Overview

overview

9

Static

static

3

a607971122...18.exe

windows7-x64

7

a607971122...18.exe

windows10-2004-x64

7

InstallTools.exe

windows7-x64

1

InstallTools.exe

windows10-2004-x64

1

bytefence-...13.exe

windows7-x64

4

bytefence-...13.exe

windows10-2004-x64

4

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

ByteFence.exe

windows7-x64

9

ByteFence.exe

windows10-2004-x64

7

ByteFenceGUI.dll

windows7-x64

1

ByteFenceGUI.dll

windows10-2004-x64

1

ByteFenceScan.exe

windows7-x64

1

ByteFenceScan.exe

windows10-2004-x64

1

ByteFenceService.exe

windows7-x64

1

ByteFenceService.exe

windows10-2004-x64

1

Microsoft....nt.dll

windows7-x64

1

Microsoft....nt.dll

windows10-2004-x64

1

Microsoft....er.dll

windows7-x64

1

Microsoft....er.dll

windows10-2004-x64

1

amd64/Kern...ol.dll

windows10-2004-x64

1

amd64/msdia140.dll

windows7-x64

7

amd64/msdia140.dll

windows10-2004-x64

7

protobuf-net.dll

windows7-x64

1

protobuf-net.dll

windows10-2004-x64

1

rsEngine.dll

windows7-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    a6079711221810049f272c6413315649_JaffaCakes118
  • Size 14.2MB
  • Sample240613-rt7hkaxarn
  • SHA256 a9a9f83473c54191c5808cbbd750c0c68eff54e1557d03a63eb2221dbb1578cb
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target
      a6079711221810049f272c6413315649_JaffaCakes118
    • Size 14.2MB
    • SHA256 a9a9f83473c54191c5808cbbd750c0c68eff54e1557d03a63eb2221dbb1578cb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2
    • Target
      InstallTools.exe
    • Size 274KB
    • SHA256 d7ffd96c98cdcd1bacbe7542b403d60a8b700ab8305de02738f1f1c2d98aa71f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      bytefence-installer-5.4.1.13.exe
    • Size 14.1MB
    • SHA256 d0e366ae735c42b36783721309da2ff9fbb339f2dc3820493ee446dab380f97a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsisdl.dll
    • Size 14KB
    • SHA256 a1e09fb1739ef7557d18104b0d6a4c7725e1ec293f5404c80402f57ff9ebb9d0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral13behavioral14
    • Target
      ByteFence.exe
    • Size 3.6MB
    • SHA256 0ebf985309d2989a589f0a1e742a1691e4e77ac15a5935233fe2bff74877be78
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    evasionspywarestealertrojan

    • Enumerates VirtualBox registry keys

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral15behavioral16
    • Target
      ByteFenceGUI.dll
    • Size 835KB
    • SHA256 8730b39c35b36ae6af9e650bb7df68ace0167b1a60bcd36ffccc84c24301f2a4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      ByteFenceScan.exe
    • Size 807KB
    • SHA256 abf213902b88e6c813b632bfd00ff2e974b07d2425b4a7c2d70c9c9a4ab324e7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      ByteFenceService.exe
    • Size 152KB
    • SHA256 14c8cf137a85c622f5a7f08401fa5fafaa2b1a1e6aaebc583731595aa6432f44
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      Microsoft.Diagnostics.Tracing.TraceEvent.dll
    • Size 985KB
    • SHA256 6f8a2f1d045efb952c1ea9988bb5dcc72555eccafe9b32c2c51b439ea1f28453
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      Microsoft.Win32.TaskScheduler.dll
    • Size 303KB
    • SHA256 cc6c472f666239ed270cc3754852f536b8981d6fd22e4ad1ee15a1aa788a3ba9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      amd64/KernelTraceControl.dll
    • Size 217KB
    • SHA256 2005f94acc7c541771066ed98aff6321b911d10c59d2544b853446dbe91f25a5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27
    • Target
      amd64/msdia140.dll
    • Size 1.3MB
    • SHA256 25a17a77163d1f18d780b06546dbe53c49d184c08cae60598b81cce655c53e34
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence
    behavioral28behavioral29
    • Target
      protobuf-net.dll
    • Size 205KB
    • SHA256 b6cad8c254404466afc57402bf9c69f92dcce2f76cdba19784cc1057e85e000f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral30behavioral31
    • Target
      rsEngine.dll
    • Size 5.2MB
    • SHA256 284b7b5340954a1c4cc8c43d2ff360aae111fd8f206449e6393cd540008bb73b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

Score
7/10

behavioral2

Score
7/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
4/10

behavioral6

Score
4/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

evasionspywarestealertrojan
Score
9/10

behavioral16

evasionspywarestealertrojan
Score
7/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

persistence
Score
7/10

behavioral29

persistence
Score
7/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10