aafa6a4f711b3db0eec7c854908102fef395d50188a8a8c36efc188b3d8a5329

Sharing

Copy URL Twitter E-mail

General

Target
a39833da93f211ce6814d9d1e48d107b_JaffaCakes118
Size 8.6MB
Sample240613-dc4tfssamb
SHA256 aafa6a4f711b3db0eec7c854908102fef395d50188a8a8c36efc188b3d8a5329
MD5 a39833da93f211ce6814d9d1e48d107b
SHA1 8fc5137eefe8ba1ab62427755c563849dbc1a6a8
SHA512 51d8b9a6970a82d0ce9da36008cfb766abd9f592d0adb2e9ae83a7e49e9455909f62f8e82cea575ec874d5a87e982b6e93bb86101756d4ff7acd1ca239a3e099
SSDEEP 196608:mg/5o91iLBcFDS74Yvl3zkmAQajA1ScrsphTuqnX:mg/5flcFu7vo9QajA1Zm/X
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  zmxy3hmnxgq/data/program1.dat
- Size 6.5MB
- SHA256 115a01f25a5f3dc6fc77a2c28237edca910bd5446b760d345c2cf0846f87954e
- MD5 d303e985946be995bd61715c5cf30cdf
- SHA1 ddbc48923862c5c3b6c30e4c4efde6b03ca9478c
- SHA512 fd5f21977e14afdb7ad3626a944c074627d0ebca513f08cc8f344ae7be1f02278d004abc87c64607705ad7aae21a0ea371e67b2124bf95b6dfce4eede29749b4
- SSDEEP 98304:e3bMeb8SXqYqdwkLcHHq66clLxNCpdGO5ean2ebmOJBAUZLV:e3ZajAzN5OeOJVh
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  zmxy3hmnxgq/data/program2.dat
- Size 827KB
- SHA256 71f46644a7e33b7e0eec8cbe994e0b3969fee1da331ee72a30880782affc65b8
- MD5 aa86c3838043d730ef8cd5a61605dcb8
- SHA1 68952ca94afac9e19356d5666f062e7c1b4c8866
- SHA512 e64dcf1fc1c2b470cf0d4580ad4cf2e205f25780886ae7dad5baa5931c91b3bbdff05608045527bf929e0dde06c80e0fd719b7e52ea5e9eb17347902e7b6c60a
- SSDEEP 24576:VYwzFmPnNN7q+iuO5Mv83ZsS5gyg7TzQbCk66Yjzxi:tz41NW+rO2cbCX9i
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  uninst.exe
- Size 290KB
- SHA256 f28aaf83e0f1e0f1eb4f5839f3041570d708bd25092a80a8825331415572c542
- MD5 098e3c228213e21a5bad50eea419a387
- SHA1 9dfc8ded333423814c3194e0a3676abb02b89520
- SHA512 f8652a76ef99a099d46ca6e5f3d8a0f3cbdea2452a747d9de64f5042962409551f54433ff06aac3fdd757c702316e130110a8ed5583b3aba005e20657cca8ec2
- SSDEEP 6144:xe340ZS0fcJc0Mqrm7Fq1rQAZvTEkA+F2vklbYE34s3TvJ74qjGgp:sEpJ7aCRTEf+Fckl/xDvhvp
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral13 behavioral14
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- MD5 SHA1 SHA512
Score

3^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  $PLUGINSDIR/inetc.dll
- Size 20KB
- SHA256 5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
- MD5 c498ae64b4971132bba676873978de1e
- SHA1 92e4009cd776b6c8616d8bffade7668ef3cb3c27
- SHA512 8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
- SSDEEP 384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  wlyx906530.exe
- Size 1.0MB
- SHA256 37f89cce104b6a196ec110439b2d48f80f5c1eb93660dd0d77efda52f1aa3314
- MD5 c36c6bb3e010e833465057a7da5fd62b
- SHA1 6f5c63a875698b4b99d194e9bbd9a672a5d770f4
- SHA512 4ec6a50a2c29b171ef3a025be0979c19816bbea5823cc9024231ab8023a55d91436f21c585e6fc8454d0fdf55136dc329a7d3b0c0d966c789c2a39690cbbf1d8
- SSDEEP 24576:pD1hfUpRmLGVQ9JQeYITPZTfbC5dIx7xK1UwXsPhQ:vupRUGVaJbYsx6571Ug2hQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  zmxy3hmnxgq/data/program3.dat
- Size 3.5MB
- SHA256 b87517e909b90003939998bf48455ad2efead454ca6f5e162b2a6655dc20ea7a
- MD5 b925d42b065b1b254926c023b2b3d3fb
- SHA1 fee05156af98bf8055133ea7a8224abc1155f2a9
- SHA512 9db065836dae20a4c43e4db83e54ab43fcca73468cd14ec9562ae99bc27b3c0901b3b26635b50f79bbbd94f82b98e438867626d7d88ca7438508bfa03d705256
- SSDEEP 49152:LOHYk2Q4ICI+5hq48LTQd7t89wZd/Q9SJzW3guTstkr/thRd8uG3B4ecrf:yz/SI+bq48Lw89wZd/tXSthUu2mf
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral27 behavioral28
- Target
  zmxy3hmnxgq/data/program4.dat
- Size 1.7MB
- SHA256 9bd87d287d4d46d199e16a42790f3520c1b2976eb4d3617fdf2f97370b14557b
- MD5 a6d8b44a0a8369fc1a6b6929b5b8464d
- SHA1 3505a86835e4c8a154267b9a0d2abb60c227f380
- SHA512 42255f8209182b99eb200bb84ecb68cb6eb4ec71bf7bb7f3be811787927df8fe7f52e626d9c6f557ac07842eb97d9a50fff228a632c07942132ede7e092ed980
- SSDEEP 49152:PSo4KbzqDeVXQGmfhaZ5J5/hn6KR2dJnuW+Mq5bH1:PSo4h5aP/hTontaz1
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral29 behavioral30
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Writes to the Master Boot Record (MBR)

Deletes itself

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Executes dropped EXE

Loads dropped DLL

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

UPX packed file

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32