General

  • Target

    b2adf0309d1f6d156966485a18e05fc2_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240616-kx7jeaxdqc

  • MD5

    b2adf0309d1f6d156966485a18e05fc2

  • SHA1

    7c23ee34aa29e9f279abab69325122cae5ee86df

  • SHA256

    0c41a9c9a845969b071aba5b5e325293c75e79b22df79a820e32b412ff52bfa5

  • SHA512

    35905930c0bf78159b5f7d89396022371fac6709dcc5a94783e7338dcc799220fa622e3a9a1a4ab34fd245733c840944fa3e746014f015148b51d9c9bef68d93

  • SSDEEP

    24576:n1hEFXvyvIDAZv5GelSGZ8h2L/0dRFq4mOTOWzVWKpAZI8fy1vkI:74/K8AZv5LcG+304YxiiI8K1vkI

Malware Config

Targets

    • Target

      b2adf0309d1f6d156966485a18e05fc2_JaffaCakes118

    • Size

      1.4MB

    • MD5

      b2adf0309d1f6d156966485a18e05fc2

    • SHA1

      7c23ee34aa29e9f279abab69325122cae5ee86df

    • SHA256

      0c41a9c9a845969b071aba5b5e325293c75e79b22df79a820e32b412ff52bfa5

    • SHA512

      35905930c0bf78159b5f7d89396022371fac6709dcc5a94783e7338dcc799220fa622e3a9a1a4ab34fd245733c840944fa3e746014f015148b51d9c9bef68d93

    • SSDEEP

      24576:n1hEFXvyvIDAZv5GelSGZ8h2L/0dRFq4mOTOWzVWKpAZI8fy1vkI:74/K8AZv5LcG+304YxiiI8K1vkI

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      config.dll

    • Size

      1.2MB

    • MD5

      d7c13a0a5ebade73ffc41a3c27fbcfa7

    • SHA1

      fae66adde5af56834e378fe1ba8e392d67888f3e

    • SHA256

      8954e8c09fe6e57bfd2e076428d2772a501d98b1cc13b5dd195723fdf652f3b9

    • SHA512

      c97d8e1b6a619301a2c6bf3aba3b32b3882b599000f4390bcbf844aa4a6f30fc4f125adc69dd7c9246fb134fd328fbae2fd3327b5c4616e5441e803106cbd2e4

    • SSDEEP

      24576:wPTgPZOzTmHYEJ/D3YHizBC3cyBw0dN7LKrogV3cz:vP1JD3YHmC3PdLtgV3e

    Score
    5/10
    • Drops file in System32 directory

    • Target

      iconAnimate.exe

    • Size

      306KB

    • MD5

      06f43c87643e1cb4aed68083ff5e0c67

    • SHA1

      daeb56df50c8dd7b6f48a4113b75d8e281081ea0

    • SHA256

      d28636272c1d9310679baaafb61adcfa37dfb4f3770c727654b14fd16aadf9e3

    • SHA512

      48c70f4bd80da9613301208eac3d24747df989e6694b2da320b0bbff0066d50aaabddfb935823d1b5e0d0d53e48fd522cceb22844a36d71f5cc461fd97395569

    • SSDEEP

      6144:0lYxXLG7M9/lV0ukmKiuwv11rf1Ar3Qsfa:0ci7M9NQiuwNV1Ai

    Score
    1/10
    • Target

      iconTips.exe

    • Size

      281KB

    • MD5

      c0a7e04aeee6f99f8da9e508985948b6

    • SHA1

      5d64623e210f2269ffc63d21524fa44844dd9e52

    • SHA256

      4f45ddf98422322f9e2c0d502bbfc5c58548f0fde8ab7dbbea1d23c9e2f83a27

    • SHA512

      6e8076093d87a96045a12e3eb27b848a6136ea9116a0f1c16c16da0b2c3b11b498007d3a36533516ec6b40258b4c485b51fbb9ab679f90c085e1c3459862c343

    • SSDEEP

      3072:/I2HXgdV8UAwCPQf3IF4YEghgQL7pndj1MqgOMPVBgV6a2j:/rwdGllpEg7bj1MqgOMP2oj

    Score
    1/10
    • Target

      uninst.exe

    • Size

      290KB

    • MD5

      89e6787a5338debf5e1993c4cf3fbc45

    • SHA1

      10b0dafed4382b72b9cfe3f62633383db1792b7b

    • SHA256

      8a215ae6d6fb398a896c730981a8ceb913fb5465f636300d2a1425bc219158a7

    • SHA512

      b70a15edc3372c637c1769a57b01e19eb51344545715656d4d763ea69e68356f2c209c244667d6197ee60c22cdf48ab450e4f8e059f2d99172d87207865f73ce

    • SSDEEP

      6144:Ae34StQOf9u+IiX5A7A9ysmB/X/BqjGx5:Fz9hIivcsOHT

    Score
    7/10
    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      c498ae64b4971132bba676873978de1e

    • SHA1

      92e4009cd776b6c8616d8bffade7668ef3cb3c27

    • SHA256

      5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

    • SHA512

      8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

    • SSDEEP

      384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    • Target

      wurn_wied.exe

    • Size

      32KB

    • MD5

      e452cb69e5c51725589da1b2323ea047

    • SHA1

      52d17988c906d1370ba920209823de08c52487e4

    • SHA256

      152878c70ff6a5341ffb6bb1f3307f7fa690956e6fbcad9d7e6a84c81d78e7d8

    • SHA512

      bf050cdb4e400d4c7e59228f1370fc548553c185a0e3eb591d5a07d3b0682d69489b9c3a839b4c51808175eea394bf8861de0235048e44a39db963b84701d2b3

    • SSDEEP

      768:BTe04tug/R3UmGoVfxv4wmygjH+5h7paqIR1R/:Bqig/OmGqfmtaH7YD

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoverypersistence
Score
7/10

behavioral2

bootkitdiscoverypersistence
Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
5/10

behavioral12

Score
5/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

bootkitpersistence
Score
7/10

behavioral18

bootkitpersistence
Score
7/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10