Overview

overview

7

Static

static

5

27ea14a5e3...18.exe

windows7-x64

7

27ea14a5e3...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

3

$PLUGINSDI...te.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

Help.chm

windows7-x64

1

Help.chm

windows10-2004-x64

1

Wnl.exe

windows7-x64

6

Wnl.exe

windows10-2004-x64

6

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27ea14a5e35a028f09005d6623b4c181_JaffaCakes118

  • Size

    1.7MB

  • Sample

    241009-a29jfsyfne

  • MD5

    27ea14a5e35a028f09005d6623b4c181

  • SHA1

    103bc623f846fbd26e0ab1eb10c44c7ff5aded71

  • SHA256

    18587958139fea44f5393c1739ab065ef899663aec64e305a9edcf3a1abc4db7

  • SHA512

    ad9a8893dc423729030a04329c0da2f246f800078884a161fcce80a214caad190034f62ceee82f1cff2c9892aee9cd73bc4ca439c005c719a3f0d4f9b0ede037

  • SSDEEP

    49152:dM+TCe7AWlCiJia6Xhw+WqbTgwF8YFUIFB5MoOndfwrohj3jl/uZ:QWlbiu+WcgwF9QonKT9uZ

Score
7/10
bootkitdiscoverypersistenceupx

Malware Config

Targets

    • Target

      27ea14a5e35a028f09005d6623b4c181_JaffaCakes118

    • Size

      1.7MB

    • MD5

      27ea14a5e35a028f09005d6623b4c181

    • SHA1

      103bc623f846fbd26e0ab1eb10c44c7ff5aded71

    • SHA256

      18587958139fea44f5393c1739ab065ef899663aec64e305a9edcf3a1abc4db7

    • SHA512

      ad9a8893dc423729030a04329c0da2f246f800078884a161fcce80a214caad190034f62ceee82f1cff2c9892aee9cd73bc4ca439c005c719a3f0d4f9b0ede037

    • SSDEEP

      49152:dM+TCe7AWlCiJia6Xhw+WqbTgwF8YFUIFB5MoOndfwrohj3jl/uZ:QWlbiu+WcgwF9QonKT9uZ

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      a5f8399a743ab7f9c88c645c35b1ebb5

    • SHA1

      168f3c158913b0367bf79fa413357fbe97018191

    • SHA256

      dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    • SHA512

      824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    • SSDEEP

      192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/blowfish.dll

    • Size

      22KB

    • MD5

      5afd4a9b7e69e7c6e312b2ce4040394a

    • SHA1

      fbd07adb3f02f866dc3a327a86b0f319d4a94502

    • SHA256

      053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

    • SHA512

      f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

    • SSDEEP

      384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/locate.dll

    • Size

      17KB

    • MD5

      7d3317f57c1a368480ace3c0ca804eeb

    • SHA1

      d4c7e185bc64aac82339f51ba6c21cf0713c9f1a

    • SHA256

      d88a04c1e39db583eaad727fd390fe599ab10198ee040bfbdd22daefadbd2372

    • SHA512

      5598c2e6caa2f66edd48f8c8305e054d4b0740b5f2b7ed92cf197a13ac66ba99a32013d34b3c2e28d007ab7979eb90a50681324eb736b1410e7df1902e4ec32a

    • SSDEEP

      384:ev/vPBkA6dK8wiLe45naPji7hpx2kRV+qgm:evyvwiNnGji7Xxjc8

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/xml.dll

    • Size

      118KB

    • MD5

      42df1fbaa87567adf2b4050805a1a545

    • SHA1

      b892a6efbb39b7144248e0c0d79e53da474a9373

    • SHA256

      e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    • SHA512

      4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

    • SSDEEP

      1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      Help.chm

    • Size

      14KB

    • MD5

      e382cc9a281dea4ca93646f4a3e79c3c

    • SHA1

      ee69276cfd4febed74bc9a25d0c7582c5076744c

    • SHA256

      5e16bdc63a50323c3e5be23b4e7ae61d801cd1a5ca8f3dd4eca0917b95600c72

    • SHA512

      df56524bcfce55f16bdeea3388c905e1ac00789b80791832d4ab3550ae8c64eee742095d5282f1070a922f04434e14896423c56b198d5717e0f083289964af02

    • SSDEEP

      192:GAgl0R9EnNDFxinzTkPPWc6zn5zQv58v:GANOho/k3EVQva

    Score
    1/10
    behavioral15behavioral16

    • Target

      Wnl.exe

    • Size

      1.5MB

    • MD5

      18572ac39e0ceeb3d6c6b0b851446273

    • SHA1

      9591bc39910a34fbd620ac41db6c26ada8067349

    • SHA256

      915c4b622458079b73df0b2091f209eab6a4386c991bd2952e183d53f86b5dde

    • SHA512

      950b7365c38b6d226b5da2009a097686eccde2278af7ec58eabae86fcf19efb21977655aeb2c5906dabe1a1fecf4dc0d43111cefef96a04e2dc8ade7c39ffb40

    • SSDEEP

      24576:ALVKx+85PqEeG3w6nv5ftmiWlSH/ivEx0a421NXq56hea7kkWCzeyZx:AMt5PSoEid0DG97BP

    Score
    6/10
    bootkitdiscoverypersistenceupx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18

    • Target

      uninst.exe

    • Size

      38KB

    • MD5

      a2ee47b929b4c8c194302306ed4c1abf

    • SHA1

      c66784d788d04254295fbd44ea0b386e70b4291b

    • SHA256

      cde44450e2bf9933f3ffd029eb4bdbd2a93cef883d0d2641fbeeeca05c67fea5

    • SHA512

      8e7b4d488073dccb56405ba5a649ae2b23aa7d764a7815c695fdc9e3d6621017af1bc2e08354b95b08b1e4f5b55688e2412a1aad5b135f64d4425c39289a4072

    • SSDEEP

      768:De3PFaDVyOQgljLDKRJyM3BmsHzSB4us/wJJadnQ4PPRz:C3cpyORJLuB4P4AJJ0n3PPB

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks