General

  • Target

    9f88f871bfb7f0609f8da285c5e84605_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240611-z2x8vssald

  • MD5

    9f88f871bfb7f0609f8da285c5e84605

  • SHA1

    1cab9186d94fe6764ca8378eec28a085c8b07425

  • SHA256

    cb4794d640c5fcbd709bedc71ed4639e7b3e2ed95cec1cb9d8d47d2a9bdf4a8c

  • SHA512

    b2765f064028dc62c69979f00d633515c39589383528e455e4c72aea986086d3653016b101d5b41eed87a19d0aa61b3e8bc0f7adf5264075ecda5b3517775ca9

  • SSDEEP

    24576:beX2vzptbfKL1oX1Y5wrrRsrW7RdYxMn4iuKbQaqfQN+Qfsqz:KGvz5Xa0Nsr4Qx64qfqqB0qz

Malware Config

Targets

    • Target

      9f88f871bfb7f0609f8da285c5e84605_JaffaCakes118

    • Size

      1.2MB

    • MD5

      9f88f871bfb7f0609f8da285c5e84605

    • SHA1

      1cab9186d94fe6764ca8378eec28a085c8b07425

    • SHA256

      cb4794d640c5fcbd709bedc71ed4639e7b3e2ed95cec1cb9d8d47d2a9bdf4a8c

    • SHA512

      b2765f064028dc62c69979f00d633515c39589383528e455e4c72aea986086d3653016b101d5b41eed87a19d0aa61b3e8bc0f7adf5264075ecda5b3517775ca9

    • SSDEEP

      24576:beX2vzptbfKL1oX1Y5wrrRsrW7RdYxMn4iuKbQaqfQN+Qfsqz:KGvz5Xa0Nsr4Qx64qfqqB0qz

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Downloads MZ/PE file

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/SelfDel.dll

    • Size

      5KB

    • MD5

      e5786e8703d651bc8bd4bfecf46d3844

    • SHA1

      fee5aa4b325deecbf69ccb6eadd89bd5ae59723f

    • SHA256

      d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774

    • SHA512

      d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3

    • SSDEEP

      96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE

    Score
    7/10
    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a436db0c473a087eb61ff5c53c34ba27

    • SHA1

      65ea67e424e75f5065132b539c8b2eda88aa0506

    • SHA256

      75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    • SHA512

      908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    • SSDEEP

      192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      14f5984b926208de2aafb55dd9971d4a

    • SHA1

      e5afe0b80568135d3e259c73f93947d758a7b980

    • SHA256

      030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1

    • SHA512

      e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27

    • SSDEEP

      96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN

    Score
    3/10
    • Target

      $TEMP/SDM143/Splasher.dll

    • Size

      475KB

    • MD5

      41d94c8eb8cb17e04f8ec6e14132f9ca

    • SHA1

      add92b031eb36b26335763780df88bca58636ed7

    • SHA256

      2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96

    • SHA512

      0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

    • SSDEEP

      12288:2I2EL1NaycNyL+kNmQLnmQtMleiQ8Zceqw1:tTayPLDltMUiQ8Zceqw1

    Score
    3/10
    • Target

      $TEMP/SDM143/cmhelper.exe

    • Size

      234KB

    • MD5

      3a9774028e1e3968b8c202fd199d0084

    • SHA1

      6e19763c3f42c8d6596135a7566bef07a0cbeadd

    • SHA256

      93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5

    • SHA512

      ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06

    • SSDEEP

      6144:VcF3h+/MWLriz/BaQKoiQH22uhJFJoaMOKFNgv5x48yH2geFELNtgxQh:VcF3h+By/BaQKoiQHa7oG/Fh0

    Score
    1/10
    • Target

      $TEMP/SDM143/resourceDll.dll

    • Size

      64KB

    • MD5

      cf437c679559b02ed9a2f1f08767997a

    • SHA1

      bf21e384a0101058da5fb8e6143641d7681173b6

    • SHA256

      a7410aac8e00977120b518f96b9f2a7f1de754a595cce740618fdd46838420bf

    • SHA512

      02941c2668f511664393585a8a7def9df8e3282cd908a0484159387dcc7b79e7494cf9722b9a8d3640144a26e19e89f45c9494070f348fca5a4e1a9dd08313bc

    • SSDEEP

      1536:+ZYvZlhIXiXwNSyY9qbJfGZKR6FluR6nGrq5mTAGXqNQhH:+ZY/h+iA4GbJfGZK2MiMq5dpNQt

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks