Overview

overview

7

Static

static

3

960d5c7972...18.exe

windows7-x64

7

960d5c7972...18.exe

windows10-2004-x64

7

$0/uninstall.exe

windows7-x64

7

$0/uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$0/zwankysearch.dll

windows7-x64

1

$0/zwankysearch.dll

windows10-2004-x64

1

$0/zwankysearch.exe

windows7-x64

1

$0/zwankysearch.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118

  • Size

    655KB

  • Sample

    240814-pdgabswdpp

  • MD5

    960d5c797298fbbe45eb9dd2fafade0d

  • SHA1

    1a34911fea08ca38a24a7b28a5c0531ef23659a8

  • SHA256

    e1f705a150f56a760af68e717f90cd553bf7eaba7861e7fe6596ba76d06b3f7f

  • SHA512

    6ae4da5d2eb692a9f1e5845458c160f9566322d5e3b21afd3765c60b6bcfbb3496b490b732db4501c881188b3f4ec06fdeb5ccf02a01cea4705b73e474c0a6dc

  • SSDEEP

    12288:8ZV4oaq2hwFKUanKHE2O4F/i0Mt/YLJa19G5HREoc5hJqM9W8nGa54dqDqu5clH:8r32hwFKHnj4qOLJa198IhJqms4DquaN

Score
7/10
discovery

Malware Config

Targets

    • Target

      960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118

    • Size

      655KB

    • MD5

      960d5c797298fbbe45eb9dd2fafade0d

    • SHA1

      1a34911fea08ca38a24a7b28a5c0531ef23659a8

    • SHA256

      e1f705a150f56a760af68e717f90cd553bf7eaba7861e7fe6596ba76d06b3f7f

    • SHA512

      6ae4da5d2eb692a9f1e5845458c160f9566322d5e3b21afd3765c60b6bcfbb3496b490b732db4501c881188b3f4ec06fdeb5ccf02a01cea4705b73e474c0a6dc

    • SSDEEP

      12288:8ZV4oaq2hwFKUanKHE2O4F/i0Mt/YLJa19G5HREoc5hJqM9W8nGa54dqDqu5clH:8r32hwFKHnj4qOLJa198IhJqms4DquaN

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $0/uninstall.exe

    • Size

      83KB

    • MD5

      71c085dade61786f05adc685d4f74b01

    • SHA1

      8b58d09e5c47a14edf983277bfff8ea6db313d4c

    • SHA256

      cd2ed594c06c16d66b534e6aaf76afb99c0dcbf77f4906ceba9c29495d300af2

    • SHA512

      add86e11840a0a69b3e4ba51756e672f58b9f363436c2fd7fb8b549b7f1fae0198093980b8bf93a984a920eb37703cf9af3280e11e0907ae202a8bd441a7999e

    • SSDEEP

      1536:+EkjY1zy214Qay0DGkJ7qAELVigJP7Fcpw/1q792sX7Ia12/DzJF:1kjAJ4dDGkJ+AI0M7Ko1qRka0/xF

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      13KB

    • MD5

      d765c492c21689e3d9d61634371fd861

    • SHA1

      ac200933671ae52c9d5544d0e2e8e9144d286c83

    • SHA256

      551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    • SHA512

      9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

    • SSDEEP

      192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      fe24766ba314f620d57d0cf7339103c0

    • SHA1

      8641545f03f03ff07485d6ec4d7b41cbb898c269

    • SHA256

      802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    • SHA512

      60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

    • SSDEEP

      192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $0/zwankysearch.dll

    • Size

      564KB

    • MD5

      73129c296e9a54d59a24e623b6091652

    • SHA1

      3cc899e3deb891cfa10981903ad01a7db0b6d8b2

    • SHA256

      d773b1dade17560e01a1d57d304b9ff853953fffefdda81ead0448f6be719e8d

    • SHA512

      48ff62c6e2cd50378adabf074c906d64d57230be1563b49a3e1b37216d3abb03a4bbb5bd8d5b8cd7a24f130fd586947603ad8f7268abd8941b3bdc9e66224fa8

    • SSDEEP

      12288:qZW11pKUJa5YDG8Wx+Y4y9rMJJboeFvbmSsVjKuPI:/rgWaBx+S9rM7bFdsdPI

    Score
    1/10
    behavioral10behavioral9

    • Target

      $0/zwankysearch.exe

    • Size

      48KB

    • MD5

      ed758535ce8531f2d471d87e1798532b

    • SHA1

      58c191bd4c41b19abb54a8b313381d657fd1a148

    • SHA256

      2b3bc89f6c62446657fe762a1dfdf1feb40c73625f21d5829e5fef3808d78723

    • SHA512

      95cd159bf798520a6d9bf67eb8f8ae142ee730b9706627962bb9a74cb0803c24d4decf6664bea4d81ba3c7cdd0589c38593bee7a87a4f25e3c9219a9e2c1b331

    • SSDEEP

      768:a75/8eeFAZDLQrLIxoVhJv3DQEJL2/WE0uCbyO8kR5DIaLFC:a18FAx8jvzhOWE0PbyODD7JC

    Score
    3/10
    discovery
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks