Overview

overview

7

Static

static

3

10369adfe0...18.exe

windows7-x64

7

10369adfe0...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/$_1_.exe

windows7-x64

7

$SYSDIR/$_1_.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$_5_.dll

windows7-x64

6

$_5_.dll

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10369adfe07523f7ee3aa3c34d1c8276_JaffaCakes118

  • Size

    450KB

  • Sample

    241003-xy2qrswamd

  • MD5

    10369adfe07523f7ee3aa3c34d1c8276

  • SHA1

    e2200f372142ecf47204da0586dbc3f73b42e798

  • SHA256

    01902c9f0201c3a74b7400324558cf9580057e202c73c097a240bdb90998c7a2

  • SHA512

    473c19e6054c00e252495bb28ed16461b9e8f0783f8e91047e95568d8d0a32b2ed9d1d9e4d0c428b42106a927574941ade4e3c7b7ceae1909d750bda0bd44efc

  • SSDEEP

    12288:Df8rwIe0OLG0EnFa/2PNAV5Qg8sbeyS9uo4z:DErwIeLp6Fx1AYgtqF9W

Score
7/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      10369adfe07523f7ee3aa3c34d1c8276_JaffaCakes118

    • Size

      450KB

    • MD5

      10369adfe07523f7ee3aa3c34d1c8276

    • SHA1

      e2200f372142ecf47204da0586dbc3f73b42e798

    • SHA256

      01902c9f0201c3a74b7400324558cf9580057e202c73c097a240bdb90998c7a2

    • SHA512

      473c19e6054c00e252495bb28ed16461b9e8f0783f8e91047e95568d8d0a32b2ed9d1d9e4d0c428b42106a927574941ade4e3c7b7ceae1909d750bda0bd44efc

    • SSDEEP

      12288:Df8rwIe0OLG0EnFa/2PNAV5Qg8sbeyS9uo4z:DErwIeLp6Fx1AYgtqF9W

    Score
    7/10
    adwarediscoverypersistencestealer

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $SYSDIR/$_1_.exe

    • Size

      49KB

    • MD5

      8b81f3c495662f93b54688be1e8b9040

    • SHA1

      a6bd1b5a430fa821d36ebe04a1a0358d4a598cf1

    • SHA256

      3c1d16bc1dcff51f594de3d2724048cda05182a8d0ac176dcabeaf378df3c520

    • SHA512

      ae61ab02501285e0c6f136d7f5bef2cfd0c2dc48f0fc9274482943b1df8919c41fe65ff768a30aa32cae1ef65739cb86311010ce9cb9f29c01f1b969ef660b93

    • SSDEEP

      768:uHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJWJRn25c7XF3pm0Efh:upgpHzb9dZVX9fHMvG0D3XJn5cjVSf2A

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5behavioral6

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $_5_

    • Size

      736KB

    • MD5

      ce7f66ea290d710a5971e9d56ca774cc

    • SHA1

      89fd53cddeadeef8434baf815378313d0a626969

    • SHA256

      d53b7c1fdd8fab8aec1556692ba0cb41b4812d0f5fc6d45b4028d487c3b4a3aa

    • SHA512

      5cfb58981ede4ce97c2f353a4bb55900b01ad84ce26b470f98719e3141a98b486bc6a03e6cc86ac32f98c232bf8263e23840f455835b5242167a6c9d1aece9dc

    • SSDEEP

      12288:L/dYsPEG5wChJOaIm11fp0Z6bJJ+yTX4aa5t5Y7/fBDbgrqmt6l0/Z9zRZzRf+Up:pYP9ChAa311x46bJVbJut+lDcrl7ZbZr

    Score
    6/10
    adwarediscoverypersistencestealer

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks