Overview

overview

7

Static

static

3

75d4456e2e...18.exe

windows7-x64

7

75d4456e2e...18.exe

windows10-2004-x64

7

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDIR/time.dll

windows7-x64

3

$PLUGINSDIR/time.dll

windows10-2004-x64

3

IETab.dll

windows7-x64

6

IETab.dll

windows10-2004-x64

6

IETab.exe

windows7-x64

6

IETab.exe

windows10-2004-x64

6

IETabHelper.dll

windows7-x64

3

IETabHelper.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75d4456e2e7477cd65770ff2bcc5a231_JaffaCakes118

  • Size

    334KB

  • Sample

    240726-1g3taawemr

  • MD5

    75d4456e2e7477cd65770ff2bcc5a231

  • SHA1

    fe7a2f38f41dc4d76ee98ce884250e157f3a3b75

  • SHA256

    5d6c0a2496fa26999029bc9da666c0c82f37e536ff0691eb1e7cb73e96089a8c

  • SHA512

    15ad0a9c9342862eb5f25d9f7f379f7367dd02dacbd100409b0f34e170d6555ac7cdbba8c498de31cf01fa64ed270d7d69996256295677151ef830fdfee59829

  • SSDEEP

    6144:4e34CNXd75+ZPPfnE2Qyn20US3iDuz4S/LMKmf/nHVcgt75+ZPPfnE2Qyn20U98:dNXdF+ZPPfnEUnriDEMrHVcgtF+ZPPfd

Score
7/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      75d4456e2e7477cd65770ff2bcc5a231_JaffaCakes118

    • Size

      334KB

    • MD5

      75d4456e2e7477cd65770ff2bcc5a231

    • SHA1

      fe7a2f38f41dc4d76ee98ce884250e157f3a3b75

    • SHA256

      5d6c0a2496fa26999029bc9da666c0c82f37e536ff0691eb1e7cb73e96089a8c

    • SHA512

      15ad0a9c9342862eb5f25d9f7f379f7367dd02dacbd100409b0f34e170d6555ac7cdbba8c498de31cf01fa64ed270d7d69996256295677151ef830fdfee59829

    • SSDEEP

      6144:4e34CNXd75+ZPPfnE2Qyn20US3iDuz4S/LMKmf/nHVcgt75+ZPPfnE2Qyn20U98:dNXdF+ZPPfnEUnriDEMrHVcgtF+ZPPfd

    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/IpConfig.dll

    • Size

      114KB

    • MD5

      a3ed6f7ea493b9644125d494fbf9a1e6

    • SHA1

      ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8

    • SHA256

      ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08

    • SHA512

      7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1

    • SSDEEP

      1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      a5f8399a743ab7f9c88c645c35b1ebb5

    • SHA1

      168f3c158913b0367bf79fa413357fbe97018191

    • SHA256

      dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    • SHA512

      824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    • SSDEEP

      192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      13KB

    • MD5

      29858669d7da388d1e62b4fd5337af12

    • SHA1

      756b94898429a9025a04ae227f060952f1149a5f

    • SHA256

      c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62

    • SHA512

      6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f

    • SSDEEP

      384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsProcess.dll

    • Size

      4KB

    • MD5

      05450face243b3a7472407b999b03a72

    • SHA1

      ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

    • SHA256

      95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

    • SHA512

      f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/time.dll

    • Size

      10KB

    • MD5

      38977533750fe69979b2c2ac801f96e6

    • SHA1

      74643c30cda909e649722ed0c7f267903558e92a

    • SHA256

      b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

    • SHA512

      e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

    • SSDEEP

      192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      IETab.dll

    • Size

      178KB

    • MD5

      14880911c4322938b2977069f0e85256

    • SHA1

      4286ea77deedd4350a272f9c701533abcb7305a6

    • SHA256

      b8c0675b3d7f736e8e970ceaaea5f45b4eb62a547d0690bbd16b7ece10b02fb3

    • SHA512

      ca2a8bf7d990671b20b0309a6d9301d2c47814898b2cc3402884c0e8a9bf66a57895bb70a6bc7fd16faf78f1babade050e302128d7df6b00615e6209bb03497b

    • SSDEEP

      3072:PSYWkSyr1ky7nrL1MXd/SZYSEXeHlxSACkuQtnPz7ezI8f8FB9a:Jp1m6ZYSEKl4DVMPWuBQ

    Score
    6/10
    adwarediscoverystealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral13behavioral14

    • Target

      IETab.exe

    • Size

      130KB

    • MD5

      22add2b7ef97a0b55ec38725e4c11949

    • SHA1

      74798d34a4dcb36a47a92beeeed39c17d9ac41b8

    • SHA256

      523272e8b73598374556d0ac3cd2d58f84e54e3c6253b976a3e72776a4a99151

    • SHA512

      0aa8c90b70ef4d6297cb4a89f89f65b0813e236587ab5b92ae279bf526535f68610e4f8159351303e90243da5d551f80c6fe23c91b2b4a67b6550597d300ee22

    • SSDEEP

      3072:2ZsvfBkD8XaDpN/kZdds7KKI/XnPz7Ptf:ysG0aDpN/4CTIfP35

    Score
    6/10
    adwarediscoverypersistencestealer

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral15behavioral16

    • Target

      IETabHelper.dll

    • Size

      34KB

    • MD5

      71db4d230fcf75b68d994e5589b9a379

    • SHA1

      50e486650e07b860027a01ec01b792bf4a302347

    • SHA256

      149900a696ec6400d65ca1546c3c9816a0dd602573b1dbdceb1e4281aa762803

    • SHA512

      b4d7ac8082af5abb9feabfd68278a36627b3fd28ec85991550a362f3b04877bf4b1a21431ab8bb75ea25d6afa4716615f5de197d1731870d2bb80125d067f1a0

    • SSDEEP

      192:Jw0uTGPOLOGx2xitAM8UdrXX335/wJirNmL/l0F8uENyxyZb8rou7+wLw:gTPLOGQ0x5drH3mirILuD0ygu6

    Score
    3/10
    discovery
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks