6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da

Sharing

Copy URL Twitter E-mail

General

Target
7b11be2b7d46c6636f3586efd0357816_JaffaCakes118
Size 22.7MB
Sample240528-appnhsgf72
SHA256 6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da
MD5 7b11be2b7d46c6636f3586efd0357816
SHA1 b5487ef831dc11d9cb81670b7cd370ad88aa10d1
SHA512 7474315fdc77154502567194d93f90edec02128faa874995257cd8bd83b99d9e41095aa90a01c2982ba3a3e0181b8eb6c7537d87595783b2a449301fea06213b
SSDEEP 393216:kmfgNOWKmd5Dzsi8V52+LNhmQyQGn6GWRuwl15+13C36SO4kq/R/6pNPobGKuLpN:kmfgbKmdZzsiQZLbmqGX8Hz+13W6SO48
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  7b11be2b7d46c6636f3586efd0357816_JaffaCakes118
- Size 22.7MB
- SHA256 6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da
- MD5 7b11be2b7d46c6636f3586efd0357816
- SHA1 b5487ef831dc11d9cb81670b7cd370ad88aa10d1
- SHA512 7474315fdc77154502567194d93f90edec02128faa874995257cd8bd83b99d9e41095aa90a01c2982ba3a3e0181b8eb6c7537d87595783b2a449301fea06213b
- SSDEEP 393216:kmfgNOWKmd5Dzsi8V52+LNhmQyQGn6GWRuwl15+13C36SO4kq/R/6pNPobGKuLpN:kmfgbKmdZzsiQZLbmqGX8Hz+13W6SO48
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
- MD5 67d8f4d5acdb722e9cb7a99570b3ded1
- SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
- SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
- SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 b15b1fc88d1b56088b2d3738d76772a91fa186a316a3e0a154358820d0fb9005
- MD5 410a586735f45164c86bda363ad8446f
- SHA1 a68d18a8c72ffaa8f8d9ed9f76ea9b0ed397821b
- SHA512 d12083f67df132b2be57c202601a0cf82dba4c234910e780d2723aac14ae68407b824405b04737b55104bc97750550a3271a944d647661b067ce134075e6cc2a
- SSDEEP 48:aYZT4WeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8m+ofYZVSA:JCWGSxamjHNDuWRWBBWvmuV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  7z.dll
- Size 925KB
- SHA256 ea50f78c5b059d910a5f7cbd9ff8270006a75c218ea49d31e499984f0ff24a34
- MD5 7ed8309941fa7ccf969a8d6a4e8c60e9
- SHA1 e195dffc8801a18e618e5f621f3dec2978dc00d8
- SHA512 552b7a4cc2cbd20f8719016c9865c1d82fd350678fc5ccd7180b53011891295c065b79a49340ba1e74c9d60d0bb35d0bb6bd6776cc88c361db8db70b9901817e
- SSDEEP 24576:FV2HCCoh4NzNungvvkkMcrnZOLY3bdYUC:qi7yNzXh7rnZOM3JY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  Addin/npTongbuAddin.dll
- Size 64KB
- SHA256 ddb0b302d6fb1291b8d6fc72163f9f3b1ef33fa1768a38e86859747318a67fd9
- MD5 20f76a9a47c0ddc38c85505c004e311b
- SHA1 e57cd89b59824307c3f4fd06d8b18d2aa17c124c
- SHA512 be602d0f9911de5af1e41530b5335fce0ed5ff72dcc254c94ca4fceb126df70a376c066baba2b0ceb9c5ece6a863c2c28bfb042a6a92c491396c2d40a28c6b3d
- SSDEEP 768:Qs4hbPUK8O9HLv0d37zi9hbfVkLhuCilrRSI7y1rNbthtqph6kgx4XOgNzl3:l4PvC/idkN70RZ7GFthUpYbxuOgNzl
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  Addin/tbIEAddin.dll
- Size 72KB
- SHA256 7f87f707d9caa79960e7d1ba3cde821a54168f16733f1b0ea45d08980ffc1f1f
- MD5 bae453b9ec58c089066aa316d2c6c38e
- SHA1 b8f0c04adeab06f8ddd18429b9b09e341e19234e
- SHA512 5c6a8a5e7622be3b9e213341b35ccf55941dc155552b46c7dce39de5146de85ebb21734de4c5b68c8304aeee621dcf537c260c94e9ff9d47a55d7457295a0605
- SSDEEP 1536:cLbTn9MKotCWfeI9rCSkNyjIxkqOA14dbHN:wT9Mdvfe4xkojIxdOA14dbH
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral13 behavioral14
- Target
  AppUnion.dll
- Size 11.2MB
- SHA256 7887d29cb9ddd14c46c43329dd56946bcad5d2c8d0998bb63df44b2a4f85bc87
- MD5 94b2b17a8434fd1e8907e0c917d01aed
- SHA1 6b3b19470bde1d0e51a9d998fa1ac747bb6ae156
- SHA512 811815503ead796e3469995cc5227e69a0fd8b6635a3817408f965ab6c60c2490f67290d495709a6c8acfea575c613006d84f80cde4c289cf9157066ecaa4893
- SSDEEP 196608:R7kO9ybKFxiYnr0tF8s4CvbktX5lKLE8+Ynw+gJanC:Rk6qKWYcGsZvMX5lKzHk
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Biz.dll
- Size 12B
- SHA256 193ddee0d7da03b66f440df5dee6efc0d630c378ad5121980141785b5b28ca3b
- MD5 a261db7c8aa1ed79b1bb0ec923d8f908
