dc150e97ce37b63c0dea549dc507ae341ac8e9e2f859cd659be137f671423b88

Sharing

Copy URL

Twitter E-mail

General

Target

8276a2e07efddb5f695912ad26af8ff3_JaffaCakes118
Size

5.5MB
Sample

240802-bj9beawgpl
MD5

8276a2e07efddb5f695912ad26af8ff3
SHA1

bd6683df25655eef77abbe0aef5576bf45272498
SHA256

dc150e97ce37b63c0dea549dc507ae341ac8e9e2f859cd659be137f671423b88
SHA512

6c61fc71212ab1b18d15e966771d4a10d38713d7f85c73d716ccf44166e3e8ea8a5c3d4ad2890f9ddd1720966c5d7fa1b3bbe3959d251183daa4c39b5d6e2f48
SSDEEP

98304:QyjtcE3qmO7AkAerVkZkObDjgSMOdEQLL1yU/Ad5j5DZgENnXNPRJ:VjSE3qmw3AwVkZdDpdnLByU/s5DJNZJ

Score

10^/10

Malware Config

Targets

- Target
  
  8276a2e07efddb5f695912ad26af8ff3_JaffaCakes118
- Size
  
  5.5MB
- MD5
  
  8276a2e07efddb5f695912ad26af8ff3
- SHA1
  
  bd6683df25655eef77abbe0aef5576bf45272498
- SHA256
  
  dc150e97ce37b63c0dea549dc507ae341ac8e9e2f859cd659be137f671423b88
- SHA512
  
  6c61fc71212ab1b18d15e966771d4a10d38713d7f85c73d716ccf44166e3e8ea8a5c3d4ad2890f9ddd1720966c5d7fa1b3bbe3959d251183daa4c39b5d6e2f48
- SSDEEP
  
  98304:QyjtcE3qmO7AkAerVkZkObDjgSMOdEQLL1yU/Ad5j5DZgENnXNPRJ:VjSE3qmw3AwVkZdDpdnLByU/s5DJNZJ
Score

10^/10

adware discovery evasion persistence stealer
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ButtonEvent.dll
- Size
  
  4KB
- MD5
  
  fad9d09fc0267e8513b8628e767b2604
- SHA1
  
  bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA256
  
  5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- SHA512
  
  b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/ExecCmd.dll
- Size
  
  4KB
- MD5
  
  b9380b0bea8854fd9f93cc1fda0dfeac
- SHA1
  
  edb8d58074e098f7b5f0d158abedc7fc53638618
- SHA256
  
  1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
- SHA512
  
  45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c
- SSDEEP
  
  48:ifXNtGNjFizsU35iej7luiwa28mDJmDKUOMQH0glay/Aa4r/:5Fef5iej5txKJKenlV4r/
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/ExecDos.dll
- Size
  
  5KB
- MD5
  
  a7cd6206240484c8436c66afb12bdfbf
- SHA1
  
  0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919
- SHA256
  
  69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926
- SHA512
  
  b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904
- SSDEEP
  
  48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  31KB
- MD5
  
  83cd62eab980e3d64c131799608c8371
- SHA1
  
  5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA256
  
  a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- SHA512
  
  91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP
  
  384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  32KB
- MD5
  
  83142eac84475f4ca889c73f10d9c179
- SHA1
  
  dbe43c0de8ef881466bd74861b2e5b17598b5ce8
- SHA256
  
  ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
- SHA512
  
  1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
- SSDEEP
  
  384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1
  
  168f3c158913b0367bf79fa413357fbe97018191
- SHA256
  
  dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- SHA512
  
  824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP
  
  192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/SelfDel.dll
- Size
  
  4KB
- MD5
  
  5e14f6774c43bdff6ffe0afb0d51c47f
- SHA1
  
  fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27
- SHA256
  
  7cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9
- SHA512
  
  6ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/md5dll.dll
- Size
  
  8KB
- MD5
  
  a7d710e78711d5ab90e4792763241754
- SHA1
  
  f31cecd926c5d497aba163a17b75975ec34beb13
- SHA256
  
  9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
- SHA512
  
  f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
- SSDEEP
  
  96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/nsisXML.dll
- Size
  
  11KB
- MD5
  
  13deb9a0f4e4286df01abc85e1895e09
- SHA1
  
  3174853b32407fd85220de844b390a18a8a76c97
- SHA256
  
  c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
- SHA512
  
  604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
- SSDEEP
  
  192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  $SYSDIR/$SYSDIR/Funshion.scr
- Size
  
