Overview

overview

7

Static

static

7

2a27d644a5...18.exe

windows7-x64

7

2a27d644a5...18.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows7-x64

7

$PLUGINSDI...ON.dll

windows10-2004-x64

7

$PLUGINSDI...it.dll

windows7-x64

7

$PLUGINSDI...it.dll

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    2a27d644a514962bc5abc6194dfc5298_JaffaCakes118

  • Size

    284KB

  • Sample

    240509-qmdq8see56

  • MD5

    2a27d644a514962bc5abc6194dfc5298

  • SHA1

    81b5c5dcc812d5be926ccff41ab3c4f89fc1adea

  • SHA256

    108636fe141b7d2ebb2ebcb89c2beffc43be827a8bb4e2f9313cbb26a5d3b327

  • SHA512

    569326108133c4185950ce16bf6cdca70e276bfeaae48f25a9e848a2adc8f52df525d9839392251e357fce6609e7f81a4aeabcc4d20ab38cfc2213ea0d3d5a05

  • SSDEEP

    6144:TAQnIaoY3ZkA+MVc6qP9sVfrNQ2TU6Lyu6urpjwmk+Zt:dGShqmVjq6GWdjLkOt

Score
7/10
upx

Malware Config

Targets

    • Target

      2a27d644a514962bc5abc6194dfc5298_JaffaCakes118

    • Size

      284KB

    • MD5

      2a27d644a514962bc5abc6194dfc5298

    • SHA1

      81b5c5dcc812d5be926ccff41ab3c4f89fc1adea

    • SHA256

      108636fe141b7d2ebb2ebcb89c2beffc43be827a8bb4e2f9313cbb26a5d3b327

    • SHA512

      569326108133c4185950ce16bf6cdca70e276bfeaae48f25a9e848a2adc8f52df525d9839392251e357fce6609e7f81a4aeabcc4d20ab38cfc2213ea0d3d5a05

    • SSDEEP

      6144:TAQnIaoY3ZkA+MVc6qP9sVfrNQ2TU6Lyu6urpjwmk+Zt:dGShqmVjq6GWdjLkOt

    Score
    7/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      21KB

    • MD5

      62cd3e9089314d24f0817c231dfa859f

    • SHA1

      907fc4cef9bf22b3814dcf1cd06fc2b3c3ec842e

    • SHA256

      93530c4c3cfa4a6c87671050a52eb673228a597e9052622e57bec02fec5328ce

    • SHA512

      ccbe4f18013fd1055ca575d15faec1773268404b5dd1af40de865b39bf18457ca8d9078d3d3932fffdcebb5e76a807adce39b1091bda897ca53d60c6798fd041

    • SSDEEP

      384:1DBI+2XKPdeyYTpLhDaSR61M01rP41WKSthVGBJwSAkBMyO:1K+2XsdeyMRhOSRAn1wWXKM

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      24KB

    • MD5

      e7143c9655d4d4a9efaa578748c6bc45

    • SHA1

      f8ac5c6ecf4847e1bbeafe021881a46e20f09e7c

    • SHA256

      5c25a47da05d6ec943baec00977aae4825fe06db370b765afc1a5d39670ccbe2

    • SHA512

      deadec14af2048188ae6c56cacec0fad9e9c86bbd352e664a999f2df8d0cef23575e6cc85bdfdc5105d69f5b0bdcca95a7b9f052f31676295ab6e3cae01cf8de

    • SSDEEP

      384:EjuFHgNpQsSBO9+N5qoNvRjEJMmG+cGSjOBhpVPY8cCBfbwdxc4:ZOkooN6JMmGU6OBhbajxp

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      13KB

    • MD5

      431e5b960aa15af5d153bae6ba6b7e87

    • SHA1

      e090c90be02e0bafe5f3d884c0525d8f87b3db40

    • SHA256

      a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13

    • SHA512

      f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8

    • SSDEEP

      192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      25KB

    • MD5

      29e2dcdfb57ee3ab5e2bbc2fc3c42f02

    • SHA1

      bd6cafcce5b70ee15311f9f53e9fd4aac819ccda

    • SHA256

      2b7a69e98ed4975fd4eade513cff17099c43b3eebe7e7641696d1d20e8e14b2f

    • SHA512

      f71c981b3b5308566b56156462d106ebf8e49a32e55b70891f9d70338941afd347cb4df374fe38b9b3d7309f63dd75a7c80ebe02bb8941d558cd638a6f8daf7a

    • SSDEEP

      384:ViY1+aFplLBSgN9afuzwZAEecpuB3NVeMUPOSya4fa0Ac9khYLMkIX0+GGxky8oO:ViY1+a3e1mwJKVSPO5a4fsO

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/license.rtf

    • Size

      1KB

    • MD5

      c452ea7c31e8d224d964f16fe6e494da

    • SHA1

      ed0427f2e1c91ae16bedc6ea510b5c63410ecf51

    • SHA256

      95d1d9bd4ad8141fa3c906fa53dac773337d7678c6e9916e13ef31f251e30bf7

    • SHA512

      435e79aa30ed67b8609064898964cc20e3e815d45099ccca1d8e6e8a28842e02757a527a9b8be609044a53106a4cc80087e5f48c6d2a26fcc7e4b8da9f668a39

    Score
    4/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      11KB

    • MD5

      66cfc94903c8cfa492fdab42bde2026d

    • SHA1

      d07194419d914eae5dc54a480ebddb0a8cb32f25

    • SHA256

      82e21860521feea4d15ff7f30538b9d0ed1860747c98549ec85217178a6db632

    • SHA512

      ecbc2c9361bef9332fe8e1675d11884c344b26f437eee9db3ec0b5999bf20e16b1d863c192e2091375a870cf8f4674deec16875ba56757b88cc859288305eeb7

    • SSDEEP

      192:mMmfEKSweFA9/H5aE3KRmQv295JrbQMH2klPdIobEEdTFdHg:OfEBwe+VH5avmQv29XrUMHVlPFEEdjHg

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/nsJSON.dll

    • Size

      7KB

    • MD5

      b9cd1b0fd3af89892348e5cc3108dce7

    • SHA1

      f7bc59bf631303facfc970c0da67a73568e1dca6

    • SHA256

      49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

    • SHA512

      fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

    • SSDEEP

      96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/nsRichEdit.dll

    • Size

      5KB

    • MD5

      02f1858b3131ffc3fc5e3a5391d3a489

    • SHA1

      454a6d749cf55ff990bd9f57941aca9d1f1674f6

    • SHA256

      f00bd6d3e7c7b8e8ad18b7dc6275fb80cc720fb164200a6506f50f6e66998b12

    • SHA512

      8147fa8014a5065f4fed7de1fbb9c2ee2c1b94d63596f7bbcf6821ecd41a73d25ebdfa1e71ca74d7598cba063042b6dfcaf050a23d0c855a7b6fbc94147ab41b

    • SSDEEP

      96:Z3CA+/dN6g2Aznq+1kaNar7ta6mKAJN0u4KOhB7lkZ3hBjB8wZ:Z3G/D26EaNar7QKzLdZkZX

    Score
    7/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks