bd99084ecea6b27f078ae62e8e4b47c5ebeac32265325d4e30df9a65cbc1ace1

Sharing

Copy URL Twitter E-mail

General

Target

672d03ef24c5e6f26ce12e977ee6456f_JaffaCakes118
Size

6.2MB
Sample

240723-mc1lga1bkh
MD5

672d03ef24c5e6f26ce12e977ee6456f
SHA1

36813998497967c9652143e5bde9cac496e48b03
SHA256

bd99084ecea6b27f078ae62e8e4b47c5ebeac32265325d4e30df9a65cbc1ace1
SHA512

05804493b0993f61e05ccf96dc16418f55fadea3e5b2a51fd4467fe0eebd5ef7fe44ed3766d34e5b5e6993c2e4c60c5f5969f8e0e4aaf063bb3d9b2a2e2ae640
SSDEEP

196608:IZGSeu1taizKTi8HsPM3jsB/Iu4MP20HPjKH7:IZGQaimTiWsTlIu4C2IjKH7

Score

7^/10

Malware Config

Targets

- Target
  
  672d03ef24c5e6f26ce12e977ee6456f_JaffaCakes118
- Size
  
  6.2MB
- MD5
  
  672d03ef24c5e6f26ce12e977ee6456f
- SHA1
  
  36813998497967c9652143e5bde9cac496e48b03
- SHA256
  
  bd99084ecea6b27f078ae62e8e4b47c5ebeac32265325d4e30df9a65cbc1ace1
- SHA512
  
  05804493b0993f61e05ccf96dc16418f55fadea3e5b2a51fd4467fe0eebd5ef7fe44ed3766d34e5b5e6993c2e4c60c5f5969f8e0e4aaf063bb3d9b2a2e2ae640
- SSDEEP
  
  196608:IZGSeu1taizKTi8HsPM3jsB/Iu4MP20HPjKH7:IZGQaimTiWsTlIu4C2IjKH7
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BrandingURL.dll
- Size
  
  4KB
- MD5
  
  71c46b663baa92ad941388d082af97e7
- SHA1
  
  5a9fcce065366a526d75cc5ded9aade7cadd6421
- SHA256
  
  bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
- SHA512
  
  5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StartMenu.dll
- Size
  
  7KB
- MD5
  
  4e96f412a8cc653053d5d918df6b0836
- SHA1
  
  a3c7d59043feecb1603874b27c23d4166b341f2d
- SHA256
  
  e4a54bfc327986a89165bdef361069810aaa985c3abecd442c786725fabaf977
- SHA512
  
  2fec61b4ad31250bdbdbbfd551d831801790b96902c67200661e8f4f2753378bbf6c0c88b12e1be9173a29597827c1c4809511b6d52666dc3324bd7031c8229d
- SSDEEP
  
  96:IiqA7bDe2xHkR1C41EhvSE+6nNtMn0iGd8CqRLqtJ1trRhElfL:IiqA7/ZH0uQMtcfCqo/tdgf
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  ab73c0c2a23f913eabdc4cb24b75cbad
- SHA1
  
  6569d2863d54c88dcf57c843fc310f6d9571a41e
- SHA256
  
  3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
- SHA512
  
  99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
- SSDEEP
  
  96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  e54eb27fb5048964e8d1ec7a1f72334b
- SHA1
  
  2b76d7aedafd724de96532b00fbc6c7c370e4609
- SHA256
  
  ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824
- SHA512
  
  c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4
- SSDEEP
  
  96:57GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgN532E:VKgfwgcr8zylsB49Ud0qJVgNQ
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PROGRAMFILES/Browser/֮.exe
- Size
  
  1.4MB
- MD5
  
  5b09029117dedb91f4b06ef3c0e8b94f
- SHA1
  
  6cef43f5147d5fe01b66748157782626cce44c28
- SHA256
  
  4dbc3ae45a04dea291f318cfefdd091af2d6a2a747f4970a1c369752ca093558
- SHA512
  
  fdd0385a7f094774fb77bec9830c7eb62fa081936c55c91539394421d2b0b8dde8ea7bb84a48001814a1e0b496e741cc5ee5c2ebd905c9ef945e7dbb22e38c32
- SSDEEP
  
  24576:SRFS7Iid6Nx7izcFsaWrtLTOITQA6kOStpbspT63cGnD:vDd6ziVTOITQAOpT63cGnD
Score

6^/10

bootkit evasion persistence trojan
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral13 behavioral14
- Target
  
  Backgrounds/Non-Tabbed/SteahlthOS Zoomer/˵.html
- Size
  
  5KB
- MD5
  
  ac1b56697ecddc6e382f31930f307106
- SHA1
  
  0d818d1b92d2d1259d622bdc73a155af428bf488
- SHA256
  
  888f62bf5bb1861d6ca5d94ded4b5fb3fbe9e186f8e0fdc2111acfb112d565b1
- SHA512
  
  d6127859d05b84e18633c675b5543c04130bfa5781dca7a11f345bf8b8eba9f298b7c67104df5f4f12d96125099ee7af2a56dfc4c0e2aaa209a5acb3ef8f0889
- SSDEEP
  
  96:mLOQeRA2RWhsFf6H7AtVgTrUdl7/kddddddddddddddddddddddddduddddddaQa:MX8A0JFygVk4/z5w1U4j2NckC
Score

