General

  • Target

    026558c6a583c38787a6fe7c2246c6f6_JaffaCakes118

  • Size

    3.6MB

  • Sample

    240622-qtnj1stgqp

  • MD5

    026558c6a583c38787a6fe7c2246c6f6

  • SHA1

    89625fdba8dd1e63dda1575fa3c6b5383b8298f9

  • SHA256

    15a5c336700cd5eac293c7d73818f9824f2f6f6f78461e3498c1fbfd019cfba9

  • SHA512

    3ac1be5c712cb55b16b68d8e9356c1d202662f042bea0d671b7b05ef8ec3fddc04af83e5f0d6ae05eb5dd2806a35b9e6476be81dcb6fb6293592ef68755abcc5

  • SSDEEP

    98304:JEgW95hfgkMLi4+SzGXnNSp+e6E+D9ift/wH:HWVfgfLVzGXN59KqH

Score
7/10

Malware Config

Targets

    • Target

      026558c6a583c38787a6fe7c2246c6f6_JaffaCakes118

    • Size

      3.6MB

    • MD5

      026558c6a583c38787a6fe7c2246c6f6

    • SHA1

      89625fdba8dd1e63dda1575fa3c6b5383b8298f9

    • SHA256

      15a5c336700cd5eac293c7d73818f9824f2f6f6f78461e3498c1fbfd019cfba9

    • SHA512

      3ac1be5c712cb55b16b68d8e9356c1d202662f042bea0d671b7b05ef8ec3fddc04af83e5f0d6ae05eb5dd2806a35b9e6476be81dcb6fb6293592ef68755abcc5

    • SSDEEP

      98304:JEgW95hfgkMLi4+SzGXnNSp+e6E+D9ift/wH:HWVfgfLVzGXN59KqH

    Score
    7/10
    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      $COMMONFILES/Angels/AgLog.dll.tmp

    • Size

      298KB

    • MD5

      eac8960e017bd934b2009f6db2faf03c

    • SHA1

      709263b55e8002c9acde39ff48eb9b43486d5ec6

    • SHA256

      5b432e3255dc73277356571855cb782d3a376c9d2a77eec940092853b68319fb

    • SHA512

      2c27493d946f3696c200b3c8db9bb698a6d8e2dcc8ad94304ca7c34b5d4fd40c735214691dcd294923515831da818a482d4821d0e0b92d162b8734ba07c9e6e5

    • SSDEEP

      6144:BCv6QXUtiBav//wX4Yz0jfTc3B3QvZusUhm:IPi/wX4YzYfTchQhu0

    Score
    4/10
    • Target

      $COMMONFILES/Angels/Agwin7.dll.tmp

    • Size

      60KB

    • MD5

      71c71a81864920b3c993500370bd24cd

    • SHA1

      1afdb9e97970741728788c3aa4da83de0c1893ec

    • SHA256

      07a15218c0862b9406e3a1002c0dfedac2fbad69578add537d5ef23961d36d9b

    • SHA512

      f4737c417e9370144409bc762f2a9067ec23c08359835f3c1191af5449c2f9ba72656cef4003309ad5f3a2b1878f3cadc34ef801414122b7b50ba66a2ce3e960

    • SSDEEP

      768:kpdcLGMKEfsu1nWmmR2LEY2t7bXrvSZYA8YKU1r15sD+ewMLEUbGq:knLMWTR24Y2tHXrv0hLrK+eF4QGq

    Score
    1/10
    • Target

      $COMMONFILES/Angels/AngelAsst.exe.tmp

    • Size

      121KB

    • MD5

      fcddb14984babda702a989a4182724d2

    • SHA1

      8220a6486fa2d5b3fdb5e936d372c4f13438f015

    • SHA256

      57d2ed4d5ffce987eba4321a055f6c2f74f94a09ec13053205462f205df33fe0

    • SHA512

      5f813e63e717df87c7f516e7b4e7b2daf3550d36f0d5347dd82e25f174eef5f0a3c615abdb3619f55f562d270c92af934acc06b50218dae892f7d531f7f390a5

    • SSDEEP

      3072:GHrcfb6juHeNxHlbuL9hKNIVu2f+FZKPSxE:GHrcfb6juHmlSL9hLVu2cZJE

    Score
    1/10
    • Target

      $COMMONFILES/Angels/IEHelp.htm.tmp

    • Size

      932B

    • MD5

      4e72a0d4ecf37f91b9fc9fd2e27a6661

    • SHA1

      c3e9117731947e1a3e2f9aaea9356cedf5fe53da

    • SHA256

      609471ce7403a914ef23d91082242c876e1b2ffcfcc6a70ab1309f45b387d1d4

    • SHA512

      ffc517b819c9e995f0aadef0583b099b16bff262315a9f27ba1c6306d0e0fde30c32ecaac19fdaf9584f182b64677699b42d40606f4038637485b2b5601d79bb

    Score
    1/10
    • Target

      $COMMONFILES/Angels/IEMenuExt.dll.tmp

    • Size

      194KB

    • MD5

      4c6f8c20b9a649e42b07f33bcce32290

    • SHA1

      c5a59524d924aa66c321479cc1dd0486cb669f61

    • SHA256

      ae47cd1154ceafc74bb4b8b11f5425bd12f2ac5eb3f3ecd7153837cd1b0761f7

    • SHA512

      59d0c341a4beff3dc2b53d3493e2a4642b6c91a426aca0a5510f8ddff732aebc22882535841cf96295acb630b6b73609031df1b697308f360d6798e865fdcd3f

    • SSDEEP

      3072:tHWSddWrkqTQslbv7mfpAQx0F9OS8jouaTX5CEoHgr5Aa9+4UtEBi41kRw:ZW4r87y0POJvakEoHk5AaCfi

    Score
    1/10
    • Target

      $COMMONFILES/Angels/IEScan.dll.tmp

    • Size

      60KB

    • MD5

      bc790cfb3e358b55b841410ae2fd7fa1

    • SHA1

      2cc3e8d98279a5e730bce9b77b18d19d069c90ee

    • SHA256

      589c537d60dfb98c6fbb1d5a26c2ffed48ed3b6ce083e2fc0ff9f4d45f6cbed3

    • SHA512

      97de33fe680f8289fd3b2d761db345198278194853aa40e4c7fa58cd549ff3c55cb2178e0001d0fef74fd385c366a7b2cbb17c0622d955681b564bc5cfe87ee7

    • SSDEEP

      768:8Q0Uz/q4DHd5IytXGU1ZclADgN87Hra48fd+R0iyQpH/xL53+SeeKWr392LEUbG8:B0f4D9yYJlDgMgfdtyt/P+Cj924QG8

    Score
    1/10
    • Target

      $COMMONFILES/Angels/IEsafe.dll.tmp

    • Size

      1.0MB

    • MD5

      e17b2e98ece6437d1c4706bec74f4123

    • SHA1

      12e35f617552c6f46f28a591d243921760d2553d

    • SHA256

      5d112bb59e28f4e2c2caf5d66b76cd625f04e79d87e69610e835653bf4f7574c

    • SHA512

      1b666d0a02d5f0647362fcffa46af47a41583406129a7aaf903e395563f9a07be238d3277ad0c841473c5ca0cc56d0a1c5ae2c1033518125b0207f594c691a82

    • SSDEEP

      12288:IfpD/QT3YycROwCH7JrNxfhcfVuOfkY0Kqpx/25tbyoVmmjyHe4TBu1pJLR3j3LT:6sPrm++ou1p/j3LTD9JBp

    Score
    6/10
    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Target

      $COMMONFILES/Angels/Scan.dll.tmp

    • Size

      1.2MB

    • MD5

      6891d3d4e9fefe584e758db70c0380ae

    • SHA1

      f79f700870f2ea2e37be7bb5569c5a035ffefe81

    • SHA256

      54e849e119904f52cfca5362290daa094544a569c13c9f5edf4806a5e0f611a2

    • SHA512

      b0e908d2067fdc579904c73d13b14d96e22dab546961a65dff867bd0e41acb3483e974acce887fb7586ddc42f33ee28f22369327b90c9a3c9e9c120b40d22e12

    • SSDEEP

      24576:TgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkk6:TgcIwi5nQ24EreytZ2ce

    Score
    1/10
    • Target

      $COMMONFILES/Angels/WebSafe.dll.tmp

    • Size

      411KB

    • MD5

      7ed89085881366038fa967cab289337a

    • SHA1

      a12864a8bf292f9a24b392c1612ab108104bcae3

    • SHA256

      d2080eebe7cda869349c0ac21e8503b24993bf764accdca10fadf4b1251bf65a

    • SHA512

      4440056d682ea2ce7d25bc1517a4e8f83381f7d6db5ec4da841b98eb45cb0eac21b0905db62215f80a75dd14b14b6dc46fd18f5c447c68f9166af4aa60e982fc

    • SSDEEP

      3072:Go/IOSN2Qv32fQNA6rPEvDKke+Eq+g4+AwCWC:9/IOSNPfNjrPeb0pg4eC

    Score
    3/10
    • Target

      $COMMONFILES/Angels/xFoCtrl.dll.tmp

    • Size

      161KB

    • MD5

      c1d9762180741f397b5d71147e4e4141

    • SHA1

      503007d02c1e77697012f0046bd5164b488752d0

    • SHA256

      31ab42cfb448c45b4cafc5c9dd783705ee1f057bdf9b0478ccc94f87fd644427

    • SHA512

      cdd427390bea5e5e9cdc7febcb026477b2445db25e3c038e1a5c7f5f74338fdec62acc387382cd7582a4407d375f4029cc8b15930167313f45c1524f129fa5b4

    • SSDEEP

      3072:h8nvO1B0Rn+rXBllu2jMLaj6ocVkTpS+lsOJx1N:Gnv9Rn+/faPbeIjsN

    Score
    1/10
    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      31KB

    • MD5

      83cd62eab980e3d64c131799608c8371

    • SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

    • SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

    • SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • SSDEEP

      384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy

    Score
    3/10
    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      32KB

    • MD5

      83142eac84475f4ca889c73f10d9c179

    • SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

    • SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

    • SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • SSDEEP

      384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+

    Score
    3/10
    • Target

      $PLUGINSDIR/OnTop.dll

    • Size

      3KB

    • MD5

      7c0c240e911a521e8e554a10d04e558f

    • SHA1

      d12ca9c464f2764e211039c09e56cb347626f7c7

    • SHA256

      28cf47c05c86b2264ea1da120d3644cb46c86d6f27072a9a853e63e05ec97a25

    • SHA512

      579b6787061efdc7f618f3c5a513cb539ccbe12ca41ba5e9ba8f00d03600edcdd82262b0fbfd58b96231c461f18b1233d657cbd0d1b827ea9df5374508578707

    Score
    1/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ab73c0c2a23f913eabdc4cb24b75cbad

    • SHA1

      6569d2863d54c88dcf57c843fc310f6d9571a41e

    • SHA256

      3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457

    • SHA512

      99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8

    • SSDEEP

      96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

upx
Score
7/10

behavioral2

upx
Score
7/10

behavioral3

Score
4/10

behavioral4

Score
4/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

adwarestealer
Score
6/10

behavioral16

adwarestealer
Score
6/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10