Overview

overview

9

Static

static

9

d213c111b8...18.exe

windows7-x64

7

d213c111b8...18.exe

windows10-2004-x64

7

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$TEMP/v.vbs

windows7-x64

3

$TEMP/v.vbs

windows10-2004-x64

3

$TEMP/xcmd.exe

windows7-x64

9

$TEMP/xcmd.exe

windows10-2004-x64

9

$_48_/$APP...md.exe

windows7-x64

9

$_48_/$APP...md.exe

windows10-2004-x64

9

$_48_/1.html

windows7-x64

3

$_48_/1.html

windows10-2004-x64

3

$_48_/3.bat

windows7-x64

1

$_48_/3.bat

windows10-2004-x64

1

$_48_/3.vbs

windows7-x64

4

$_48_/3.vbs

windows10-2004-x64

7

$_48_/qq.vbs

windows7-x64

3

$_48_/qq.vbs

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d213c111b804b50b5d595556e6383cb5_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240907-q43fxsxckm

  • MD5

    d213c111b804b50b5d595556e6383cb5

  • SHA1

    7948dc6b89d621c38b6fd1393053eda491323239

  • SHA256

    343425a3ef1936e503f5ad9ff367d0a42663363f6e8683572d1a76e72c69cb29

  • SHA512

    ab113055bfe2e0134f09f26568865839007805e6bbb58268fb9320ce26c27de6fa2e70f8ff2c82063abf4bd9b8f32e2b6adada5299c81676e0a33f03e1e7e4fb

  • SSDEEP

    24576:6Ab0Y0OpBW2khb+3fZnc59/0/vmOfwMtYamaw1:6Ab0YPW2khbWNSM/vhf7tnzM

Score
9/10
discoveryupx

Malware Config

Targets

    • Target

      d213c111b804b50b5d595556e6383cb5_JaffaCakes118

    • Size

      1.0MB

    • MD5

      d213c111b804b50b5d595556e6383cb5

    • SHA1

      7948dc6b89d621c38b6fd1393053eda491323239

    • SHA256

      343425a3ef1936e503f5ad9ff367d0a42663363f6e8683572d1a76e72c69cb29

    • SHA512

      ab113055bfe2e0134f09f26568865839007805e6bbb58268fb9320ce26c27de6fa2e70f8ff2c82063abf4bd9b8f32e2b6adada5299c81676e0a33f03e1e7e4fb

    • SSDEEP

      24576:6Ab0Y0OpBW2khb+3fZnc59/0/vmOfwMtYamaw1:6Ab0YPW2khbWNSM/vhf7tnzM

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/MakeDll.dll

    • Size

      392KB

    • MD5

      eb907eaaf1d86c90112783c8a189882a

    • SHA1

      04ca0180f47096b3ef711914cf93ca6ec2b6c390

    • SHA256

      42e21a9f51079d8a8c211b20ffbb31e86ed1e68f306cf72442a5b46c49ffff1a

    • SHA512

      0e5327d7447ce77ab2001d1bd2bdd634da5adf1160064d77747381e3912e0b9716134edf847fdb0fd32847a5ec8efa4edd6bddbb568b7e849c99e4cbde9817ac

    • SSDEEP

      6144:LET26hNKPuz98w6DkrSbu0ia7TOscYT0DEw0isbDfg7dNpJ7yOSc3gvlb/wl:l+NKPs6oubumRqoisw7P7yOF3yb+

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      33d4a515252e42901fcd3230a749e92f

    • SHA1

      168ccf18807f372d59c954425b23e3ba07b9e32f

    • SHA256

      83817610e28c78c766a183e66d9fa47f1831b702846cae2ec51ba5848c9dbde1

    • SHA512

      fcd40f466403d3243d8a8d2e98aae74f46d5b5e9e254d13485281e86022305a3e8d47c6411175a9f2f90ad8d10aa40614c71329969ef895a20d60688a649adba

    • SSDEEP

      192:HPv+wTtD0MzoU7Fs0+/gcDmduwJQXzw+KtnvH0tKO/B75D/Vp6kn2HgsDw0:HPFT90MzRF4/Bj0v0tP9gk2ZDw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      72f18eaa88886bd0d46de64a17d9720c

    • SHA1

      e604c84de0ded023cf4c5e215c0534faf1d18227

    • SHA256

      05f699d932f1fea8e6f1a711c3bc8ba51463b924b78a68bfd0683295de008da1

    • SHA512

      5a80e303f1418dde67ffe0b9b60d574b85634de0d2b557a6691229812e9b376fb34ba7e276efd0e20f35baec91f1030b738e2138d7b7ee146715fcab5cd7e018

    • SSDEEP

      96:VgJbo7bG2VHk3C45rJixqE+6nSvMn0iGLG8wq/aAtJ1t2RhU1fU:qJk7ZHgRJRHvcwBwqP/t6wf

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c6284e23cd7e4d11db8298deb4541083

    • SHA1

      e338686c7579620383ab8cc5a51bbb8d846f60cf

    • SHA256

      79914940cbbf70a385f13a9970a9d577d7a7e07d240fe44563b45a472cd4bc3f

    • SHA512

      72103e470d770fb402a18e975ff339526a3e4c9aeb8fac1b0977995a6eace0eca965b1915404df9b5a25b59628db1b199d2b9b10372841309c137054356a5cd7

    • SSDEEP

      96:q0HzOxnC1hncrcpRciM8wcxMkDOW6LbUXv8X2PXv5bcndYosRn:qJxw3pmiMRxNE/8c5bcdo

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      40909a97db3a51fc83aaeff503128b3f

    • SHA1

      9693d68a1fb11db70f61b8277e1195dd298abbab

    • SHA256

      f2633b3604a80a7b1be67858fb43288fd7b686730bad158f347dfa38c6df59d9

    • SHA512

      cd1425e28302dfeced644fa155a09549aae25b96f5f6a7688624135a69be7abee8e6eaac89194dc6ec89281c45e00451fae43db5953360ee9a47dc0d11d07c77

    • SSDEEP

      96:+Vyk3+0P+gcVUzWKw1lq4xNmuUUOnyX3z9zJ5cVK23EHC:+40P+gcVUzWlyuUStJ5cVKXHC

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/nsRandom.dll

    • Size

      21KB

    • MD5

      ab467b8dfaa660a0f0e5b26e28af5735

    • SHA1

      596abd2c31eaff3479edf2069db1c155b59ce74d

    • SHA256

      db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

    • SHA512

      7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

    • SSDEEP

      384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/registry.dll

    • Size

      16KB

    • MD5

      351f89337642c165a48dd763aa210023

    • SHA1

      a5b204cbc51a0ad84248aa680b85be7824f3354e

    • SHA256

      b610ab13da00e05b000026c73081cfdf0d2ebd3f2fad05e1d0f277060fc3c07f

    • SHA512

      10326b95ea81b377f74cb9e42135e891930a354b65ce50a4562246da33ca6816f5397089bb60cd1eb647bd28829d70f6425c3113440e11f9a9a4f7fecaac7f4c

    • SSDEEP

      384:tTVUUuJHxgeh2OTU+X9pCtlohiTV0pWY7:tTqzHxgeh5X9oaiTgW

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $TEMP/v.txt

    • Size

      3KB

    • MD5

      441a4b033e97470276b0dc7ca0476f6e

    • SHA1

      ef1c6f285ab092be338d1b5de4e6b5693604ef0b

    • SHA256

      880f68256ac79457e50025dbd4a1f578468899c2db31be40d724ed0bb59ef727

    • SHA512

      20a0d8a439bef94e54e18cc94f63186def069d4b02a79edfeaf6a525f876a5419875e684bd8d9c35b684ec02a49cd8403f7ba6bc6a2e09eb4a1660c444c7019e

    Score
    3/10
    behavioral19behavioral20

    • Target

      $TEMP/xcmd.exe

    • Size

      32KB

    • MD5

      378e0103156f2e6844c83087d80a7156

    • SHA1

      c3e577e294ee81cd763625b4f6657795c4a8a6c4

    • SHA256

      82fbc8842aceeb471967d2e78b7336c972e3d1379fcd23662df022af958f40c1

    • SHA512

      0d9e162042f0894aeefb4d43a2c98161686b4451605cbaddcf12f367b17ed1a3796370e770dfbbe6b2ce7ddfba7dc42747ce564b8f80c292b331a600910103bb

