Overview

overview

7

Static

static

3

5f941637d2...18.exe

windows7-x64

7

5f941637d2...18.exe

windows10-2004-x64

7

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...ge.dll

windows7-x64

3

$PLUGINSDI...ge.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$TEMP/nsisos.dll

windows7-x64

1

$TEMP/nsisos.dll

windows10-2004-x64

1

AddScheduler.exe

windows7-x64

1

AddScheduler.exe

windows10-2004-x64

1

BoanSupport.exe

windows7-x64

3

BoanSupport.exe

windows10-2004-x64

7

BoanSupportMon.exe

windows7-x64

3

BoanSupportMon.exe

windows10-2004-x64

3

BoanSupportcfg.exe

windows7-x64

3

BoanSupportcfg.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    5f941637d2387b4dfbccfb7f30bae8ba_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240720-jcfphssdnn

  • MD5

    5f941637d2387b4dfbccfb7f30bae8ba

  • SHA1

    0e345867d890093b965312964cf91a0368f9be71

  • SHA256

    35288cc9856deb3cd3a5d47364073420671b323fb0d887621e47b69f53a24ceb

  • SHA512

    ce027ff7e874a30a310b7f4501ac18ff1566019d34f87d96703b8b6caccf53cfb7e962a4be767d2cbb690c17cd4809c39179095edd4eb5030f89f4bbbe71625f

  • SSDEEP

    12288:cYdyfgrF0velfihzkUOTGUGvcjltqRfXl+pG6wkKtTL3Hh1GF5oqhXDXwxHMMCcN:dyoryefihrzUGEfqJQpeZTLP45hXcRfN

Score
7/10

Malware Config

Targets

    • Target

      5f941637d2387b4dfbccfb7f30bae8ba_JaffaCakes118

    • Size

      1.2MB

    • MD5

      5f941637d2387b4dfbccfb7f30bae8ba

    • SHA1

      0e345867d890093b965312964cf91a0368f9be71

    • SHA256

      35288cc9856deb3cd3a5d47364073420671b323fb0d887621e47b69f53a24ceb

    • SHA512

      ce027ff7e874a30a310b7f4501ac18ff1566019d34f87d96703b8b6caccf53cfb7e962a4be767d2cbb690c17cd4809c39179095edd4eb5030f89f4bbbe71625f

    • SSDEEP

      12288:cYdyfgrF0velfihzkUOTGUGvcjltqRfXl+pG6wkKtTL3Hh1GF5oqhXDXwxHMMCcN:dyoryefihrzUGEfqJQpeZTLP45hXcRfN

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/DLLWebCount.dll

    • Size

      28KB

    • MD5

      0bdd7c6f1046ea4b42839f991ae53fb2

    • SHA1

      cb9baefb10159b4a684fa1ee4372e7715865052d

    • SHA256

      0a0019b2603dbc4505453c2501255ab0cc0b3c317ece4a6ce0cfb6a02a30907b

    • SHA512

      96f41497f25d7bc81f51ab167f74243b4b767089c89c26f9752ef518fa60dedd2722c66ae87dad2334bcce1622bc12f7b9b892ae654ca58cecd9f35c9f1dc163

    • SSDEEP

      192:OQoR7CK9FX/dVPWtJ/tXP88bSNwWW8+YdbDT:OQcWeJ/XPWtJxPFYi8nb

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/ExLicenseBoanSupportPage.dll

    • Size

      48KB

    • MD5

      fa7057b96c5e0ee2a356d96f82393204

    • SHA1

      bd0695fdafbe72299a826a1e13d32b47d4f94317

    • SHA256

      11761fc0fba2b78083e2d46f14afedd0345e0650134f9f557ed83b417311b3d3

    • SHA512

      5216102ac3a4ad444a5b632ceadd257d904405325ca4766ffaa5ff598188ab945a5c9f3483071f3b161374e8a900a508089db420d5241a5196ee8cc20846039a

    • SSDEEP

      384:9TC+WJzIuhKvncN1ZbOgYC+938m0kNyDt82LvnJviXnCO4u:95uIgWWbOgYxJ8tSSti4

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      eef9e469e8a30717974499f277d97e2a

