2d52ef6c7d66fed4ca81a4a0e0adfad036d24653700fd17a45366826ce0ad45a

Sharing

Copy URL

Twitter E-mail

General

Target

95a9f7060da714981527add4417e341b_JaffaCakes118
Size

2.9MB
Sample

240604-vxselaed73
MD5

95a9f7060da714981527add4417e341b
SHA1

743393ac4b3f4d89891f3ac5427ff889c876a7d8
SHA256

2d52ef6c7d66fed4ca81a4a0e0adfad036d24653700fd17a45366826ce0ad45a
SHA512

5231da18fe6cc78254d454558a81b043b7f9f977adb137966d91e7b753a869f673b1356acfc5c666362ccd6daa17bf774858316c87854f8a731ef52d57155764
SSDEEP

49152:qyDuw+3Z8WBZbwraA8ZiD6iwNgLDRO+lroTCc0b9GgCdSlX9ZY9fWni+6W:qyDuJmWBZbwexikgLFO+SoJGgsSlXY9y

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  95a9f7060da714981527add4417e341b_JaffaCakes118
- Size
  
  2.9MB
- MD5
  
  95a9f7060da714981527add4417e341b
- SHA1
  
  743393ac4b3f4d89891f3ac5427ff889c876a7d8
- SHA256
  
  2d52ef6c7d66fed4ca81a4a0e0adfad036d24653700fd17a45366826ce0ad45a
- SHA512
  
  5231da18fe6cc78254d454558a81b043b7f9f977adb137966d91e7b753a869f673b1356acfc5c666362ccd6daa17bf774858316c87854f8a731ef52d57155764
- SSDEEP
  
  49152:qyDuw+3Z8WBZbwraA8ZiD6iwNgLDRO+lroTCc0b9GgCdSlX9ZY9fWni+6W:qyDuJmWBZbwexikgLFO+SoJGgsSlXY9y
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  3KB
- MD5
  
  8614c450637267afacad1645e23ba24a
- SHA1
  
  e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA256
  
  0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- SHA512
  
  af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/License.rtf
- Size
  
  79KB
- MD5
  
  6b49cb824fc11edb01d0ee4dee1bd54a
- SHA1
  
  81291caac7aaad7a439b5f8564ca26b320732b03
- SHA256
  
  7d13c20e98677d3434ee1610b8f29d6b78b71026840d9434a298d8680ca649a6
- SHA512
  
  b06a655b590e5a201a394d7f982c02c515a741653f81cb28bbca5a20097e16f2f09a81aee1648a7b725cc584f04a77825e0c5b1b5bee578ca6a21ab0f4934a19
- SSDEEP
  
  768:iNt4l3sjvUxnJ4mbjWn9G6GXBKgGYUWwlC1xVbn:ngrQJn
Score

4^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/SkinBtn.dll
- Size
  
  4KB
- MD5
  
  e4ec95271ff1bcebab49bdfed6817a22
- SHA1
  
  2c03e97f4773aea80ecdb98a1482e5896fe4677b
- SHA256
  
  ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
- SHA512
  
  771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
- SSDEEP
  
  48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/SkinProgress.dll
- Size
  
  4KB
- MD5
  
  cc037c4703d3ec257efeef2ce0a1a20e
- SHA1
  
  b3d6cc8f687a31fb2c1a5921a38de9429af20502
- SHA256
  
  888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
- SHA512
  
  120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/WndProc.dll
- Size
  
  3KB
- MD5
  
  f0cb331dd4bd92a6ebce45e7cd1cf5ef
- SHA1
  
  b66ea0c10b08750295f2dc7c170b370402393214
- SHA256
  
  e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
- SHA512
  
  7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
Score

3^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  c10e04dd4ad4277d5adc951bb331c777
- SHA1
  
  b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA256
  
  e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- SHA512
  
  853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP
  
  96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score

3^/10
behavioral17 behavioral18
- Target
  
  $_47_/Web/error.html
- Size
  
  2KB
- MD5
  
  9085af5c4c8fc9fc7c83ff132daf4970
- SHA1
  
  b91dc15b71fb30e923761b89c6a9ef85635bcf2d
- SHA256
  
  7dce7e40633ab511ea62e62943c71981e5e91eeb21ca98a1bcf5338bd3ceb3b3
- SHA512
  
  8465e6d1c5cca1e690b4c3889ffee61d2816c6fe04771fab75c9a463f73cf9bb2ae3e0b47aff9b9e30173b2d25d52bb9c4ccaf9d380bcf5d78a6e039e873722c
Score

1^/10
behavioral19 behavioral20
- Target
  
  Accelerator.dll
- Size
  
  307KB
- MD5
  
  bf6cc6604c959ae1bfe649bf18634454
- SHA1
  
  afc868af909f049c06a6dbcf2ba78dd0414b8105
- SHA256
  
  cb258957da8d6a06b876109a70c185a6097646817cafdc14c3d523f7a4f1025d
- SHA512
  
  f9f803cb5d5a0f7867b76b2f49dac2676d84d41f8c2f42a86427f265386928736bbebd4492b494e9cd1b9fe029e3f0f3b21192b8bd2a6d98309ce820dc740b51
- SSDEEP
  
  6144:l2GMn+qaIrAf4pd3DecSGUHmJYSJuXEj0j888888888888W88888888888Bf:U3+yt8SYiuc0j888888888888W88888t
Score

1^/10
behavioral21 behavioral22
- Target
  
  Basicsurvey.exe
- Size
  
  657KB
- MD5
  
  ddbbb976bcaf2bffad290294064c852f
- SHA1
  
  e128d2fc52e7172c79b44cb0e3dd348e91a19555
- SHA256
  
  12a55423f21f87d7f4dcee9cf5fc1b28819ab373126da5e94a0272258413ef3b
- SHA512
  
  2aa3eaa6c7977cc3e63c89da614115cf636b9c7d2199ff5f2e391f74957ea135d1aaef9f64c99bf6ece97779aab56420d4db868ba4e8332583c88f48433fac29
- SSDEEP
  
  12288:QvfHRhWfFaJqIg+OeO+OeNhBBhhBBxKdWux7hC6wQ2DAYtfIN9cvT6:Qv/RhWfFaEI2dWg7Y6H2DAY6
Score

1^/10
behavioral23 behavioral24
- Target
  
  MouseHook.dll
- Size
  
  32KB
- MD5
  
  30d0890b84494f4d4689037b6126bba4
- SHA1
  
  dd5bf37c4751710c57d1e95e29ce6e890ec73a25
- SHA256
  
  fc07f2c9c5830056e51f02e6e85195d89af51c3e9d7d42de56049a6261bbfb02
- SHA512
  
  545ec0918da23acb984241b668eb6db3bc297c16e754ae472c8f8745c62811fb9d1501f75e205064760bee7b46eae6bf4687990e1b50f9aa755b2b0b6cbf6cff
- SSDEEP
  
  768:3Hr98zW8XvCBcaxFUpGai292OKjojDd7paqIp:3L98zW8fCWafw2OKjoN7O
Score

1^/10
behavioral25 behavioral26
- Target
  
  Socks.dll
- Size
  
  963KB
- MD5
  
  3ca586b5855018a3113fce9ef5b3cb03
- SHA1
  
  0a2e7c31cedb78f0ca3e93d125aed850c23beaad
- SHA256
  
  3bab664a22a3420a69f3ba8067346758d3876722fefdd6a4bf5d5c2a9850b1c5
- SHA512
  
  7f5ceb82d538fb3d36190b85c46dffd02ff3bdf7b59ef3221763799cd8f917e59342646f9f0f6fbd5b0304f2efd761240ad5964e17cbefa974fa7859fefb9703
- SSDEEP
  
  12288:P1XBTCHIy1Q3qyST6FD6NRMtEwdaCy5+OeO+OeNhBBhhBBCtEUEkj5faXy3pG+gA:PJmhMtPECyhtjLfaiZhgv4
Score

1^/10
behavioral27 behavioral28
- Target
  
  gamebox.exe
- Size
  
  2.1MB
- MD5
  
  3bd4dd9dcef8070bf4a5c63eaf4e4fbb
- SHA1
  
  3b478334cab0fdd4dfa3e204f3abdc82f74e0a5b
- SHA256
  
  5fe2cb5db88b8c33b6f92add6b352b67e9a73797afa13d0da17a84aff38c2c14
- SHA512
  
  7e55667839027b489c22b5666c736f38aea6b727c0078c52e064fec88e4fa3cba0ab55ab08d07f09678f00bc8bd8a3fbd8d7d2b0d3c373c6cca6063769861728
- SSDEEP
  
  49152:DK0tPwL/4j8uHjFI4RiXiVUvThPBXH++kSteD5D121C7:ub4j8uRpRi7XH++kSU
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral29 behavioral30
- Target
  
  tabGame.exe
- Size
  
  1.1MB
- MD5
  
  60164a2e300f6d7b578eb9c2a7f836c9
- SHA1
  
  c9701c83cd15af6e86548065a241de3665249ac8
- SHA256
  
  80156e19ca74b927939dfbda4f70513fefa2ff4420b935fcd4064b7d9dcd66ee
- SHA512
  
  700eabcdda7b21877d74c9bde2c43775bdf503c752c61b3256e25942527277001d7f0e6574706d09f1ebe5380cc7c9e0002ee7eeb99ce49867d56c4fbdc15860
- SSDEEP
  
  24576:b4xuworsVZTL6MsFbnT0ZDPLucdI5p0FXH+tWO:W0T0Z/H25uFXH+tWO
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32