General

  • Target

    af64546fab922ba8bad76eead19dfa53_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240615-t8e3za1enq

  • MD5

    af64546fab922ba8bad76eead19dfa53

  • SHA1

    fbcbf67f8d7bd639f7d02af20a2d76fc38290391

  • SHA256

    76dbbb12ca3638a851ef42b131130f7b3152fe0a4ae2104ff7beb918e3a633f7

  • SHA512

    c7af122158890ad3adaa8187313879a0cab3e0d2d81ac7bd39f53a533bdee49136c9a07333b1934f6d02c690be9bf6d1210c0f9d560f1459ab861a54bd12ed64

  • SSDEEP

    24576:+cJ4XqBr4UbL0gZRv++VmLinLRsff2ZBRz6VOJp1xVwoZ3eYM2Wrik9zvoldY6nh:EaBrmYRv++8kLqff2ZBRN1Dl3egW4WTK

Malware Config

Targets

    • Target

      af64546fab922ba8bad76eead19dfa53_JaffaCakes118

    • Size

      1.5MB

    • MD5

      af64546fab922ba8bad76eead19dfa53

    • SHA1

      fbcbf67f8d7bd639f7d02af20a2d76fc38290391

    • SHA256

      76dbbb12ca3638a851ef42b131130f7b3152fe0a4ae2104ff7beb918e3a633f7

    • SHA512

      c7af122158890ad3adaa8187313879a0cab3e0d2d81ac7bd39f53a533bdee49136c9a07333b1934f6d02c690be9bf6d1210c0f9d560f1459ab861a54bd12ed64

    • SSDEEP

      24576:+cJ4XqBr4UbL0gZRv++VmLinLRsff2ZBRz6VOJp1xVwoZ3eYM2Wrik9zvoldY6nh:EaBrmYRv++8kLqff2ZBRN1Dl3egW4WTK

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      config.dll

    • Size

      1.3MB

    • MD5

      8d0d10f74accfc93d4f2bee7218eb60a

    • SHA1

      4c04ea98ae9f4034567e483ef734c4cb4a9b9121

    • SHA256

      da02d900d262016d88f9b34983601a8dd1309bf839ae57cba163df77b5f2bd7a

    • SHA512

      e4a737aebbf9eaa4a96d92396e700df1191a2d50afdb49dec43fb514107835690f46e7c01df9ecea779377fd9f8804a974f125b8f5585c74e03769edfc49de38

    • SSDEEP

      24576:T9wwDZhwPOmH6SR6RRXerF/VsfT5ty8J04WMgVa:ROaSR6DXk/65thaJVa

    Score
    5/10
    • Drops file in System32 directory

    • Target

      iconAnimate.exe

    • Size

      306KB

    • MD5

      d1e1d596b8f189721481cd003bd32828

    • SHA1

      a292b668275a0f439ce537249eb8d4c57e3ccbc0

    • SHA256

      bb515d3f8b707354ef54f1982a4c8d327c52abfa4b35d13cd18333aaa4b7effb

    • SHA512

      3f4bd7046cb9db46adb86ee25b2260ac24970a03b6995f006ddf51c4362723b290ea1802b92e2fc4405183a7531eb9ae8b4f89c92c5c1374b979505b6b0f7038

    • SSDEEP

      6144:agY6aLiYIKLlVeukmKiuwv11rf1Ar3QbCC:aVGYIKhyiuwNV1A0f

    Score
    1/10
    • Target

      iconTips.exe

    • Size

      281KB

    • MD5

      cd196dee81bf0e577d5d65cc5540df81

    • SHA1

      8e767f94d491a63276fd7a49f69be26e251e7968

    • SHA256

      3179f526d276ad0e57af55adba2d7b6bcf8e8ee8209809ccc63dbe7a1789dfbe

    • SHA512

      8656cf701db05b5eca3d99e30fba272e4b1701de7ea948822a409a22344fee8eff54fa6f9114aa950b6568d240ac1572ee87fbbf6650c1e6bf5045e1fc1332d9

    • SSDEEP

      3072:r1G0sELXVE8tT/wFetENNXh55fqgOMPVjH8fwnub:r1QOW6EJffqgOMPmfVb

    Score
    1/10
    • Target

      mir_game.exe

    • Size

      33KB

    • MD5

      56e25d72ef14817691e84a089d048a51

    • SHA1

      ce720bd502de59718ad4969f6aaeafdb7286aeb1

    • SHA256

      86d96feb1ad4930c5be0f61acf1c1aee2c3d195074b476be60bdfab677e0f67b

    • SHA512

      a2f89767fe1532ee177051348f5ab7f253d8c18f01677995bc12bac4dc60ddd7c3893b65e8d4c5142816212a9a07b2ddfe4ade7997ebb5066e9e61774e88b32d

    • SSDEEP

      384:0hQW0OFVOxnGJCkSaTW3kDO4v+W6a1qwU/4R/MlvLLTgHeNp+01QXUXVPr/paqIs:LW0mWeztZq+PqwhivLLTgH2j7paqIs

    Score
    1/10
    • Target

      uninst.exe

    • Size

      290KB

    • MD5

      b2b08305dcb2838240f58232e632530e

    • SHA1

      6e7888a31d74f72d7be039220f6d7c7877face09

    • SHA256

      c0e76262713dadc308e64e027bcee25ac7788ff8c7488673e71de49c464bf698

    • SHA512

      d934e53911fdf4396c0d51ae73e10524524628f687cf6aed867c75ecadd947301e57c5dc0f2f2910512cbb2bb8f6f1c49d4adb829f035ff8ffee4f5d6994ecbf

    • SSDEEP

      3072:rgXdZt9P6D3XJTH3PAscQZ5fic3ez5JFw1bNyGxmsUYSh51pM2Wfi8mvvlz9pG15:re3415c0Zic3cwKGfUXht9WqjG1xz

    Score
    7/10
    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      c498ae64b4971132bba676873978de1e

    • SHA1

      92e4009cd776b6c8616d8bffade7668ef3cb3c27

    • SHA256

      5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

    • SHA512

      8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

    • SSDEEP

      384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

2
T1542

Bootkit

2
T1542.003

Defense Evasion

Pre-OS Boot

2
T1542

Bootkit

2
T1542.003

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoverypersistence
Score
7/10

behavioral2

bootkitdiscoverypersistence
Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
5/10

behavioral12

Score
5/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

bootkitpersistence
Score
7/10

behavioral20

bootkitpersistence
Score
7/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

Score
3/10