29bf1bd7dfb0fe799a29bb9162ff3c873857fb7c354843d7d022e11a9c842cd5

Sharing

Copy URL Twitter E-mail

General

Target
64d4eefeba27b578640beaf6859ac311_JaffaCakes118
Size 793KB
Sample240521-1dl2csbb63
SHA256 29bf1bd7dfb0fe799a29bb9162ff3c873857fb7c354843d7d022e11a9c842cd5
MD5 64d4eefeba27b578640beaf6859ac311
SHA1 f6ea710aac2fb4464dec25b71d3279104e332e41
SHA512 fa55dff9147f5977f9208d0eecebfff3e90013e09ab8bd373599003688ab97ac3cb0e6328a0acf472654a562cc42baad9e9b67d7bcca9a3c54024c86f56d561f
SSDEEP 24576:85mTMc+53iC7On3GH8fZbHNRwHFKdJMI997o:1Mcyt7AhNHNRwg/c
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  64d4eefeba27b578640beaf6859ac311_JaffaCakes118
- Size 793KB
- SHA256 29bf1bd7dfb0fe799a29bb9162ff3c873857fb7c354843d7d022e11a9c842cd5
- MD5 64d4eefeba27b578640beaf6859ac311
- SHA1 f6ea710aac2fb4464dec25b71d3279104e332e41
- SHA512 fa55dff9147f5977f9208d0eecebfff3e90013e09ab8bd373599003688ab97ac3cb0e6328a0acf472654a562cc42baad9e9b67d7bcca9a3c54024c86f56d561f
- SSDEEP 24576:85mTMc+53iC7On3GH8fZbHNRwHFKdJMI997o:1Mcyt7AhNHNRwg/c
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery persistence spyware stealer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CheckInstalledKB_15-02-17_3_1.dll
- Size 78KB
- SHA256 92d2e4031540c2db9938f257e4c25fd61f3d8fce9397a6a7a83a6604a40c0c8c
- MD5 d2098d2c2d7d35c0d3c396ef6206b867
- SHA1 10d7bcdf07c9b3fb784dc0d6a6983d6846422e9d
- SHA512 61a2b45382feaae5ac75f2a9a250d2c2098918c2f89f53eb0ecfedcb63f7db87b72d27ab3c3602e62f6ec7a8bddce287cd49fa74688eeb6387ca4cbdc796436f
- SSDEEP 1536:qbTMRUnE8Yc506eYYh20inHOVxcoG5iX7UXqI:6dnElcu6eRdVxTG5g7aq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/CheckInstalledKB_15-02-17_3_2.dll
- Size 78KB
- SHA256 92d2e4031540c2db9938f257e4c25fd61f3d8fce9397a6a7a83a6604a40c0c8c
- MD5 d2098d2c2d7d35c0d3c396ef6206b867
- SHA1 10d7bcdf07c9b3fb784dc0d6a6983d6846422e9d
- SHA512 61a2b45382feaae5ac75f2a9a250d2c2098918c2f89f53eb0ecfedcb63f7db87b72d27ab3c3602e62f6ec7a8bddce287cd49fa74688eeb6387ca4cbdc796436f
- SSDEEP 1536:qbTMRUnE8Yc506eYYh20inHOVxcoG5iX7UXqI:6dnElcu6eRdVxTG5g7aq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/Processes_2015_02_11_2_1.dll
- Size 56KB
- SHA256 d8d618d75d0c01c39bfc0827d1414c2aeed299cf541d3387322d0fd91bfd06a7
- MD5 0dc4361cc10bf4609baae53cca018a58
- SHA1 b69e3ddb534f4ad10b6a532c9125b372ac73abc9
- SHA512 1745d39ebcdb898fa752e2015356131e53bc064e79dad04c9b2917aa237088110291d8ca813e67ea71aa6c03614194a9c52285bfe7f18abe5c8b862b8520c293
- SSDEEP 1536:J0wO3mVw8a7HzpyHrHhQl27ssSsVK5bamG:f6UimSsVK5mf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/Processes_2015_02_11_2_2.dll
- Size 56KB
- SHA256 d8d618d75d0c01c39bfc0827d1414c2aeed299cf541d3387322d0fd91bfd06a7
- MD5 0dc4361cc10bf4609baae53cca018a58
- SHA1 b69e3ddb534f4ad10b6a532c9125b372ac73abc9
- SHA512 1745d39ebcdb898fa752e2015356131e53bc064e79dad04c9b2917aa237088110291d8ca813e67ea71aa6c03614194a9c52285bfe7f18abe5c8b862b8520c293
- SSDEEP 1536:J0wO3mVw8a7HzpyHrHhQl27ssSsVK5bamG:f6UimSsVK5mf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 72830b70d5758a90713b4f0f5c7138a4fe5b78a82a25ede01d6adb5e55e96798
- MD5 b56556a129ab99dee768c15dd7fcfa2a
- SHA1 3bacd77144ee06732fc0e595c7f1635382c9b6ba
- SHA512 8b5899f8c14bb2b5de0cc6e6a8b2bdfe6f6161f4cc80c9f01fa49155f3ac72022d3a27ec7a7cc0dff7b699974df688cff1cdc61496d04f21119c9a7b06e41511
- SSDEEP 192:2muTUV6D5KgWuDGY/nV2kU1ZH460axh+aJNPtHx3JyVt8SRx9Lo:2/HYglP/nVCFvAMXRw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/System_1.dll
- Size 11KB
- SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
- MD5 2ae993a2ffec0c137eb51c8832691bcb
- SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
- SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
- SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System_2.dll
- Size 11KB
- SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
- MD5 2ae993a2ffec0c137eb51c8832691bcb
- SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
- SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
- SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
- MD5 4814167aa1c7ec892e84907094646faa
- SHA1 a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
- SHA512 fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067
- SSDEEP 384:3A7q72y8XYDSDJe7H+KXKKK2KRKuKZrjVo787foI7:3sygyraXjQ7Zl99
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/UserInfo_1.dll
- Size 4KB
- SHA256 77b40d42606d48f817b901f1e5abea114b4288b344b8c193bf3e3c52e469a926
- MD5 d1e37112390e6bcca8362788d61becf5
- SHA1 d97888f0f69d34de202e7c68b8ff5b2c2fec4c5f
- SHA512 04121e5241ad14890095a6cf5e698979820fa97d911918b9b77f2064a713e20f4827f72c057d5da1789bc340d63f391872fe5dfbb79e6c33d3995f82c37fa51f
- MD5 SHA1 SHA512
Score