1^/10
behavioral15 behavioral16
- Target
  
  CrashRpt.dll
- Size
  
  93KB
- MD5
  
  eb2e5161cb51d9693d2293a62360f85c
- SHA1
  
  9222aae2e59400edcb50931b2d43cb2db8da5ae6
- SHA256
  
  6053041f64d4c6ae9c00f0e95d4bc3c2be2cd47e978f8254582f9a3df70a291b
- SHA512
  
  2c37aa4dbc4c46f7c081e9a64ac2333e5deb1cbb16c1dda0c492bbf6770bf04126e82a8a0a8aba89903ddda7494e018be407fee4e9b895b474ba61835ea46e7b
- SSDEEP
  
  1536:tVWFxAZa/onBdNNof95ToZgSrlwYCslhIhNNB7s2UnYw:t0/AkgBdIe1zlGNB7sxnP
Score

3^/10
behavioral17 behavioral18
- Target
  
  Dock64.dll
- Size
  
  20KB
- MD5
  
  270ad0cea1beb9684e2a12bf55743040
- SHA1
  
  3f51cecb35ee3f4ba0c012369862433aac186b6a
- SHA256
  
  c8128cb2006ee59a0261e659ef3a899ff0eb9660805a9d23f3f88ca2a60432d5
- SHA512
  
  2fbc70c6377058f850f524355d2f0650391d0d5c347d0eafab88af64bb4b8bf3eb4a42c3e1ff91978244715752aa1055e40b03ecfd1933777b97d2b19b89b4f3
- SSDEEP
  
  384:kV684cDoRDIjCgVhkpyTzVHs9OEWu5h8nlHiLCcG:kVP4cFVhEyTz5qOEWG6nlHiL3G
Score

1^/10
behavioral19 behavioral20
- Target
  
  Dock64.exe
- Size
  
  104KB
- MD5
  
  2de21d94bb9516513baa75dd9dee0f21
- SHA1
  
  3d8b7ac5c603696a0443929742c8f372091e6dc7
- SHA256
  
  30067f5e9e9967687eb03ce90177a68a25658b815732cd8b51c4c2c2fecd5262
- SHA512
  
  9f46339990d90dd50491cbf9cd219927fd2aced97e245adbb2ba6bdc3021c2bc8c2fca976e0fd8cd3b05ad32f902f8d4644c69928ff4f3794053c80062c91eb6
- SSDEEP
  
  1536:u02UtO4yWfzeKRsK/XdlAZSqLf0NXpBJnY7:O3M7PRsK/XdlY5LfoXpBJng
Score

1^/10
behavioral21 behavioral22
- Target
  
  DockShellHook.dll
- Size
  
  109KB
- MD5
  
  e20b163073e57c492012f11e39397708
- SHA1
  
  06daf5e093f25286b38f0094e804e2c78b44123c
- SHA256
  
  c27277625a73bfd80c3e40550610f0f657c20c12c8facab9be689f110728045b
- SHA512
  
  8cd8c8ee0bb7a89137d0ddc0fc09ff9fc7edb3e2c2d371c3158a29bb14698349b746d711a0b911d98a7ec1b1fada6ffa6a2b7caef21f57ca3b705db69856ffa2
- SSDEEP
  
  1536:L+ZYI8hqU1d5AK2tq8LiWPjTb5Yt5knnYZ:L+z8oU1dmLiQHI5YnC
Score

1^/10
behavioral23 behavioral24
- Target
  
  ODimg.dll
- Size
  
  116KB
- MD5
  
  92756208fe9138d360f2beb68d5ca349
- SHA1
  
  5359b0f6f342c36b586b555e0c2ca65dd7715508
- SHA256
  
  f551f27a4a9bbdbbbbcadd4ba43c6165e1f17bf5273fac339972673cd2b9bbbc
- SHA512
  
  d9549ca6562017d98121b8ac093d0ec1de6786a7b435c43163ea06bb724d6014ccad7e91c102f369e9d586dcac412ae8c768ffd4a1fedfed8a08b1a1d8531770
- SSDEEP
  
  3072:m/ekNHuu7IqaltFiuiEf0/rN4xg98mGi:m/WXqalPQ1o
Score

3^/10
behavioral25 behavioral26
- Target
  
  StartMenuPosition.dll
- Size
  
  65KB
- MD5
  
  40283d500a5dc6c822cc66297a7cffd5
- SHA1
  
  2cf5a7a461662d4d8ed9f98cb2cbba25dbb1b13a
- SHA256
  
  d5a13baaada8a7b7d37b629161f5566e318bd116565fa21a04b3b74159967091
- SHA512
  
  c932f95748c291e4eb456533a584daa0dee99289c156d3310fb6c21f7aff19243ce6102c884c33ec102a8c7d459e627c7d5847414ca2731e7dca16a9298dccbe
- SSDEEP
  
  768:WKzuNWhAeTzYgZWGOk6mz5YYGVNsGTeReXtF5IpwwwwI92454YMSRpnlHiL37z:WKqN33mYk7zGBVmXRi5Hx5VPnYvz
Score

1^/10
behavioral27 behavioral28
- Target
  
  Uninstall.exe
- Size
  
  103KB
- MD5
  
  a98b00f4a1fe988996c3a2bf5473c55e
- SHA1
  
  a25e2a0785b87f3d9a3ea495c3be7eb6330187d6
- SHA256
  
  c03a1f6092fbd80041c504e11f3331233ce1249d56e5d939c59d1af8585c88c2
- SHA512
  
  3a4b14bfff4cdec88055b7d1e43e8feb8805fc569167c2f4cf1dd01b608be215d81531427f9ecb0939efe93fc4566bd1d2a6d2042e406e246c59e003a1c1edff
- SSDEEP
  
  3072:kqBFJLzgOJJY+z14agrFbwZRHGLIvnoOyQfa0rZ:zPdZ0+h4aNiMvnDj71
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks whether UAC is enabled

Writes to the Master Boot Record (MBR)

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32