    • SHA1

      2d33c25984ebd9116beeb55cdde4c5c86c023e5d

    • SHA256

      1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

    • SHA512

      d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

    • SSDEEP

      192:8np6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTjK72dwF7dBEnbok:8p6UdHXcIiY535zBtMTj+BEnbo

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c6f5b9596db45ce43f14b64e0fbcf552

    • SHA1

      665a2207a643726602dc3e845e39435868dddabc

    • SHA256

      4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0

    • SHA512

      8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a

    • SSDEEP

      192:qADKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQbVUSF:qAViJrtFRdbmXK8+WVUw

    Score
    3/10
    behavioral10behavioral9

    • Target

      $TEMP/nsisos.dll

    • Size

      5KB

    • MD5

      69806691d649ef1c8703fd9e29231d44

    • SHA1

      e2193fcf5b4863605eec2a5eb17bf84c7ac00166

    • SHA256

      ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

    • SHA512

      5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

    • SSDEEP

      48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn

    Score
    1/10
    behavioral11behavioral12

    • Target

      AddScheduler.exe

    • Size

      379KB

    • MD5

      f6f71b8d45855097641549c59a13630b

    • SHA1

      e8b4250b58993c1550f96e9a74db2058ad302019

    • SHA256

      5e8ebf54e987804b6f06880505240ca1fe14c70d3a10e9de580f37adb933b029

    • SHA512

      5b64683f9d9ead2e2f036fba34b231021f01be84fcec47f61c8595da28b9951bfa8f0f85b70ff8e3181212cb01a0cffb9e00e18ca92306e3b8c119bb43f3488f

    • SSDEEP

      6144:U7GS1D7K18xPMQvF01cwaP0SCS8GMSQSlgTJ9Of+F/p/uwONct43D92U:R8xPvv9P0SCS84l+TJ959pGHNu4B2U

    Score
    1/10
    behavioral13behavioral14

    • Target

      BoanSupport.exe

    • Size

      5.1MB

    • MD5

      7563452b1cbb9954602bab1313bc3531

    • SHA1

      0d4096cb36d1efb02bc707368bc48e2abb3a0504

    • SHA256

      ed56da24442303141588cf9cfe7e38a971aaf5ba1a60764117189b13577347ba

    • SHA512

      fb84e2735490f90a56cac337f9c6e1465294f16eecd8ecf36b688115ac21626f6192483761c0d4a5d90207667bb7197e793e8c52410436c2ded3df31f0ffb688

    • SSDEEP

      12288:yMHC2ESCu95o+RLbzLyLMJRpW/rjssLVIHBgJH+7mxxJkYXOVu:9HC2ESC6beLMkssKhNy

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral15behavioral16

    • Target

      BoanSupportMon.exe

    • Size

      849KB

    • MD5

      e28443d8f550b7e0e9de7d5a58890a8e

    • SHA1

      287061cce74bb37b79fdcecb57246b6182882e4a

    • SHA256

      ba199ec8f3540d7191436687c7efceb95ae473d770210dd63a99074e8e44491b

    • SHA512

      29d5713914434f494218cc3bc0288d5de88f28f358a2659bccb00c330f0dae1fbc86835e98c10b5640ed13e636364eaa633677f2303bf28b565b95dc3774e29a

    • SSDEEP

      6144:STtdbW5lnZbYpB1O7GSXAoQN8sQSfkiLkxg0GSMbuTGDqe:ShNGlnZbrQNnfkiQxg0GdAa

    Score
    3/10
    behavioral17behavioral18

    • Target

      BoanSupportcfg.exe

    • Size

      550KB

    • MD5

      98239cbaae4910168e6a248f3c3385c3

    • SHA1

      a04a804695e47ec38887fa182f06286531597d00

    • SHA256

      85e0e9b7a17b444bbc11ec0ade660d255aac096f14d77d40bf5a95e3b1047fb5

    • SHA512

      9f930051fa884ba42ad1fb43c58723b4b761d931b7f27f0715a1535d88fc935c1d276b9bd8faa5b82936fa3ad6491b17ca18031c9c6e140709fc87c74393dcbd

    • SSDEEP

      6144:Qa1GBosz6ABawRLrd1QVOJEGsH23CVVU9pN3SlEukEw4T9c2xy8gl8YiC:Qa1Ctaw1dKW3CVV4SlfkE3T3BC

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks