52dc7c72b26bade4bdee1d62188dd34e97358912e109a1ee61868b8b9d134905

Sharing

Copy URL

Twitter E-mail

General

Target

75eb9f9cc2239b0da27fcc0def63da5c_JaffaCakes118
Size

1.3MB
Sample

240526-sth1msbh57
MD5

75eb9f9cc2239b0da27fcc0def63da5c
SHA1

abeee3aa8385645cb94c9916640ace2d2e370e46
SHA256

52dc7c72b26bade4bdee1d62188dd34e97358912e109a1ee61868b8b9d134905
SHA512

4642dca44190c91a2e0ee9cafddec281c4544225f0452614e567b0fa5ae9737b1fd3e675dc7bcd53a21ae9b2e3c8c1372a0bc3189c5df527076644e03f55d04a
SSDEEP

24576:G8TvwCObbLFeCxekNWRVQfPzxyibAKU0ejvqLYRKHDPBZO9FJrGw:9bObbLzIEPlyib3rJLtjLO9F1

Score

7^/10

Malware Config

Targets

- Target
  
  75eb9f9cc2239b0da27fcc0def63da5c_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  75eb9f9cc2239b0da27fcc0def63da5c
- SHA1
  
  abeee3aa8385645cb94c9916640ace2d2e370e46
- SHA256
  
  52dc7c72b26bade4bdee1d62188dd34e97358912e109a1ee61868b8b9d134905
- SHA512
  
  4642dca44190c91a2e0ee9cafddec281c4544225f0452614e567b0fa5ae9737b1fd3e675dc7bcd53a21ae9b2e3c8c1372a0bc3189c5df527076644e03f55d04a
- SSDEEP
  
  24576:G8TvwCObbLFeCxekNWRVQfPzxyibAKU0ejvqLYRKHDPBZO9FJrGw:9bObbLzIEPlyib3rJLtjLO9F1
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  3KB
- MD5
  
  8614c450637267afacad1645e23ba24a
- SHA1
  
  e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA256
  
  0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- SHA512
  
  af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral10 behavioral9
- Target
  
  config.dll
- Size
  
  1.3MB
- MD5
  
  f7d35c2278ddc74320da8e433067ed0d
- SHA1
  
  820794c1b818f22af92c2c9f51f02737d19d98d7
- SHA256
  
  0532f140d364c23a6f3f7e7c1cecdf25a1307405c981e17437f9c4c6ebb55bf9
- SHA512
  
  3742e54969208fa55690f357737b9ec7767dcf32f2d14a3d0eeb9a7f8ecd035c54fb89a9f3dc03c0f10fde5f2237683aac6071629d83afc0292af640163351a4
- SSDEEP
  
  24576:W6oMrkAGFRl8sSaaxIHkNkXcYtUk8cSkTsYO3yhCnTt:XoMrkA08GNH8yOkTsYO3ECR
Score

5^/10
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  
  iconAnimate.exe
- Size
  
  300KB
- MD5
  
  024badafe2bb463c0b68a45b4f5fa2be
- SHA1
  
  59ccd68a0f8ff80f778f61d8601ac4aa2bbda0b4
- SHA256
  
  80847d220052e7b401d1d77f42fba9abc3bf2dddecc1717d8182e55887aaef4d
- SHA512
  
  2077637d0b8837cc55e94b13961e7c8550a53832174cf856f83eba7fc86742661cba87d8caaeb1629ea4fb8052d55cd912cda649720ab6efbcdaa30ef3df1c44
- SSDEEP
  
  6144:xy+1YkUbLToAdOFKnlVhukmKiuwv11rf1Ar3Qu:xy+JUHoAd3DiuwNV1Ab
Score

1^/10
behavioral13 behavioral14
- Target
  
  iconTips.exe
- Size
  
  260KB
- MD5
  
  7700eeac3827b10d27396da858d0ca31
- SHA1
  
  726066913e7a3b9628996e32092e360f707c2953
- SHA256
  
  e9fe9882567e9bc46b755d5416599754840087038087d0734d63bc2a5376233c
- SHA512
  
  cc751c86e0256b4a8a0d95d87c22ff2a36eeabcd405dcedad96470e7a45fc3c5aa4053fe6c5b68d22f0d3ca86b0655e5da1411af2ba07dbddda3748f3fce7831
- SSDEEP
  
  6144:wFvZPEp1ifAQo/uhUHuofEN47ehnhX13uWRLjNi043rGrVAw85y3whM9mc+rqWG1:L5NEAOkW
Score

1^/10
behavioral15 behavioral16
- Target
  
  mk_vcmfc.exe
- Size
  
  31KB
- MD5
  
  643c30508a7edcf90e391a51bb130f23
- SHA1
  
  18a91a89c08516dc1f42f2334012030ebbddc4dc
- SHA256
  
  b9cd5912cf3fece5fcd42d884eab64d9819074477b6893ede5f8bb8aa13ac6b4
- SHA512
  
  fdf85af0bdc65799af08f9cd3cc9e636e0ac16726b0feccf20c583718a18cb8890178869fbe57b4b4fcdaee3e0ae305b55da43c1c20ac75968918efa464d0781
- SSDEEP
  
  384:z4hQW0VFVOxnGJCkSaTW3kDO4v+W6a1qwU/4R/MlvLLTgHeNp+boQmaqIeco:zXW03WeztZq+PqwhivLLTgH2haqI
Score

1^/10
behavioral17 behavioral18
- Target
  
  uninst.exe
- Size
  
  289KB
- MD5
  
  06701f28530e0f834498faf10977c1d9
- SHA1
  
  4d120306c427fe6a2af1c934f92b8caed8d47bcf
- SHA256
  
  50468a25b87f5044d5e457abc34117ad3efb37e0eae60b65668559dc3875dbac
- SHA512
  
  3b89056053af671f16de09de5ae4c0600c6e3c8af98898da7859cc6f3ef2e7b214746aefcac91c380838627613ff6b7792224c28c78393d07d91aa711af3cdfd
- SSDEEP
  
  6144:Ue34FVc0Mqrm7Fq1rQAZvTEkA+F2vklbYE34s3TvJ74qjG:GV7aCRTEf+Fckl/xDvh
Score

7^/10

bootkit persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  3KB
- MD5
  
  8614c450637267afacad1645e23ba24a
- SHA1
  
  e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA256
  
  0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- SHA512
  
  af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
Score

3^/10
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/inetc.dll
- Size
  
  20KB
- MD5
  
  c498ae64b4971132bba676873978de1e
- SHA1
  
  92e4009cd776b6c8616d8bffade7668ef3cb3c27
- SHA256
  
  5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
- SHA512
  
  8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
- SSDEEP
  
  384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG
Score

3^/10
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  c10e04dd4ad4277d5adc951bb331c777
- SHA1
  
  b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA256
  
  e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- SHA512
  
  853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP
  
  96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score

3^/10
behavioral29 behavioral30

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Deletes itself

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30