0d4e910847a8da89c1a61e75ddd8db232083e735486178457c547e6a3958dcc1

Sharing

Copy URL Twitter E-mail

General

Target
752b8a6b45ceb452cd4ef28e8f9d3965_JaffaCakes118
Size 34.4MB
Sample240526-md41aaff62
SHA256 0d4e910847a8da89c1a61e75ddd8db232083e735486178457c547e6a3958dcc1
MD5 752b8a6b45ceb452cd4ef28e8f9d3965
SHA1 e737a6c2fea43b9a5df2e85f90299fca3416f39e
SHA512 91b7baaea54ab4feecdae6ba5d8aad7376c3e50eed649f9d8630744b333ccedbdb1cace441bec5fb6942f83b4ca2ee67bf8059eb97012bcfccd7a88502d17676
SSDEEP 786432:/XCfiZDJsTvuBLeSqiPGBWnd9X5+MG+jmmXt:/XEiZWVVQP5+MG+jmm9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  752b8a6b45ceb452cd4ef28e8f9d3965_JaffaCakes118
- Size 34.4MB
- SHA256 0d4e910847a8da89c1a61e75ddd8db232083e735486178457c547e6a3958dcc1
- MD5 752b8a6b45ceb452cd4ef28e8f9d3965
- SHA1 e737a6c2fea43b9a5df2e85f90299fca3416f39e
- SHA512 91b7baaea54ab4feecdae6ba5d8aad7376c3e50eed649f9d8630744b333ccedbdb1cace441bec5fb6942f83b4ca2ee67bf8059eb97012bcfccd7a88502d17676
- SSDEEP 786432:/XCfiZDJsTvuBLeSqiPGBWnd9X5+MG+jmmXt:/XEiZWVVQP5+MG+jmm9
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Src/Protocol.dll
- Size 668KB
- SHA256 7c301b9c44cae3a53a4f939a391ae36e79e29f9216fc903665b4551426cecd90
- MD5 a438e303cf31126c5d6b882aeded21a8
- SHA1 eebe92a2e07ec209e6c366899938d2f7677e9977
- SHA512 ddc47c35d7b662e939d471e07f5f45e979abd4df14b334c5c12f229f7d185bb9925693d9dd71e36c97eef02c92f961775f5d7cd605b36af9e6a5c9d83af3964b
- SSDEEP 12288:dmaGqDdZHrLgjYSrXJ2YSIAkL2dFHZluIqNqSayOUpJyOwC+ATO3se:Y9qDdV3YWKNoSrHpJTNhTcse
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/Src/Report.dll
- Size 316KB
- SHA256 3347ab083d69d9d4bf6c8e6816c56a1eb694b581721965ebd44d240fe956e164
- MD5 98a2b4d094fa825e601b1f68752d4ac5
- SHA1 0197c18e2443b53add35870df81a0123acbaa0cd
- SHA512 47ef8d5ee9273a41169ec522245869f6d9d90b840d56d88e68bd693b4d1b4243b005cede1a5f9420ff1a5240f7de8ba7a5b915b846af9e1c57a0d4eaa584d53d
- SSDEEP 6144:1Hmqik5oLytEct4Cz7UWi9F5ZqDvdVfb/f:pmqik5dtEc6Ccz5EDvPfbX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 19KB
- SHA256 714bd22a836a7f164b848541b8bf8ac80a20ff38e10e412bf9ef518620a80b8c
- MD5 35d7b29c3ed690a8b0cd323917677b42
- SHA1 ad74d2babe09f94838e408c8f9f77b6b56c644f5
- SHA512 abc6f37b7306de737adf998607e81304ecc1589ac8e3164651b237def11b424a190e84608f4f6ce44a63ce225d93be7c617a736c82fb6b9077c5222c2e17b67d
- SSDEEP 384:4JoiO8V2upW7vQjS//nYPLQa6jvjeMN+:4JzO8V2uovQjoym
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/chkm.dll
- Size 74KB
- SHA256 2061a94b4d34a77f935f95a3741f917c91b27d0e1585c2ee2f8e00806b671db7
- MD5 3b8308f1dba641b49a642fa6d92f3451
- SHA1 a11164e08bd9c594b6d608c51a2428a4c6b555a2
- SHA512 dc089fc2bb43ccfcca8748013636e8d249cd91e1b08b30358d00df0decaec5782d2af85274e7b70784d4e58c934dfe5112fdcb4006de2a5dbe9c76dae9ed1f81
- SSDEEP 768:9elCeN9djBHTUURm58yTOM30Hz6pW+QLqr69p4R1t8iKkEL:9elD9djBYqyTOS0T6UBLNWt8iC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/insthelper.dll
- Size 774KB
- SHA256 d62d59db60544bd44db6d710f3b6d48608bee022d908dc46d16885e79dd1ca0d
- MD5 8bcd300c69b67e78b09cf07aecfa14fb
- SHA1 d92bdb71d8b8477a3f0838360191aecc459a3c09
- SHA512 393667c3423ed6defeca5c7c51c3244106ebb737398b34822a38edf9fa68cead72016a77c29d4f47d0c5c784c6339e8080d3b35eb17d325658a951c464951cf4
- SSDEEP 24576:Hur3XYYvDFTBs8N2x0y7J07fGYQ0gD8H9V2SM+5byEziR1BRWptMYabpeB:jp8JQPIFz41BR3bbpeB
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/reportsetup.dll
- Size 309KB
- SHA256 210876c0ff70ffaa88a05f9ef794a96136549f4168e940e256fb4ac85b0fff71
- MD5 52c3b9ac0484ece3b524a9526272f88e
- SHA1 c07268de6a13290acbf58ec5ef75e2468533d791
- SHA512 da7710404e5630509eeaf9e318e2a4a2d9c4f269aee6cdce5d2a8f128094e7c92940312fda9913f5c44dce5159b59159f40137ddb2e7975e450f30c6a7b24f47
- SSDEEP 6144:9TTPaNT41SBzliGz6WXKzoOCEIMzjKTBR2Z4kgg6D/Uuc:NrmT4uxiGz6WazojEfnKT/2Z4nD/Uuc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $R0/$R0/BaiduPinyinWin10Setup.exe
- Size 226KB
- SHA256 ab4ef02af724cce31e288a84c5847badd08c238eea6ad4fc79371c7c8be07cb9
- MD5 9707b6ee14be876babbd9298d488e68a
- SHA1 794e1ee2a2e75f86762d63952f169874584b87fe
- SHA512 0602791993f606be04a642846b7f71c0d2f238f585215667f1cf3db3b66d2aa863aabc71d45c6f4dab6efa1bcf19ebd88c1612e7252bb742648fc144607775d9
- SSDEEP 3072:44nI1jpEk5Qz/7VWJTUM6dqXd5/prGvvXKF9CSCv+FNZaqLqjYMV0uku48F8gr:4qI16k5+xWTZ//prGvvXq9xayukulr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  $_24_/PersonalCenter/$_25_/index.html
- Size 9KB
- SHA256 47b3d9f77c16d3087806a31a07cd4503827adb71297269861dc5e67f74207659
- MD5 3ae3cc4b0ae61cb1f76d7c5be021c9ca
- SHA1 ed0c9bf634226dd7ea197c223f8a42767a0ba965
- SHA512 5fea3f8a26ecb97bed4c9db32969e6d78e86c6da7b7d98475861a26217df9a32d5c2fff335b2456893ffdf036d85b80daf6295cc277e046177dfb9737bc16058
- SSDEEP 48:0WpzaQhMnrHKPiwM5xkQMOFThKBdIzQhbwvbaJtVvVi0wLF0YlALNM+5mhYUV17j:fUrHZD/FTKxbaOSbLFP4zNJ7CEm8T/C
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  $_24_/PersonalCenter/$_25_/js/achievement.js
- Size 5KB
- SHA256 fab571286fcfd1c076b54040b6823301638d5dcdf08fc379ea6632bc97406daf
- MD5 59af35f3f7021712b8bf3591e0231874
- SHA1 36a65249a0fbc9eea243db2168c1eff3599964ba
- SHA512 e3d1cd30b28d30218853d2bdfb433c6ed55adac2bb9fcf47c1a5deb31d3cdbc96d2d9f46055d9e6a61702e23a13cb5ed1f7df96e41b983ba1576943e015cf347
- SSDEEP 48:CxFc8hEJN0We/s91IU2Ze2MNpfN2ABwSImxr5wUJumcxgexe1DL9Iy1PMdh3rozE:Cxg36ZQ9e96MG9FMdb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $_24_/PersonalCenter/$_25_/js/common.js
- Size 34KB
- SHA256 fae546d7d9c85aa8ef803564e594a33609c54066a642313dff37f7b81ac16578
- MD5 643df7af49c094ad64d15a21d2562814
- SHA1 89ada5d72ef8d72e4e3b6860e4b2d1279537316c