3^/10
behavioral19 behavioral20
- Target
  $PLUGINSDIR/UserMgr_2.dll
- Size 55KB
- SHA256 54a9ab4ac127d950ad293a71f5a496af3ab09b70aa73839fd0f1c9cbaf35f70e
- MD5 74813d238f84d5c0f5328bd7ba79537a
- SHA1 5aeecd94f0902bad1572fd2cceada9ad44af6725
- SHA512 ac7fb85c6375bc3e0e76b535550b604cbad31e69696030314f34e41d3bb5c04411ec826c89885c30556649961d45061f501db6a37a23bb419e4f1e7cea34deff
- SSDEEP 768:WThBSJtwQegACHpCygw5eKeK/B/viiTRvTkujLWf2UEHzDSZA7yM5jt/BJE4lW:aSCQeLCHpCyNV9ZTRbkuOQzyMVt/blW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/inetc_17-05-09_1.dll
- Size 35KB
- SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
- MD5 51843d1334d3d9e751622541bbc76131
- SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
- SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
- SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  $PLUGINSDIR/inetc_17-05-09_2.dll
- Size 35KB
- SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
- MD5 51843d1334d3d9e751622541bbc76131
- SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
- SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
- SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25 behavioral26
- Target
  $PLUGINSDIR/inetc_17-05-09_3.dll
- Size 35KB
- SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
- MD5 51843d1334d3d9e751622541bbc76131
- SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
- SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
- SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  $PLUGINSDIR/inetc_17-05-09_4.dll
- Size 35KB
- SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
- MD5 51843d1334d3d9e751622541bbc76131
- SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
- SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
- SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral29 behavioral30
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 518c3bb40f6e7c37beb3483284c12ed44038ae2a56bfe1604ffea6330f31b0d6
- MD5 83cc33553a3b7aaefbfb7af4aa97ab08
- SHA1 484ddfb9bde560fe354e5c101701c78564ab6ff8
- SHA512 109ad559efb49fea41d39b49852c0d4ce5f611c75ae137e489231a3c260ba79a17918e71efc2d65d9e18cebb697044159784369bed32ee442c496716e63bf1bd
- SSDEEP 96:yYPLOGJbpWd8k74+PAIfbGn0JOu4YTnqJ3yd1vrwcJG/05sVarU+TvQN:TaGvu8k74+PPymqYTK+rwcdsVatTv6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32