  504KB
- MD5
  
  f6fb0456e5083b41eb970d1ec4de2d76
- SHA1
  
  b1ef6414e651c06a79d36cd21eb88b69f7ea0851
- SHA256
  
  9a436d862a56174373be465a05dc477c9a1f96be52f01a8606e3d890f6b7cb0d
- SHA512
  
  b348a14f4a91905d9f1dd730a731553581a18a7646176763075a5e66abb2639fb02477d913db177c0ab19ebba4f891fa937cac1afe99fd3bd8b59bd0cb99bb97
- SSDEEP
  
  6144:UKhrsGRZubVktVTZ1mNjqmJk+Lf+n9sQTfioxE2J3nybMOsPvhApvvUb:FhrRRZuB8znmyW+ndJxEW3ishcu
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  $TEMP/$SYSDIR/Funshion.scr
- Size
  
  504KB
- MD5
  
  f6fb0456e5083b41eb970d1ec4de2d76
- SHA1
  
  b1ef6414e651c06a79d36cd21eb88b69f7ea0851
- SHA256
  
  9a436d862a56174373be465a05dc477c9a1f96be52f01a8606e3d890f6b7cb0d
- SHA512
  
  b348a14f4a91905d9f1dd730a731553581a18a7646176763075a5e66abb2639fb02477d913db177c0ab19ebba4f891fa937cac1afe99fd3bd8b59bd0cb99bb97
- SSDEEP
  
  6144:UKhrsGRZubVktVTZ1mNjqmJk+Lf+n9sQTfioxE2J3nybMOsPvhApvvUb:FhrRRZuB8znmyW+ndJxEW3ishcu
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  $TEMP/Dump.dll
- Size
  
  292KB
- MD5
  
  170b07cb382aa88703522bef5645d7a6
- SHA1
  
  d08feaf1c69a64bc31a19badd3b1ef8da230f930
- SHA256
  
  044aebc88de22c0ae81a289a6c11d766b2c3b261825bd613d90d4f928266fab3
- SHA512
  
  5d0498f266ebeb68de02eec20460787f4a73baa33e6cb53b9365720065e738e918b51e534b3c4ec052f156430acea1d41ed715f78c4374e365262ffe312c079a
- SSDEEP
  
  6144:0kUXvxOR4A6FE2oybxHbJTA4O+b+7dO7Ydb5:0kUXvxOj6FES7Oj+bwdO7Yd9
Score

5^/10

discovery
- Drops file in System32 directory
behavioral29 behavioral30
- Target
  
  $TEMP/getmacaddress.dll
- Size
  
  156KB
- MD5
  
  7598ba134ae1b92a18f071f5c3f1a7e6
- SHA1
  
  559b4f9e36774548fc9a7a9c8c7385f831ed0800
- SHA256
  
  f6df67a3cfeef9518f9ab8698eea44a2c2943a56d1772b79309706dbdce6baee
- SHA512
  
  addd953d6f4db0e66bf87fa8af74dfab75912a885d055657be9e204de20a88f38b62565d34e0d255d16e31770a0d6211370877e9aa63bb637247510c16078ebe
- SSDEEP
  
  3072:dLLYx20PcAAtmt0O7GcezOIUiTdrqBWUBwFw5xPlRW:dn0phV7d+dT3YDts
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies firewall policy service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

Drops file in System32 directory

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32