Overview

overview

9

Static

static

7

a2e2954e48...18.exe

windows7-x64

7

a2e2954e48...18.exe

windows10-2004-x64

7

$PLUGINSDIR/Aero.dll

windows7-x64

7

$PLUGINSDIR/Aero.dll

windows10-2004-x64

7

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$SYSDIR/frapsvid.dll

windows7-x64

1

$SYSDIR/frapsvid.dll

windows10-2004-x64

1

HELP/help_fps.htm

windows7-x64

1

HELP/help_fps.htm

windows10-2004-x64

1

HELP/help_general.htm

windows7-x64

1

HELP/help_general.htm

windows10-2004-x64

1

HELP/help_movies.htm

windows7-x64

1

HELP/help_movies.htm

windows10-2004-x64

1

HELP/help_...ts.htm

windows7-x64

1

HELP/help_...ts.htm

windows10-2004-x64

1

fraps.exe

windows7-x64

9

fraps.exe

windows10-2004-x64

9

fraps32.dll

windows7-x64

1

fraps32.dll

windows10-2004-x64

1

fraps64.exe

windows7-x64

1

fraps64.exe

windows10-2004-x64

1

fraps64.dll

windows7-x64

1

fraps64.dll

windows10-2004-x64

1

fraps_ru.exe

windows7-x64

9

fraps_ru.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    a2e2954e48a33e5b1a33bb0cdcf828e1_JaffaCakes118
  • Size 3.7MB
  • Sample240612-29b2psvcjg
  • SHA256 9f3f956525cecd7c4fb922f884a0deb3e151b9e23c98f08788939dfe18575dfa
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionupx

Malware Config

Targets

    • Target
      a2e2954e48a33e5b1a33bb0cdcf828e1_JaffaCakes118
    • Size 3.7MB
    • SHA256 9f3f956525cecd7c4fb922f884a0deb3e151b9e23c98f08788939dfe18575dfa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/Aero.dll
    • Size 6KB
    • SHA256 04a577df50431eb0ff6fb103566402bf66c50415bcc1f8a86b9c235053131455
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/BrandingURL.dll
    • Size 4KB
    • SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral11behavioral12
    • Target
      $SYSDIR/frapsvid.dll
    • Size 64KB
    • SHA256 8effbb13e6e74778867fbb1ecd929df9b7335fc4d4f5532fbe7a91da82e6745e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      HELP/help_fps.htm
    • Size 546B
    • SHA256 b1419a421ea79de26a910c941c72d8eef7f97f42e55c28e8f7df9d31be3a0889
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral15behavioral16
    • Target
      HELP/help_general.htm
    • Size 550B
    • SHA256 731aa299a4024b9574282c12ff9385b6bc972a360d327633259c5bfff7bd8b86
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral17behavioral18
    • Target
      HELP/help_movies.htm
    • Size 549B
    • SHA256 241da611a040ed0d1b9e51d92eaa7ef7f9821cd1bcbfcbc6759db2babc4d6881
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral19behavioral20
    • Target
      HELP/help_screenshots.htm
    • Size 554B
    • SHA256 b2bebc38395e4678c78af793b1c5ad214a3f832fbe860dedb0d8db36118350fe
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral21behavioral22
    • Target
      fraps.exe
    • Size 2.4MB
    • SHA256 188ad0def854013f007218b20632c76ee3f8a7b1c9fd111aa467c4eafae485c9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion
    behavioral23behavioral24
    • Target
      fraps32.dll
    • Size 228KB
    • SHA256 d972834a5a97fcff4d521f93f36966f9a1710591db98c0b4bf7e4dc383783391
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      fraps64.dat
    • Size 67KB
    • SHA256 7d5a88574ea4599e5b46d8dad2943c16f65b8e4a6dd1b3f309001fa8c507b4c7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      fraps64.dll
    • Size 182KB
    • SHA256 8d63ffccbfc9bccc0450dede55b654024404276b460c771dd403b3df88cf7882
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      fraps_ru.exe
    • Size 1.5MB
    • SHA256 67a3866453826fecbfc9883842490c971b4025d01e82284b516e8b6814b5575c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

upx
Score
7/10

behavioral2

upx
Score
7/10

behavioral3

upx
Score
7/10

behavioral4

upx
Score
7/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

evasion
Score
9/10

behavioral24

evasion
Score
9/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

evasion
Score
9/10

behavioral32

evasion
Score
9/10