    • SSDEEP

      768:vGw9ERxPw5DAKshWRjzrjBav9+IZ5deSbA:vGQc4TsYznBA9LISbA

    Score
    9/10
    discoveryupx

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral21behavioral22

    • Target

      $_48_/$APPDATA/xcmd.exe

    • Size

      32KB

    • MD5

      378e0103156f2e6844c83087d80a7156

    • SHA1

      c3e577e294ee81cd763625b4f6657795c4a8a6c4

    • SHA256

      82fbc8842aceeb471967d2e78b7336c972e3d1379fcd23662df022af958f40c1

    • SHA512

      0d9e162042f0894aeefb4d43a2c98161686b4451605cbaddcf12f367b17ed1a3796370e770dfbbe6b2ce7ddfba7dc42747ce564b8f80c292b331a600910103bb

    • SSDEEP

      768:vGw9ERxPw5DAKshWRjzrjBav9+IZ5deSbA:vGQc4TsYznBA9LISbA

    Score
    9/10
    discoveryupx

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral23behavioral24

    • Target

      $_48_/1.html

    • Size

      321B

    • MD5

      4981db0e61460d215e67ea30b2ccb115

    • SHA1

      9adcce6d71e190518363785a461f4874b1cdad22

    • SHA256

      b42ad407dd50b045ff838c26c593e04c275e2cad50b194f887c2fef6b2201e5f

    • SHA512

      650b47a1c93d34f2c66d174317da67c813f537c593ad37e84a410a5f21812f1a9ebf85c686180c9782c9db213175b336d130a504a3a212e28b21eb2ba4fe3820

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      $_48_/3.bat

    • Size

      2KB

    • MD5

      3d356f7ae18cacb2ed04d55ac1d5b5b7

    • SHA1

      deb8f6c7750d3a6f2266daef8350e15b7c6ac369

    • SHA256

      4d44afeb58408a1876fdfda3537bf5d1cc12921bedcadfee8cdc147f706995e4

    • SHA512

      07cb7f07ed80ba17b30e4e7e6709a5b8da3d3ab0fa911ade56c42ecdd4e8afbba924f4b41bb8c26734fb5ba14628cd47de964081d17e57fdf6861f38f0aef319

    Score
    1/10
    behavioral27behavioral28

    • Target

      $_48_/3.vbs

    • Size

      2KB

    • MD5

      51092ec91a13a60648bbbd04705ebfe8

    • SHA1

      20c569c33b3c50c52b72c116118e1dfe2d68b5a0

    • SHA256

      145d1b2b5cf4d15382e505a8077e745a09a6a109aaf660122a3642b7cb75e07c

    • SHA512

      a8ff0a7bb0db5966cbf7e81eca4e46936080670708476b7dbec28cdbf81ef4c77e1de235aa19cee8446fe5bba7bbd458b619e8030eeeb7ee915cdffc5b64c7e6

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral29behavioral30

    • Target

      $_48_/qq

    • Size

      970B

    • MD5

      4e6e43ad10ef6a77d9b01eec44a661ae

    • SHA1

      b510f3c86fe70bb7ab0751102e7f0720e8d9ca27

    • SHA256

      e8d3bdbb274c77337943799adbb05bbdac8e686ebc6e20bb8a343e92a68af497

    • SHA512

      51f7b8d106fe1de87f9e8f826eda05cb353c375ae6e82d82ec6d4c19df946e0183ce2cd6776067c1923d6cdd8001b90582f40f1ff293988c34d4a3025a2fb80a

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
9/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discoveryupx
Score
7/10

behavioral16

discoveryupx
Score
7/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

discoveryupx
Score
9/10

behavioral22

discoveryupx
Score
9/10

behavioral23

discoveryupx
Score
9/10

behavioral24

discoveryupx
Score
9/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
4/10

behavioral30

Score
7/10

behavioral31

Score
3/10

behavioral32

Score
7/10