Overview

overview

9

Static

static

9

f65e79bb74...18.exe

windows7-x64

7

f65e79bb74...18.exe

windows10-2004-x64

7

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

5

$PLUGINSDI...om.dll

windows10-2004-x64

5

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$TEMP/v.vbs

windows7-x64

3

$TEMP/v.vbs

windows10-2004-x64

3

$TEMP/xcmd.exe

windows7-x64

9

$TEMP/xcmd.exe

windows10-2004-x64

9

$_48_/$APP...md.exe

windows7-x64

9

$_48_/$APP...md.exe

windows10-2004-x64

9

$_48_/1.html

windows7-x64

3

$_48_/1.html

windows10-2004-x64

3

$_48_/3.bat

windows7-x64

1

$_48_/3.bat

windows10-2004-x64

1

$_48_/3.vbs

windows7-x64

4

$_48_/3.vbs

windows10-2004-x64

7

$_48_/qq.vbs

windows7-x64

3

$_48_/qq.vbs

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f65e79bb74f99ef872a313579bf2d3db_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240925-tjy5jsxeqb

  • MD5

    f65e79bb74f99ef872a313579bf2d3db

  • SHA1

    19c5c34c5c8bcddbae089d8165c28a930cd1d537

  • SHA256

    2992e88b75e33aa2ec54ad512b856c902f9daca80dbbd6e3f376b95a73f08003

  • SHA512

    33ff83c08a0251017415287f83e308e50111804214c7d1b8e1727e404964585eef289e0e65ee8c18a32fe6149e822f77a0815f1b399558ee36a95d1c73deddfb

  • SSDEEP

    24576:c8DXCusyy4gmc6zDkRFMoUIEzU/TtgNT74l0lhYw:RUyTgj6vQMoOo/Tti74OQw

Score
9/10
discoveryupx

Malware Config

Targets

    • Target

      f65e79bb74f99ef872a313579bf2d3db_JaffaCakes118

    • Size

      1.0MB

    • MD5

      f65e79bb74f99ef872a313579bf2d3db

    • SHA1

      19c5c34c5c8bcddbae089d8165c28a930cd1d537

    • SHA256

      2992e88b75e33aa2ec54ad512b856c902f9daca80dbbd6e3f376b95a73f08003

    • SHA512

      33ff83c08a0251017415287f83e308e50111804214c7d1b8e1727e404964585eef289e0e65ee8c18a32fe6149e822f77a0815f1b399558ee36a95d1c73deddfb

    • SSDEEP

      24576:c8DXCusyy4gmc6zDkRFMoUIEzU/TtgNT74l0lhYw:RUyTgj6vQMoOo/Tti74OQw

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/MakeDll.dll

    • Size

      392KB

    • MD5

      eb907eaaf1d86c90112783c8a189882a

    • SHA1

      04ca0180f47096b3ef711914cf93ca6ec2b6c390

    • SHA256

      42e21a9f51079d8a8c211b20ffbb31e86ed1e68f306cf72442a5b46c49ffff1a

    • SHA512

      0e5327d7447ce77ab2001d1bd2bdd634da5adf1160064d77747381e3912e0b9716134edf847fdb0fd32847a5ec8efa4edd6bddbb568b7e849c99e4cbde9817ac

    • SSDEEP

      6144:LET26hNKPuz98w6DkrSbu0ia7TOscYT0DEw0isbDfg7dNpJ7yOSc3gvlb/wl:l+NKPs6oubumRqoisw7P7yOF3yb+

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      33d4a515252e42901fcd3230a749e92f

    • SHA1

      168ccf18807f372d59c954425b23e3ba07b9e32f

    • SHA256

      83817610e28c78c766a183e66d9fa47f1831b702846cae2ec51ba5848c9dbde1

    • SHA512

      fcd40f466403d3243d8a8d2e98aae74f46d5b5e9e254d13485281e86022305a3e8d47c6411175a9f2f90ad8d10aa40614c71329969ef895a20d60688a649adba

    • SSDEEP

      192:HPv+wTtD0MzoU7Fs0+/gcDmduwJQXzw+KtnvH0tKO/B75D/Vp6kn2HgsDw0:HPFT90MzRF4/Bj0v0tP9gk2ZDw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      72f18eaa88886bd0d46de64a17d9720c

    • SHA1

      e604c84de0ded023cf4c5e215c0534faf1d18227

    • SHA256

      05f699d932f1fea8e6f1a711c3bc8ba51463b924b78a68bfd0683295de008da1

    • SHA512

      5a80e303f1418dde67ffe0b9b60d574b85634de0d2b557a6691229812e9b376fb34ba7e276efd0e20f35baec91f1030b738e2138d7b7ee146715fcab5cd7e018

    • SSDEEP

      96:VgJbo7bG2VHk3C45rJixqE+6nSvMn0iGLG8wq/aAtJ1t2RhU1fU:qJk7ZHgRJRHvcwBwqP/t6wf

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c6284e23cd7e4d11db8298deb4541083

    • SHA1

      e338686c7579620383ab8cc5a51bbb8d846f60cf

    • SHA256

      79914940cbbf70a385f13a9970a9d577d7a7e07d240fe44563b45a472cd4bc3f

    • SHA512

      72103e470d770fb402a18e975ff339526a3e4c9aeb8fac1b0977995a6eace0eca965b1915404df9b5a25b59628db1b199d2b9b10372841309c137054356a5cd7

    • SSDEEP

      96:q0HzOxnC1hncrcpRciM8wcxMkDOW6LbUXv8X2PXv5bcndYosRn:qJxw3pmiMRxNE/8c5bcdo

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      40909a97db3a51fc83aaeff503128b3f

    • SHA1

      9693d68a1fb11db70f61b8277e1195dd298abbab

    • SHA256

      f2633b3604a80a7b1be67858fb43288fd7b686730bad158f347dfa38c6df59d9

    • SHA512

      cd1425e28302dfeced644fa155a09549aae25b96f5f6a7688624135a69be7abee8e6eaac89194dc6ec89281c45e00451fae43db5953360ee9a47dc0d11d07c77

    • SSDEEP

      96:+Vyk3+0P+gcVUzWKw1lq4xNmuUUOnyX3z9zJ5cVK23EHC:+40P+gcVUzWlyuUStJ5cVKXHC

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/nsRandom.dll

    • Size

      21KB

    • MD5

      ab467b8dfaa660a0f0e5b26e28af5735

    • SHA1

      596abd2c31eaff3479edf2069db1c155b59ce74d

    • SHA256

      db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

    • SHA512

      7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

    • SSDEEP

      384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z

    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/registry.dll

    • Size

      16KB

    • MD5

      351f89337642c165a48dd763aa210023

    • SHA1

      a5b204cbc51a0ad84248aa680b85be7824f3354e

    • SHA256

      b610ab13da00e05b000026c73081cfdf0d2ebd3f2fad05e1d0f277060fc3c07f

    • SHA512

      10326b95ea81b377f74cb9e42135e891930a354b65ce50a4562246da33ca6816f5397089bb60cd1eb647bd28829d70f6425c3113440e11f9a9a4f7fecaac7f4c

    • SSDEEP

      384:tTVUUuJHxgeh2OTU+X9pCtlohiTV0pWY7:tTqzHxgeh5X9oaiTgW

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $TEMP/v.txt

    • Size

      3KB

    • MD5

      2e8beba4ac7733991bd5caea62dc786c

    • SHA1

      1f420320dea88c5c165dc3bc084d33a6e1be67db

    • SHA256

      4001e1479fcc9e919d3abdafbf54371ab03028a51e27990beafd317dd56d1e12

    • SHA512

      30e00c9f2c8e423ca3529b947d63b75bc43eaf9cced31a891b731d9f9cda931518c532f68a3ceec0e786ee0c99e8fc9e74124e3f124877ee4425294056ab2db4

    Score
    3/10
    behavioral19behavioral20

    • Target

      $TEMP/xcmd.exe

    • Size

      32KB

    • MD5

      378e0103156f2e6844c83087d80a7156

    • SHA1

      c3e577e294ee81cd763625b4f6657795c4a8a6c4

    • SHA256

      82fbc8842aceeb471967d2e78b7336c972e3d1379fcd23662df022af958f40c1

    • SHA512

      0d9e162042f0894aeefb4d43a2c98161686b4451605cbaddcf12f367b17ed1a3796370e770dfbbe6b2ce7ddfba7dc42747ce564b8f80c292b331a600910103bb

