fa9c85f956773b5c1430b2cab5986a5e7465664efe49161d1fa530b9daafc124

Sharing

Copy URL Twitter E-mail

General

Target
c12e258275265c646e5949c6da18f29c_JaffaCakes118
Size 328KB
Sample240825-vhdb5avalb
SHA256 fa9c85f956773b5c1430b2cab5986a5e7465664efe49161d1fa530b9daafc124
MD5 c12e258275265c646e5949c6da18f29c
SHA1 84797d63f542f9131333af42b2d85544b1dd9356
SHA512 09d233d79d9b989b633df5de6f3a9d17cfb972bbad8233a3430f9fd8e18a9dcc80e3fe8d3b79e586ace254f41c96ed8fedf2c8cc55e19e10e07857a9dc893145
SSDEEP 6144:Me34COl75+ZPPfnE2Qyn20UK1fGGhmudYDXRXR6vaVXS/YOr75+ZPPfnE2Qyn20e:pKF+ZPPfnEUnxZGGMud6B6SVXSAGF+Zm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  c12e258275265c646e5949c6da18f29c_JaffaCakes118
- Size 328KB
- SHA256 fa9c85f956773b5c1430b2cab5986a5e7465664efe49161d1fa530b9daafc124
- MD5 c12e258275265c646e5949c6da18f29c
- SHA1 84797d63f542f9131333af42b2d85544b1dd9356
- SHA512 09d233d79d9b989b633df5de6f3a9d17cfb972bbad8233a3430f9fd8e18a9dcc80e3fe8d3b79e586ace254f41c96ed8fedf2c8cc55e19e10e07857a9dc893145
- SSDEEP 6144:Me34COl75+ZPPfnE2Qyn20UK1fGGhmudYDXRXR6vaVXS/YOr75+ZPPfnE2Qyn20e:pKF+ZPPfnEUnxZGGMud6B6SVXSAGF+Zm
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/IpConfig.dll
- Size 114KB
- SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
- MD5 a3ed6f7ea493b9644125d494fbf9a1e6
- SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
- SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
- SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
- MD5 29858669d7da388d1e62b4fd5337af12
- SHA1 756b94898429a9025a04ae227f060952f1149a5f
- SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
- SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  IETab.dll
- Size 178KB
- SHA256 f83bca6cd4897e8fcd3efd7f27abcb0152ef4c1887c5b6474d7842fa3eebf31f
- MD5 d767390d6e47b2762accaf9f4b44a2fa
- SHA1 56c770abedfd52dee418e8b842b50e99b40c48d1
- SHA512 6e0f534fcb5c6017701583b212f9aaf460078eaaf381b7005011613022752e032c5e64aa212803f82d9a4e8555ad5c61eed5f5685981d82d3d587969fccddf3c
- SSDEEP 3072:DSYWkSyr1ky7nrL1MXd/SQYSEXeHlxSACkuOtnPz7ezI8fwFB9w:lp1m6QYSEKl4DVCPWaB6
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  IETab.exe
- Size 130KB
- SHA256 4f51a3b11160c32f6b5bf66a544ba5a14b4bf9fd351e5d9086c8e5ea0af4fc07
- MD5 437506ca5d08c4393c9ee25d5ea752ff
- SHA1 01d0b29b052df9d566d080aa5268c5a5007fd5b6
- SHA512 abc73f91e783d7b8d211a15d214edf2d355ed9a78b922ac7a8080650ef0dded2aef9d45fec5d5809a3c862c4abb716da0a169e14522fb7d7a9302e2ee8de6ee6
- SSDEEP 1536:gjHgYTWp2qcCx3KOHEDZN/9JxfHXocRAbiLanaIfMrMnnPz7PtkgfT:gjHgV3KvDZN/9JNYcbLaaIfXnPz7PtpT
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware discovery persistence stealer
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral13 behavioral14
- Target
  IETabHelper.dll
- Size 34KB
- SHA256 85e71d08ae666df9753bbbeac5c8169f4adeab1b479c4658e26c57356273ad71
- MD5 55f625b8a0dd87e25542a86195a5355d
- SHA1 37c0ba73be9cf1c59c55dc3cac697125ad2f8e44
- SHA512 f62a3605ffd10de88f535d0d3c5982cf97562cb51b80d150ff95ecc4ea68dca9e58c95c66c0f05393a23a5789611d288c3f167bdfa39ecbbd93b84bf96e0c577
- SSDEEP 192:1w0uTGPOLOGx2xitAM8UdrXX335/wJirNmL/l0F8uENyxyZb8rou7+wLaxq:ETPLOGQ0x5drH3mirILuD0yguEQ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

Adds Run key to start application

Installs/modifies Browser Helper Object

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16