e60aea3de7a184da9ffe6ab259ac9d8df4f766b7073425e1b9a0c38cba47e6a0

Sharing

Copy URL Twitter E-mail

General

Target

31151a90a011c05239d9382943fd972a_JaffaCakes118
Size

5.3MB
Sample

240709-tqyscssckm
MD5

31151a90a011c05239d9382943fd972a
SHA1

c28823aa1a26411782937e5ee7dcdbbb5d844d66
SHA256

e60aea3de7a184da9ffe6ab259ac9d8df4f766b7073425e1b9a0c38cba47e6a0
SHA512

e206e29f44cc239833416cda5433c59ed3ec4a74a78c5c2c5afe7b4c82903126c99dc1398ac56570a6fa5e6ba551ec80ee29a6830bb50eb201688e3a5c238f90
SSDEEP

98304:Kg8H+KNKS6r/5rdZhydaId1qqnkdSaNkMS+fHAy0VHzZlh3zXW4Y:J8HT6r/5xZ0dp1qqnk4aeMS+fgymlTmt

Score

10^/10

Malware Config

Targets

- Target
  
  31151a90a011c05239d9382943fd972a_JaffaCakes118
- Size
  
  5.3MB
- MD5
  
  31151a90a011c05239d9382943fd972a
- SHA1
  
  c28823aa1a26411782937e5ee7dcdbbb5d844d66
- SHA256
  
  e60aea3de7a184da9ffe6ab259ac9d8df4f766b7073425e1b9a0c38cba47e6a0
- SHA512
  
  e206e29f44cc239833416cda5433c59ed3ec4a74a78c5c2c5afe7b4c82903126c99dc1398ac56570a6fa5e6ba551ec80ee29a6830bb50eb201688e3a5c238f90
- SSDEEP
  
  98304:Kg8H+KNKS6r/5rdZhydaId1qqnkdSaNkMS+fHAy0VHzZlh3zXW4Y:J8HT6r/5xZ0dp1qqnk4aeMS+fgymlTmt
Score

10^/10

adware discovery evasion stealer
- Modifies firewall policy service
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ButtonEvent.dll
- Size
  
  4KB
- MD5
  
  fad9d09fc0267e8513b8628e767b2604
- SHA1
  
  bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA256
  
  5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- SHA512
  
  b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/ExecCmd.dll
- Size
  
  4KB
- MD5
  
  b9380b0bea8854fd9f93cc1fda0dfeac
- SHA1
  
  edb8d58074e098f7b5f0d158abedc7fc53638618
- SHA256
  
  1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
- SHA512
  
  45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c
- SSDEEP
  
  48:ifXNtGNjFizsU35iej7luiwa28mDJmDKUOMQH0glay/Aa4r/:5Fef5iej5txKJKenlV4r/
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/ExecDos.dll
- Size
  
  5KB
- MD5
  
  a7cd6206240484c8436c66afb12bdfbf
- SHA1
  
  0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919
- SHA256
  
  69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926
- SHA512
  
  b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904
- SSDEEP
  
  48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  31KB
- MD5
  
  83cd62eab980e3d64c131799608c8371
- SHA1
  
  5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA256
  
  a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- SHA512
  
  91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP
  
  384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  32KB
- MD5
  
  83142eac84475f4ca889c73f10d9c179
- SHA1
  
  dbe43c0de8ef881466bd74861b2e5b17598b5ce8
- SHA256
  
  ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
- SHA512
  
  1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
- SSDEEP
  
  384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
Score

3^/10
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1
  
  168f3c158913b0367bf79fa413357fbe97018191
- SHA256
  
  dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- SHA512
  
  824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP
  
  192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score

3^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/md5dll.dll
- Size
  
  8KB
- MD5
  
  a7d710e78711d5ab90e4792763241754
- SHA1
  
  f31cecd926c5d497aba163a17b75975ec34beb13
- SHA256
  
  9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
- SHA512
  
  f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
- SSDEEP
  
  96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
Score

3^/10
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/nsisXML.dll
- Size
  
  11KB
- MD5
  
  13deb9a0f4e4286df01abc85e1895e09
- SHA1
  
  3174853b32407fd85220de844b390a18a8a76c97
- SHA256
  
  c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
- SHA512
  
  604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
- SSDEEP
  
  192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
Score

3^/10
behavioral21 behavioral22
- Target
  
  $SYSDIR/$SYSDIR/Funshion.scr
- Size
  
  524KB
- MD5
  
  02ec8649344eb2175b53dafe60bcdd16
- SHA1
  
  2f3c94b9b82ec849f65e5e63157c3655d9152237
- SHA256
  
  2b694ea3e88747ca6f3f2bcf21c8b86da51668810db6af236c17e93726ca6629
- SHA512
  
  c4f68a10b3b309c5a2650948b184e928e825a4051926ad25b533cee8ba65486f7240c41481dcb34f7cb6a121804f5b2ca69ec33bd5742452560a9ef36916fff1
- SSDEEP
  
  12288:+yufLgjikHAppunG/NjKGXndqP6+FmyW+ndJxEW3ishcu:kTg29jK7P6+E4nbWAi2H
Score

1^/10
behavioral23 behavioral24
- Target
  
  $TEMP/$SYSDIR/Funshion.scr
- Size
  
  524KB
- MD5
  
  02ec8649344eb2175b53dafe60bcdd16
- SHA1
  
  2f3c94b9b82ec849f65e5e63157c3655d9152237
- SHA256
  
  2b694ea3e88747ca6f3f2bcf21c8b86da51668810db6af236c17e93726ca6629
- SHA512
  
  c4f68a10b3b309c5a2650948b184e928e825a4051926ad25b533cee8ba65486f7240c41481dcb34f7cb6a121804f5b2ca69ec33bd5742452560a9ef36916fff1
- SSDEEP
  
  12288:+yufLgjikHAppunG/NjKGXndqP6+FmyW+ndJxEW3ishcu:kTg29jK7P6+E4nbWAi2H
Score

1^/10
behavioral25 behavioral26
- Target
  
  $TEMP/Dump.dll
- Size
  
  266KB
- MD5
  
  138408a562fb0601f2a48fb4a8c8aa23
- SHA1
  
  66ee62cb205105ea9c4132222378ead791cef78e
- SHA256
  
  bf06808cd630c20569afed9573ef40a71f83aee605a70fa6c8f69c96d7c37618
- SHA512
  
  f8f97cf425966afe0ae83ff078fe94b9d9f052ed01f3deb17ca852bb87e94a8f3fb57f600fc062179f968bbd5996b92a9a60efa6d1d2befc18ab88c26f999fbe
- SSDEEP
  
  3072:Ea8YWXU8fXYVs3r7cwfpcMwCZ/Yz6wcIyVFLRKIIYo+RCG5SJND4sD:EYWXU8gwfpcMwCZjMyX0Z+RCZJNz
Score

5^/10
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  
  $TEMP/getmacaddress.dll
- Size
  
  154KB
- MD5
  
  43d6ea2d92057a5bee55a24da663c5d1
- SHA1
  
  2aee91ec9978b47aa897332a60ad53eaf47b3629
- SHA256
  
  b54029ec6385605fac85067be8573f6fb97fe9958ab527789b145efbf5133445
- SHA512
  
  94a1f3622cb5e6a329b1eb9dd6a11f41515ac56417fb48aa661dd5fe32b6571a7cd73303b82def40c7e99067b6766206ad0abfa31b865ffe383c45aea79f5e1a
- SSDEEP
  
  3072:IhITGPcAGwKKmHHzsgFvpflFbJLa0G5G9lk8:Ihm8wKeHoKvBlr757j
Score

1^/10
behavioral29 behavioral30
- Target
  
  $TEMP/xml2fspdata.exe
- Size
  
  122KB
- MD5
  
  e658e684b19c7dbacf1d197c3fdb0265
- SHA1
  
  5fe48fc190f65d44090854a7549925e19bd81b61
- SHA256
  
  434ad3a94e2686eee117d140302a089b12caec2a1e29bfb8dbf9004d555f7c33
- SHA512
  
  87d554df3720ba8e3da89fa1cd60184a3e4eb906281adfeac7cccd375837b53001bfc7dd1a6dcdad2a6caa39b3950df5e938dae6c1f5e24e425a69153dcdea1f
- SSDEEP
  
  3072:8BGnF5O6zuqlseceLqGtbNiD+MyQyba5uIq:eu5O6HlTVLbNiB2F3
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies firewall policy service

Drops startup file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Installs/modifies Browser Helper Object

Drops file in System32 directory

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32