Overview

overview

7

Static

static

7

eaab7858ee...18.exe

windows7-x64

7

eaab7858ee...18.exe

windows10-2004-x64

7

$PLUGINSDI...if.dll

windows7-x64

3

$PLUGINSDI...if.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...tc.dll

windows7-x64

3

$PLUGINSDI...tc.dll

windows10-2004-x64

3

$PLUGINSDI...eb.dll

windows7-x64

3

$PLUGINSDI...eb.dll

windows10-2004-x64

3

$PLUGINSDI...rs.dll

windows7-x64

3

$PLUGINSDI...rs.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows7-x64

7

$PLUGINSDI...ay.dll

windows10-2004-x64

7

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

7

$PLUGINSDI...on.dll

windows10-2004-x64

7

$TEMP/free...xt.rtf

windows7-x64

4

$TEMP/free...xt.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240919-f5x8gssgre

  • MD5

    eaab7858ee68fef371d269c5f29ac42e

  • SHA1

    375d1116acd741fa35c3491da1191fb4c053dd30

  • SHA256

    067a096b7dbb8efc36d920c001f9fc332f468d439b071fe6fb6a464879776b94

  • SHA512

    bb3bf338e68ba53b9b58c5983987f39f160c887d992ed29d0cfb61c35aa0b5490a8b8cf9629f2e16306592456f4dac676c99898991d61e5f2dd61d872376298c

  • SSDEEP

    49152:KpqyOqAiCA4KQ7iIe3XHBQ440lLq7Gid4TG3U:Kpqy5v4KeEXHG4476I4

Score
7/10
discoveryupx

Malware Config

Targets

    • Target

      eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118

    • Size

      1.8MB

    • MD5

      eaab7858ee68fef371d269c5f29ac42e

    • SHA1

      375d1116acd741fa35c3491da1191fb4c053dd30

    • SHA256

      067a096b7dbb8efc36d920c001f9fc332f468d439b071fe6fb6a464879776b94

    • SHA512

      bb3bf338e68ba53b9b58c5983987f39f160c887d992ed29d0cfb61c35aa0b5490a8b8cf9629f2e16306592456f4dac676c99898991d61e5f2dd61d872376298c

    • SSDEEP

      49152:KpqyOqAiCA4KQ7iIe3XHBQ440lLq7Gid4TG3U:Kpqy5v4KeEXHG4476I4

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/AnimGif.dll

    • Size

      9KB

    • MD5

      200b6570553d00a76de8a5a6c9587f07

    • SHA1

      08ca76a84cba8483ab34285d07909e08bdbf4a67

    • SHA256

      8fb060b77728fbe347e294d1174a732db7cf9c99b187f8f332662c87683fd0a3

    • SHA512

      01ab8aa80d7d5d3083f2e3016aab5dad29c0bbba18b225a5dde51b3bc6fa4c8c1278aec17d76bc5ee2b9ccb8532c22d79845162f752bba6ee12341b4d64304e8

    • SSDEEP

      192:gOHvLYKKad68vn0YQRbqLGWSMRH00yQTbxDdHw:bvLXKa0OqRqS1MRH00HJdH

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/BgWorker.dll

    • Size

      2KB

    • MD5

      33ec04738007e665059cf40bc0f0c22b

    • SHA1

      4196759a922e333d9b17bda5369f14c33cd5e3bc

    • SHA256

      50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be

    • SHA512

      2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/ButtonEvent.dll

    • Size

      4KB

    • MD5

      55788069d3fa4e1daf80f3339fa86fe2

    • SHA1

      d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96

    • SHA256

      d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f

    • SHA512

      d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616

    • SSDEEP

      96:hrA2+5HGZFYJf9D8IjDflDCoMzncsGSmE:hE2+5mMJfJ8v1zFGSm

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/ExecDos.dll

    • Size

      5KB

    • MD5

      ebcf9f71d804abab3c2e5ce4c17dc22e

    • SHA1

      17d13084e75cbfa5fbfdd0025e9a0ee5772ae765

    • SHA256

      d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993

    • SHA512

      5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1

    • SSDEEP

      48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/IpConfig.dll

    • Size

      114KB

    • MD5

      a3ed6f7ea493b9644125d494fbf9a1e6

    • SHA1

      ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8

    • SHA256

      ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08

    • SHA512

      7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1

    • SSDEEP

      1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/ThreadTimer.dll

    • Size

      3KB

    • MD5

      c43953f463c22e048e45b402d190e77d

    • SHA1

      b4a5e6567bed3c783af030df9418f91a7bac3040

    • SHA256

      4e2a7c511e0f2ef46ac9002e0666f058ea5a4657371f086e2e4797393ee2fbf2

    • SHA512

      18facd89f3dc55826b7aa0c02b8fdf3a1e6741850e4d9c264fb095e9da7956f6a4d331655ef00862948397d1a3f99d15243d03ef09c145a39c3b9a0c2ef4c974

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/TkInetc.dll

    • Size

      172KB

    • MD5

      8777f46e35ab035d4b526377d9a7097b

    • SHA1

      9780ff9145be4aa7a912e6dbaaf7d781316b9adb

    • SHA256

      d5bb2ebaac75a1588f00cea3d35faea0e5a3c7c319785406315cda2d4a52bb47

    • SHA512

      131d6d9de492d55dc55df396a5153119bcb1c09c723abf009d8a7ef3cc71244b51f7ac1715bf7bc23c9b94ac661c255cd7a30e97267295ce060487705395128c

    • SSDEEP

      3072:bhW2YXDpNYCy32SHyE1k7skVSiIJz6Kp+CYF:bhW2YTIJzk7skVXIg

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/TkNsweb.dll

    • Size

      59KB

    • MD5

      c6731fd774db4835a5763afd404a50eb

    • SHA1

      c6b20b36631b513ca8647d952b95469b77d2ac24

    • SHA256

      23861a8828cedc363baa54760766c01fdd9e1414073ca1148ff9a19ca818b13a

    • SHA512

      c3eca3f693f4ff6b078e0708c70156f2184708f0e07d40f3cd54dd24556ae6e010a89b9bfb777f4131f0d0ee0f87d79015e7eb8f0b2606fa156d846dd581e197

    • SSDEEP

      768:LGGFsrrp6e7co2DLJUcUw9nf/bsJVtCcdWANKDrYsWjcdvCQFEzLr+M4dk:LGdNRIrLJUBwZUvCcdgYsWjcdqQdvk

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/ToolkitOffers.dll

    • Size

      289KB

    • MD5

      21ace3cf64828557817cb17f55e4dfd1

    • SHA1

      46574d7a5483db8476bd607340cc441a326dcf14

    • SHA256

      2d1becb94d82d890662ffd0cd99b6004e31a4633bba8e950f79610907761e7ab

    • SHA512

      1f8b8c077ac814c4570794b7e324fd2125a187934d4ce59886e2940141e93aff020cf3cfdeb9dbc5f0a62d76f502af6018f05659d285a87a3dfddb1b77a37ef2

    • SSDEEP

      6144:avsHwgvnAgF7y8nfbf/50CGZ3cPmo9UH:msHwj8fr2CGZ3WUH

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      e541458cfe66ef95ffbea40eaaa07289

    • SHA1

      caec1233f841ee72004231a3027b13cdeb13274c

    • SHA256

      3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

    • SHA512

      0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

    • SSDEEP

      384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      $PLUGINSDIR/nsArray.dll

    • Size

      6KB

    • MD5

      f8462e9d1d7fd39789afca89ab6d6046

    • SHA1

      7e9a518e15b7490245d2bef11a73f209c8d8d59b

    • SHA256

      48941e9f5c92a33f1e60a7a844d562dd77ce736fd31b5503c980b49679dfe85e

    • SHA512

      57dee2253abd7d17d53811d5e95237f9434288518fb043645524a517786db2d8a91df86a6da732c620f12ad0e7ea30a923b8d5f3de386c65bd3ff240bc0dff69

    • SSDEEP

      96:TjGBPJ762z6gjutipI+h7jz5ozZt/aYfA7EfXxLfAZi:/ix7ibUpIS+Xa1wX2Zi

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      $PLUGINSDIR/version.dll

    • Size

      6KB

    • MD5

      ebc5bb904cdac1c67ada3fa733229966

    • SHA1

      3c6abfa0ddef7f3289f38326077a5041389b15d2

    • SHA256

      3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

    • SHA512

      fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

    • SSDEEP

      96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral29behavioral30

    • Target

      $TEMP/freetwittube_text.rtf

    • Size

      6KB

    • MD5

      5f6c3d13e32a61bcba20c2a9284a27e3

    • SHA1

      75a4ec8495bf15ec97abbac093716a0805032c55

    • SHA256

      83a61a0ca3ff4ea9e126a7c6147c68480fdadce954282f740958eecd3e438076

    • SHA512

      afeebd16be0a0f1c385e6fce9a000e35a58478c2a90a3d9f41bfaab29eedc2d566240e39eaa502a5f078e64c77914e756335d08cb0d76851ab793049753ca59c

    • SSDEEP

      96:V10PoYACgYWVDjcqpFAPT95mpgoG7e9x4AEuA8+GAE38SDA7GA7GAEKTgA7GAEbi:ImzFA953jiEeFHPDjjljEGj8

    Score
    4/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

discoveryupx
Score
7/10

behavioral2

discoveryupx
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discoveryupx
Score
7/10

behavioral26

discoveryupx
Score
7/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discoveryupx
Score
7/10

behavioral30

discoveryupx
Score
7/10

behavioral31

discovery
Score
4/10

behavioral32

Score
1/10