    • SSDEEP

      768:vGw9ERxPw5DAKshWRjzrjBav9+IZ5deSbA:vGQc4TsYznBA9LISbA

    Score
    9/10
    discoveryupx

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral21behavioral22

    • Target

      $_48_/$APPDATA/xcmd.exe

    • Size

      32KB

    • MD5

      378e0103156f2e6844c83087d80a7156

    • SHA1

      c3e577e294ee81cd763625b4f6657795c4a8a6c4

    • SHA256

      82fbc8842aceeb471967d2e78b7336c972e3d1379fcd23662df022af958f40c1

    • SHA512

      0d9e162042f0894aeefb4d43a2c98161686b4451605cbaddcf12f367b17ed1a3796370e770dfbbe6b2ce7ddfba7dc42747ce564b8f80c292b331a600910103bb

    • SSDEEP

      768:vGw9ERxPw5DAKshWRjzrjBav9+IZ5deSbA:vGQc4TsYznBA9LISbA

    Score
    9/10
    discoveryupx

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral23behavioral24

    • Target

      $_48_/1.html

    • Size

      321B

    • MD5

      af99876e3a3ff3a6a5336d7acca9b828

    • SHA1

      72874e2bd626622710eb89adf6f580a89c08ccaf

    • SHA256

      352a8f94a36d8fdcf8005eceedd4cfb6c7f0de791a747fbaa14dff802dff17cd

    • SHA512

      418799b21553ca94d606cdb05b9d0e437a4ba039f914fad7734f0492540a2af96329e08aded56d0e2ed54a4c71efccee441183ccd1786183e1a03f831b475b6a

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      $_48_/3.bat

    • Size

      2KB

    • MD5

      44050433f3e51479ce70c7145ca02e37

    • SHA1

      418a7f27408c1e49304062965c6b8def0f8b4574

    • SHA256

      5f9d1969e5dc5d31ef85e026eec651f2cd47d8e505f07dbaeb21c8f0bd8828e5

    • SHA512

      96b1b508185d28385f5b74cc3e992014de7a157cde0c12ec4a6b3c7e3d51ade1035bcfa8c891bf81630728ba795b3873563e4379db1b568b89b320f6d3243367

    Score
    1/10
    behavioral27behavioral28

    • Target

      $_48_/3.vbs

    • Size

      2KB

    • MD5

      b4eccc20dfcca0c00d93830d76973361

    • SHA1

      21d4f2968c988bfc770e0940df5bb55ab5d17705

    • SHA256

      b0a86922d04f36b8318711f340fcb6cbdfe5e380fb73c45b7cf2b15c3139780b

    • SHA512

      534d9f71a165f9a52d2cb593f1e20d9c44758b394c3d3a96437850f5b8db228324bc92d400fbbc3cb85c9d2f17e17c3a9ab734eadcd9dcc1c3229c5e0014d535

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral29behavioral30

    • Target

      $_48_/qq

    • Size

      970B

    • MD5

      0673e7a45f4bdc9049e06bb53632a80e

    • SHA1

      d810656800a1984dd70f2a3a05d1fefdd715e260

    • SHA256

      9e3c211ae37ec943ff467437c4ccbf431cd1d2989b8da216346d5634d5b3373d

    • SHA512

      642b4c38583b28556e519673baec6a7546ef4e74ff2a922f72b034c388aaa34b19cd20baeb4a93a94705463961e6aeea665fe6e8e6db2c0775dcaef8c0fbd0e1

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
9/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discoveryupx
Score
5/10

behavioral16

discoveryupx
Score
5/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

discoveryupx
Score
9/10

behavioral22

discoveryupx
Score
9/10

behavioral23

discoveryupx
Score
9/10

behavioral24

discoveryupx
Score
9/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
4/10

behavioral30

Score
7/10

behavioral31

Score
3/10

behavioral32

Score
7/10