Overview

overview

7

Static

static

3

28e9c9b769...18.exe

windows7-x64

7

28e9c9b769...18.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$TEMP/Toolbar.exe

windows7-x64

7

$TEMP/Toolbar.exe

windows10-2004-x64

7

content/aboutTabs.htm

windows7-x64

3

content/aboutTabs.htm

windows10-2004-x64

3

content/ctoolbar.js

windows7-x64

3

content/ctoolbar.js

windows10-2004-x64

3

components...rch.js

windows7-x64

3

components...rch.js

windows10-2004-x64

3

components...bar.js

windows7-x64

3

components...bar.js

windows10-2004-x64

3

components...rt.dll

windows7-x64

3

components...rt.dll

windows10-2004-x64

3

components...re.dll

windows7-x64

3

components...re.dll

windows10-2004-x64

3

defaults/fbAlert.html

windows7-x64

3

defaults/fbAlert.html

windows10-2004-x64

3

lib/xpcom.js

windows7-x64

3

lib/xpcom.js

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28e9c9b769c2b8a7a2a1260b3d70d3ee_JaffaCakes118

  • Size

    2.5MB

  • Sample

    241009-cjnkdawhkc

  • MD5

    28e9c9b769c2b8a7a2a1260b3d70d3ee

  • SHA1

    c68c6c74e75eeb3dab0f15ca10729f13c290a9b9

  • SHA256

    79a45a49b0058527f026f50cf95a7ffa03f7fd896e80491df36b6baac436fd18

  • SHA512

    b1a692c3dc6e7abb91189ade6546c8994990143f07e5b8145ecefc715dc5ea527159ef06e9a4aa27a4d3c2128a2183829eba269ebd19586bf54fdb887f649217

  • SSDEEP

    49152:lxP+4rCs3PXOfnz/Uu5S22sOorKV8lekAoLXiQgKsh6s9JmI7r7z1Ekz:lxPJrCKPXAnz/dS5svr3lekViQgK8D9l

Score
7/10
discoveryexecution

Malware Config

Targets

    • Target

      28e9c9b769c2b8a7a2a1260b3d70d3ee_JaffaCakes118

    • Size

      2.5MB

    • MD5

      28e9c9b769c2b8a7a2a1260b3d70d3ee

    • SHA1

      c68c6c74e75eeb3dab0f15ca10729f13c290a9b9

    • SHA256

      79a45a49b0058527f026f50cf95a7ffa03f7fd896e80491df36b6baac436fd18

    • SHA512

      b1a692c3dc6e7abb91189ade6546c8994990143f07e5b8145ecefc715dc5ea527159ef06e9a4aa27a4d3c2128a2183829eba269ebd19586bf54fdb887f649217

    • SSDEEP

      49152:lxP+4rCs3PXOfnz/Uu5S22sOorKV8lekAoLXiQgKsh6s9JmI7r7z1Ekz:lxPJrCKPXAnz/dS5svr3lekViQgK8D9l

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      31KB

    • MD5

      83cd62eab980e3d64c131799608c8371

    • SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

    • SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

    • SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • SSDEEP

      384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      fa5beae80dba254fb6c21b58265f5310

    • SHA1

      f2f776611dbbb157b151aa744a7e0be1d4b8c079

    • SHA256

      34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269

    • SHA512

      7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538

    • SSDEEP

      192:06JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTZK72dwF7dBdcQOz:06JaVh4I5rpPbTZ+BdhO

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      7eaad8c651cdeb4a71355b10dbe8d17b

    • SHA1

      1ef6cf4f98c7f20238e548dc6cdb270b741cfe8b

    • SHA256

      fad96602241e65daeef96b559092e7efa2c3b68948a65f1bd7f126b9963df468

    • SHA512

      6f7867774bfd82b1d12d0db5479e9539440ebfc6fee54aafc4381edea8fdccb89a9521a60b5f907033c147c805e6f541ec534c56bfe5f7354c55ca04df5175b9

    • SSDEEP

      48:SnHsOVN7ZTPUptxEwvB3UAKxwLJXyTpXfaV4MOa1n8iwuf0//nDGkaEJPof5MKIM:Y7ZDGEQ3zLJX6d6pOun8iwY0//npEO

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      6b85b2ff78fe0e04b5f0d4e996f0d62e

    • SHA1

      4507dee0b963080cbd75c383fa4650c7b99907dc

    • SHA256

      c7a033bb91be5487d93cc402d27e4e893ba39b37a121f60c9dbef5bdf02e52e7

    • SHA512

      84cbe4c2ecefd5eaa01ba5c1063056aed5f62a6ced32876c591bfb2bbe8688a020d02573a5f419cac2362579021fe2b4c6abf7e5d619de8178028db49d53e84b

    • SSDEEP

      192:I4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12wgszA:IysdM80dCI5a2LsQ5IlPNRY00AlAMU

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      17KB

    • MD5

      09caf01bc8d88eeb733abc161acff659

    • SHA1

      b8c2126d641f88628c632dd2259686da3776a6da

    • SHA256

      3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478

    • SHA512

      ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

    • SSDEEP

      384:w9JzaeWrF8d22hXAGFkr2WqErkuCYMAWS5Ns8AXXki:wLaBrrTXr3qruCYuS5qk

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $TEMP/Toolbar.exe

    • Size

      1.6MB

    • MD5

      803f2f972e70333c04aa15e9c0aa005c

    • SHA1

      b5f187f219c91799cd32e85135ee254149d2109c

    • SHA256

      5bf15c1bb866744d19d845aee46b9d0129d9ac86318eee7255f23dcfeca57a17

    • SHA512

      e0a9a9c8b5d71d0717afa3de781c807c7385bdd883e319a8f415bee07ad78dd6180b95b0878ec4cee4dac1e5ce3a65f9f83e5053ee86186b8955f43158fa587a

    • SSDEEP

      49152:JkHP+lrdsO2gH9hPmJeuP222hl7W9ug7S5lVk/6y:+HPird12gDPmJl25hl0ukS5lVk/5

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral13behavioral14

    • Target

      content/aboutTabs.htm

    • Size

      143B

    • MD5

      30b063c23ccd0e573f7956a49e6ad2da

    • SHA1

      b43ddff041bd7e3fdec541b0b3004ecd661db8d0

    • SHA256

      dde0330a494598aee2dec1ed467b0ce99400b860a9eec03e59a963090736cf9a

    • SHA512

      5af5794bc10afd6692ef9eccfb860248fbf656361fd6cbbe399e497bf0f8c9e9e603eb0dc3781344a53ae84578e1618e60a9a1096cc3a0b149e2e4c82c8c43c4

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      content/ctoolbar.js

    • Size

      1.7MB

    • MD5

      10a2c2f6d17091b5f6c2ab93b8a0b254

    • SHA1

      20570e22e00953dee74889950462560c6eaef550

    • SHA256

      34c96b9d414fda04d67e18498a7c1dfd789570beaef7c978bc91e49a6eacc17e

    • SHA512

      460d3388c457f7998d9c6d8ffa14c5d5bcff23ecae50eb02fc1f1834fbf4bc483eeb5021eef3b8f7dc4910c151feac170e12c270dcb6d21cff8cdec736ccfb9c

    • SSDEEP

      24576:Q/oCv8BYtyR/J+wh07Rs3JqDWKNMIz2iekxRn:Q/oCUBYkR/J+j7Rs3JqDxNMIz2iekxF

    Score
    3/10
    execution
    behavioral17behavioral18

    • Target

      components/ConduitAutoCompleteSearch.js

    • Size

      20KB

    • MD5

      9c6c85bd90c1878709c60ada200fca2f

    • SHA1

      379dac037b14fa21a56b08f4dba13c8c45a4b4cd

    • SHA256

      e28ab509efd87e81c3785858392e7e1f892fcd92b3a5e8e16734beb6fc5a3599

    • SHA512

      cac9fe78137104187ba7cb2ad20ec40a8a28538b24619586f5fb72e01702e0595e5b1b0a59db69e7ab3ef9cce9cdce915ae0d4066a450aab8e9a64aff4205d92

    • SSDEEP

      192:7j1DVelhxsk/M++iFdoK6dV/23RD8OQBM8G3j/pZ5HAwxIbUd0xC/iaG:7j1DVelhxskEFiLoK4AD5TFr5HAcVdm

    Score
    3/10
    execution
    behavioral19behavioral20

    • Target

      components/ConduitToolbar.js

    • Size

      3KB

    • MD5

      45125a08f11a41c888f1ca4605fcd670

    • SHA1

      4394f701592d7a75de44b8650708eac9459a7e71

    • SHA256

      27683257a48e82b0013d6d58f4deb6772f7c90b7425f5ebdaa34fcf283d3cfd1

    • SHA512

      5e4243be383341ecf06668491cea7329c4f5a13644ba4695cab749aba092a057723ba9f880d79f5927bc5542f43cd7096f1f39b8c09c619aefe4423591867a9e

    Score
    3/10
    execution
    behavioral21behavioral22

    • Target

      components/FFExternalAlert.dll

    • Size

      51KB

    • MD5

      ebebdbf1df7621623bbc5af82b533542

    • SHA1

      79807e07b5622c0bfeea6d7056dd418ba6667bb2

    • SHA256

      16e9938d330e3c2136f067376be3da206f928919cbf3207bbf34781f98902a9b

    • SHA512

      9678550490ca412d4d1f3f1e98085d97fbf663b6018d90289e124e062a0f2e300f7e36e5fa1385257f04b6cef8f703e5059703fdc4fa23f54b30d468ed081488

    • SSDEEP

      768:/67JzH2IjMH+asRPfyVCaO2P33k3Ql0faYM/LPg5YRUx9J:/6h2IjqYF2PqfglRUx9

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      components/RadioWMPCore.dll

    • Size

      99KB

    • MD5

      696f6787818300362f15485d654f6887

    • SHA1

      1ed56308df4da59efaa1ffddab00f6fa08783d0d

    • SHA256

      e4002c31fba34f976b135d07b2b03f6ca352863907ce521b1c1d7b6215947eb3

    • SHA512

      eb6d7f3feef54ddfb3f0fbfa876480f8c75902774cc529fffa8e33fd6c689134fb824033a55e7ab0c4e428cebe9f3220038addd99df74fe562f7692da8502531

    • SSDEEP

      1536:ji63tfvHRjEw1L0d0tGBOpWNJjxyHLHnS5GIHi:Td3HxD1LGopsjxyHrS5GI

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      defaults/fbAlert.js

    • Size

      4KB

    • MD5

      02beb29f12ef02d4fb4ceb94a02f2071

    • SHA1

      87c2c54bb1623217a44c52b3d11fcd1dc58a1cf3

    • SHA256

      2275e3dca1093cee646e1522c61ee4bb1f2d632fd8e0402a9cb7a30d5a0380a6

    • SHA512

      676fb9c855259f7f9445b5ce697f0d439043f5563d3de7a2d4a85f2aae321e01768276ae6488ed94ee8c98ff186575dd759baa384ff2655032032d2feb84ca9d

    • SSDEEP

      96:xDRtBOS7XEF7492uMbY3jyQei0diVD90MlYQTXSb79XHLHIuBlGOFFMlgBoJQE/d:xDTBOS7Xu7492lY3jyQei0du90MtXSba

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      lib/xpcom.js

    • Size

      523KB

    • MD5

      a728760323beb17df4343d89e610fd23

    • SHA1

      0c15c52295195d16797740aca47817c9ecdc36dc

    • SHA256

      6f1a91b9c46609d18a6d39c2b863631f3700f2406a6056ae7a7f4ea47104e3dc

    • SHA512

      001f485f6c5d7cad35e9b08bea54712682f693d8410e142624dbf0f1e2f05a0e8779193b78aa3d53fb7439646151e9fba4470e440ac0012fc059d09a99b0eeb5

    • SSDEEP

      6144:fZDdKzw51XGi8AXs7XzwCG9pBTXgP0mR7SEHwm/djYcVnXf/y7WI77Z:bKzw51XGi8AWjw40mR7Swy7WI79

    Score
    3/10
    execution
    behavioral29behavioral30

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
7/10

behavioral14

discovery
Score
7/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10