- SHA1 34677fe8a8f02352c4290d42161266059180fecc
- SHA512 d2a969baf1782bd7f7f8ebdef4044ce32badcd44e02f32d90cae091ac7b1d926ea68e4939eaa3325cda1d1b150cfbdf2c92fefa85209fa2a7647e23f494747e0
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  Codes/ffmpeg.exe
- Size 2.8MB
- SHA256 7c5edec7615a71bdd22b6a6add273e910bc7364cb266e7cfd2d5a753216218e0
- MD5 0bfb6cb6f957e89ab2ae65b410cf9f64
- SHA1 70b69205072f0d2cd586738b39572910463510cc
- SHA512 723b90c4fc9b273e269a1295249e612677aa17aa7cb7e0a281d298b2bfb368fd65860267107d0e7cc6f8475607bf50c96762bfd760b6bd9f75bf571fc10eec07
- SSDEEP 49152:GPQakj9g+C5WYul343x++o0BveKrCo3BhC7rAT5IfZ/q:GOjUvAgro0QKrCA6ATu
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20
- Target
  Feedback.exe
- Size 93KB
- SHA256 098fab95cb882645ecfe1ebae770c0909072d38f97ad2b6850dfeebb7d4cfb3d
- MD5 b2702c48dd0513c26901a88ed90fda8e
- SHA1 52bddadee61dccb06bf67e55f0764910e42b94ac
- SHA512 ff9302afdd7c18db64015dd56a0ade9cffa81961a7b3a165dc62ff7424054fea6b4e1c582ad2067c2b48397f76b597c2bbb3a8946ba7b39c5eb40caf518f405a
- SSDEEP 1536:1h6OZXJT5+HxB6uWqjt6r+vcI6RhZXJT5+HUu:1wOZN5+RTWqR6RhZN5+h
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  Hash72.dll
- Size 387KB
- SHA256 fff0098e9976a2a26a49a54cb133ae6acd29f98660314af9190d9edc6917acc0
- MD5 70aad37d50f6f21c42266a98b7e665d6
- SHA1 346cd54035e37f8c74d38542e301d7c05c4318b4
- SHA512 21224488400a124f65cd147185d851e41e8089c31c9a80512cb66c077679cf2011d6b35315d1bd638e2c56d0bc36cc117c6062a3838402d446e485c7a4481c01
- SSDEEP 6144:WPJbFOniW8UGjgpUnLO6AdFbFiiMNdg7ZXyRgZr0TED5RXH3x4rXtgrQtbguHKa:gb6qUaLOHkiryCrVRXHh6iMiDa
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  Helper.exe
- Size 185KB
- SHA256 34cb735fe65d0b6e00886ee9cd73b86562dd1bf3c25d5147fe17035cdb9c0875
- MD5 00fa398b8c5dae607879268d33adfd2f
- SHA1 0e1aff2bf74077e5ab8f2d05cdcc2b1575fe3895
- SHA512 6058431d2d31dc1bb1ca5f83fbbcf4a3769d2e2889fdc6347fd899da74673d50e46b99481c93a4919bd0282cd2d27c77321c7233792c97f83f3d0fb42209ed0a
- SSDEEP 3072:WJKCzzm4lBL0x/Jq9fak+9fakMNpa+ga20Y3g3a0d6MczNC2d9zm4r:ku4lBkJG/S/YpV22MC2i4r
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  History.rtf
- Size 42KB
- SHA256 ce04438ea65a55b1beefd801f19b81cea9fe44f933ac8a3ec06c00657e695bae
- MD5 8848f77d9214b6ded4a3fd500856f651
- SHA1 38c1a3eccbbeedf5a68dad736133ffaaeb8e135b
- SHA512 134361272b5c6ecf154657ea72f8051e00fce4bee09ed3671948af5d96bb83c880e06646a37b7e4de52cb6e3d1956a40218f4e41cfa10371b30fec306d7d4400
- SSDEEP 384:AAPbA+yE9K6mGmQOb6RBy96P5KEKPeo75Y3kMpwmBa5qd9:AAP9zKYZFb
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10
behavioral27 behavioral28
- Target
  ICSharpCode.SharpZipLib.dll
- Size 196KB
- SHA256 5f3275a619a224ff5e867039b30a147291db8d0508f72e8a24b674273062cff6
- MD5 d462b957f90310ef2d4b3406b02b0887
- SHA1 2b61ed8e77ab4d63bbb33894dddc56d35741d8a6
- SHA512 41fa681124a3e5acf3edecd6d996b868aeaeb7e55cce2d9dbdafc12f2435c819133bd18105481ba20a05e174c617df777e5cddf6067cbb9df789b1d300de090e
- SSDEEP 3072:EcVZDNmywB9hgBtZZXMDcpeCOIVyVQBpd2SzAfQFrr2b2DwiItzyxyAtwy8I:EsNwBjItZZXMgp5PVyVQBppzAf2uj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  Launcher.exe
- Size 80KB
- SHA256 fbe0dfcd053290c88edb9404ef78a8c890a6cfea499c5e596e22c492478a1228
- MD5 9d8e49512087b973cb3f889043384915
- SHA1 07d2b7661e9fcbfd7dbaa247b3ecd24ed613e8c7
- SHA512 e939d5f552ccc5b613c403de46e72c5e59f4e8516c5e7b533320f9a39623bdd4861ba1bbf2a744c6da9dc13107e2ef901170478084b93a6c4876698a09515a1a
- SSDEEP 1536:eiy8YBr321Er76ZUiCGDh2GWv6NJg59A4fkl6CxthIcYK2kpzKXJTC+hbeD:eiy8mDt76eGDKyNO55kljx2JXNC+Bc
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence upx adware stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Installs/modifies Browser Helper Object

UPX packed file

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

Installs/modifies Browser Helper Object

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32