- SHA512 4d31db7c4ff87b13c1b0cb95df75c41ce5f7fd97dcb13a9c3ad92845a95dcf003a106520919d39b7c16973cc476df9ae6078ebe9bb10d10b0c2ab8fefe63c45a
- SSDEEP 768:JK6DoGKxaiDMpk1YVE/cPXh4i9ejGqSxwb:JKyoGKxa0MpkSVE+Xhdej08
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $_24_/PersonalCenter/$_25_/js/config.js
- Size 7KB
- SHA256 df77e726865a485beb4b3bededeb6a0c64f8900b3dd0d2135e8dcd5d0f199d43
- MD5 3e09da843341da463d13a24beac5c550
- SHA1 b31cfedc9e7faa53c2a0b2659410313851869664
- SHA512 480bda924f57ee37c7ba36e25a1f5eba347c629ccdc2e14ea1ff96d2225a1b736bc30b559c80b5dd503732e01b755a87cd08230423f07532b50e666faebcf4a3
- SSDEEP 192:0QqkwiXD2dm/uhqBZj+UCUrLldEmtxU02sgIbLnu7t:07k/Ds4SQrLrTLKsi7t
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $_24_/PersonalCenter/$_25_/js/tangram.js
- Size 1KB
- SHA256 89916f61df38986873dc4c6e562011b35169d9fe0432ceae5a80d405d3310da2
- MD5 c06c852e7640cd9d08141949853726ec
- SHA1 6f48d7722df7a4268bab8b172d273441609f1b6f
- SHA512 62277d14d1d8bf26e75c2a13426755e280f818fa8d9b185a353c96100b2f95796bd839b07a411dd45e76c0a8b43f469b89f89cb28e6d6dba9507024b6b723a14
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25 behavioral26
- Target
  BDBugReport.exe
- Size 364KB
- SHA256 db05ad643a42d3c146f84e49796db419193e03d84291fde8cb4e5dd833071899
- MD5 7eb76813480fb29e40720d2c0e7d5e25
- SHA1 82b8b748382fe4be999a3fe2b4f12ccadfd35cba
- SHA512 de8bb7f0ccc4861e140c39e539908e45f4354b79976aeac2e1b937cc7a8cc112d8ec99c10a71586ef36083c94026a11478c4f77216e335b8c857b35fecfbc829
- SSDEEP 6144:ElgPNLM7flY2bc7CrJsbxTs7Y6zjoyzHUcx3cjTBqEywSEGYBoIpQ:PlM79xc7097Y6zcQrx3cjTsERxBoIpQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  BDBugReportx64.exe
- Size 244KB
- SHA256 54be9c8057c6736b188398cdb51faa406223667f52b06e2b06f1430a6052ffef
- MD5 575d7d14b7b1bec7b636b0dc3f04dc94
- SHA1 a7587536112c990fbdf7c37bfadf9cf42995b195
- SHA512 58518521ea75412e6bc6aed8282d7f87f4fbd7a331c7ef8326d7962f9c0a691cf69b6a3a6f0f65c2c4d7cb063e6eb4ad3d0b372fac753012c5d5d9d1b72d63f4
- SSDEEP 6144:1dpgIn1Em9TQa7ThngtgEeNNGz5JbK4PK:XpgIn1lVQaC5Jbc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  BDDownloadExe.exe
- Size 367KB
- SHA256 68ed1dc5216bc98e95b938643b44160805fb9564966ba3baa515df526ce6cff0
- MD5 2f5aa7abfbbf2b087f9e4dfe423bd6a1
- SHA1 c54a1c7d55272efc2733eea8c92e4e5d5b88c36d
- SHA512 f296c689b22ccf8d55f385e22f29e5e7e059daa44577eba05a8e42706abae4c9292c16fc9fe44d671ffb816960e69317aa5fbafb7e0702acf4f2608c6c0db719
- SSDEEP 6144:AJwx+zTO02TvEUSzi1G6/InjNx9LtEmCR1/gxKrpU1QUTive:AJwx+zTBtzi18xzBEmCRixBive
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Registers COM server for autorun

Adds Run key to start application

Checks installed software on the system

Writes to the Master Boot Record (MBR)

Drops file in System32 directory

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32