Overview

overview

7

Static

static

3

a9717874b9...18.exe

windows7-x64

7

a9717874b9...18.exe

windows10-2004-x64

7

$0.exe

windows7-x64

7

$0.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    a9717874b91bf74d8c86a5828307f2b8_JaffaCakes118

  • Size

    6.9MB

  • Sample

    240819-d83w2ascrd

  • MD5

    a9717874b91bf74d8c86a5828307f2b8

  • SHA1

    7620662875b705db740fb084f00eefe53f7ac9e2

  • SHA256

    8cdbb4a4068632144614afb59992b7fd3ea4145782a04a9229137a972c01cbe3

  • SHA512

    063da601be6f1d73ddc3100c18b2007375c4fd371dd5ad07028ce09c4717f0456c137b2842248f391f6508b245255c9515dd8a6a02b38835b3a3b1a405e4eaff

  • SSDEEP

    196608:sl48PLCHEsuTA2ajOoO0JojFlAGKTuSQYye6xarp:sGuek1A2ajOo+jzDKTRoel9

Score
7/10
adwarediscoveryspywarestealer

Malware Config

Targets

    • Target

      a9717874b91bf74d8c86a5828307f2b8_JaffaCakes118

    • Size

      6.9MB

    • MD5

      a9717874b91bf74d8c86a5828307f2b8

    • SHA1

      7620662875b705db740fb084f00eefe53f7ac9e2

    • SHA256

      8cdbb4a4068632144614afb59992b7fd3ea4145782a04a9229137a972c01cbe3

    • SHA512

      063da601be6f1d73ddc3100c18b2007375c4fd371dd5ad07028ce09c4717f0456c137b2842248f391f6508b245255c9515dd8a6a02b38835b3a3b1a405e4eaff

    • SSDEEP

      196608:sl48PLCHEsuTA2ajOoO0JojFlAGKTuSQYye6xarp:sGuek1A2ajOo+jzDKTRoel9

    Score
    7/10
    adwarediscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

    • Target

      $0.exe

    • Size

      6.8MB

    • MD5

      7fc8bc184501f4bebf58d891a13a4297

    • SHA1

      161c6bcbd11f16fa50869205d44621fe6ea32a10

    • SHA256

      c725547de6a430338e39b3c978c0fc89e5b054de3ef653e30dc4704eefbebb23

    • SHA512

      282e2912ffdbf97d67e4896b3a18ad2bc4c1283f070c5bb8b61426ec40d84fd23db3f62a0a09a27985a2a8c404eb7dccbff6de36af9dcf86d5d466b93651c30a

    • SSDEEP

      196608:84C6LY5eF2Chd1khvEgRaQsS3+BDCly/yeZMlu:rVM0hhd1khvWQDOBDkpeQu

    Score
    7/10
    adwarediscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      17KB

    • MD5

      88ad3fd90fc52ac3ee0441a38400a384

    • SHA1

      08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

    • SHA256

      e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

    • SHA512

      359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

    • SSDEEP

      384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk

    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks