General

  • Target

    264b27b9ac7ac6874e50d073638930b5_JaffaCakes118

  • Size

    1.7MB

  • Sample

    240508-xtnncaae6s

  • MD5

    264b27b9ac7ac6874e50d073638930b5

  • SHA1

    4e2b68ab76ea8afaa6ef03dde72ab1ad5fd1f265

  • SHA256

    b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce

  • SHA512

    8f78943b1526f29c26f8f34571eb40b0fa9396d02876e76a7c6311340f0a7ee2826890a1cfb5f0aa0077d2726ef1458b16de33cdc55706df09a8ee95bdd9702d

  • SSDEEP

    49152:kO0e40QOdfZ7B1OHZYlLjqyJkUs75Naw4O5:kO0Z0QIfH1SM/qkkVbd4O5

Malware Config

Targets

    • Target

      264b27b9ac7ac6874e50d073638930b5_JaffaCakes118

    • Size

      1.7MB

    • MD5

      264b27b9ac7ac6874e50d073638930b5

    • SHA1

      4e2b68ab76ea8afaa6ef03dde72ab1ad5fd1f265

    • SHA256

      b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce

    • SHA512

      8f78943b1526f29c26f8f34571eb40b0fa9396d02876e76a7c6311340f0a7ee2826890a1cfb5f0aa0077d2726ef1458b16de33cdc55706df09a8ee95bdd9702d

    • SSDEEP

      49152:kO0e40QOdfZ7B1OHZYlLjqyJkUs75Naw4O5:kO0Z0QIfH1SM/qkkVbd4O5

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      d753362649aecd60ff434adf171a4e7f

    • SHA1

      3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

    • SHA256

      8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

    • SHA512

      41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

    • SSDEEP

      192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo

    Score
    3/10
    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      94KB

    • MD5

      0061a96c8ff17ad0927aae65b5dfe06b

    • SHA1

      9d1bd69d930ccda683e6b7c2c0d1dbe3b54861fe

    • SHA256

      2aaef1ed8a25097b3a807568daeffd3320fa29d6de66df90a57beaa8df8949cf

    • SHA512

      c6b887a4e1682ba1e126c93bc4d886c7f1ce392f97866e631c5b8a945824cbefc9af2429a14c2dac3b16d97bd33195d4378a7e92ae53fdeb47197452d4d90fc4

    • SSDEEP

      1536:0yy+i55jAPWrI5qXgcAZ5c4DB5G7NXE9eOO2xwN:3y+i5i+kEQcAZXGx0cr2xw

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      56a321bd011112ec5d8a32b2f6fd3231

    • SHA1

      df20e3a35a1636de64df5290ae5e4e7572447f78

    • SHA256

      bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    • SHA512

      5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    • SSDEEP

      192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8

    Score
    3/10
    • Target

      pluginsetupadmin.exe

    • Size

      461KB

    • MD5

      87daf3658c6aa863444532f1f324cca1

    • SHA1

      c0caa342fcbde6a0c6b1566e71bc051117a7c40b

    • SHA256

      c007fefe59aa783e7ea677a6275f87b9675f750a8e31a67c8325440308eed90a

    • SHA512

      050b10619e355fe16fc23bf83b7b38a5237adb80e406d79653c029182bf33a40c3717a12f80ce1e024e2afee305421b3f3947d38a833169576e1c3d0a9ebc551

    • SSDEEP

      12288:7ugClTRuCj6KxXpDKlvuONobWHp9d/MJyKRs:78TRuo6KxZeluooKh/SyKRs

    Score
    4/10
    • Target

      sz.exe

    • Size

      1.2MB

    • MD5

      5fd84590e2e1358a8e51fb76b1b3d721

    • SHA1

      eea0902b66e1082a5ba9a1ad7c4bcd3fb5d53154

    • SHA256

      bcc516b915a8826ef12689e455d0b1afaa7ad1eae534729eb43e6639a95992f6

    • SHA512

      3e9de52d11522b5115d30b51a6cf5b43e28df27432e7d0aa0eeecd0648ab1d3622b30f921bbed011681ba7c286d71053486bb0b6949103b69adab1cc4e5e1281

    • SSDEEP

      24576:hyPL2BkBGuDHCu9lpaE6ua0gY28UlyvCKk3U9wlozxjv2k6DjIVnF0SK+OGkn:G2BkBpCurMpujW8ptxOkMj6nFjdO5n

    Score
    1/10
    • Target

      uninst.exe

    • Size

      400KB

    • MD5

      7ded51e887171a321fd7f5f59925ea42

    • SHA1

      2d2654c5e0c4fb557383842a7de1c2036a2f569c

    • SHA256

      1cb9f1b81e6c5b98feddee92c9d14fff89d4b111b0c0974c6e804d7dfdc36bdb

    • SHA512

      980489325baa4c17d727334076e4228d582afe0884548bc132f4991cca6e96a92605c9b777af0b62162f90a326ee1145d2dcb056fc30390b28d6c9f015138827

    • SSDEEP

      6144:H8LxBH3+tUVHZfKfj+v9ETgRPOILnMLPAiaINBIs/IYlAJA3Tfk6:M+tUT7OKMLPTaINBIs/nAW3Q6

    Score
    7/10
    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      56a321bd011112ec5d8a32b2f6fd3231

    • SHA1

      df20e3a35a1636de64df5290ae5e4e7572447f78

    • SHA256

      bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    • SHA512

      5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    • SSDEEP

      192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8

    Score
    3/10
    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      50fdadda3e993688401f6f1108fabdb4

    • SHA1

      04a9ae55d0fb726be49809582cea41d75bf22a9a

    • SHA256

      6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

    • SHA512

      e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

    • SSDEEP

      384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      f832e4279c8ff9029b94027803e10e1b

    • SHA1

      134ff09f9c70999da35e73f57b70522dc817e681

    • SHA256

      4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061

    • SHA512

      bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d

    • SSDEEP

      96:ytJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4yndY7ndS27gA:yyj6QS8HREf+BYYxbdqn420

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoverypersistence
Score
7/10

behavioral2

bootkitdiscoverypersistence
Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

persistence
Score
4/10

behavioral14

persistence
Score
4/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

bootkitpersistence
Score
7/10

behavioral18

bootkitpersistence
Score
7/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10