General

  • Target

    2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118

  • Size

    23.2MB

  • Sample

    241009-hezdzatcld

  • MD5

    2c98b86dfd5ba8f1d2e38f00370ad4b9

  • SHA1

    19144bc217ca11f092e5f4bfd187cea7586172b2

  • SHA256

    1b491752f18b866c048ebd243a4ef8a68d358c7d23b228705d06b1d9f612da75

  • SHA512

    502870a5629ceaacaa0a87d8dca62e7d810b0e2ea1e210e797a589c7ca3c79acf31822677110de61fe5fd2096a08511c305bd151a5373825de73a3e7ebb63eaa

  • SSDEEP

    393216:gt0l6b0pNXBGox+LEAW8FGivNLV3XrRHY8pqbqUkpdQ70+Gdg1uu:gt0cbMX7x9AXhVZnN48pfzpdfrd8

Malware Config

Targets

    • Target

      2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118

    • Size

      23.2MB

    • MD5

      2c98b86dfd5ba8f1d2e38f00370ad4b9

    • SHA1

      19144bc217ca11f092e5f4bfd187cea7586172b2

    • SHA256

      1b491752f18b866c048ebd243a4ef8a68d358c7d23b228705d06b1d9f612da75

    • SHA512

      502870a5629ceaacaa0a87d8dca62e7d810b0e2ea1e210e797a589c7ca3c79acf31822677110de61fe5fd2096a08511c305bd151a5373825de73a3e7ebb63eaa

    • SSDEEP

      393216:gt0l6b0pNXBGox+LEAW8FGivNLV3XrRHY8pqbqUkpdQ70+Gdg1uu:gt0cbMX7x9AXhVZnN48pfzpdfrd8

    • Possible privilege escalation attempt

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • Target

      $PLUGINSDIR/Banner.dll

    • Size

      4KB

    • MD5

      0116a50101c4107a138a588d1e46fca5

    • SHA1

      b781dce23e828cf2b97306661c7dad250a6aaf77

    • SHA256

      ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b

    • SHA512

      55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988

    Score
    3/10
    • Target

      $PLUGINSDIR/ExecCmd.dll

    • Size

      4KB

    • MD5

      b1d08c24cad3f8f6ccd6b9ebd24d30c0

    • SHA1

      d01549db25d0345c05d3c2eb90b173f937966ce5

    • SHA256

      c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69

    • SHA512

      9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8

    Score
    3/10
    • Target

      $PLUGINSDIR/JpgToBmp.exe

    • Size

      44KB

    • MD5

      a3e8696c93ad86d6b76a455e9d04582f

    • SHA1

      17368dc01a16b6a67663c1900575aa96f5e170ba

    • SHA256

      cce22a24171bca94741e8e5aed408b8abf33f20a27c6fe8696947285e7e7da70

    • SHA512

      85de5fcdc530c787aae8aa9ef3a0c27f22ac65dd8ca066e71859b417d141cf49d4013fc05b008cd49dad66a90f23efcd8bd37bc7360c6873171e334cbb7ce30c

    • SSDEEP

      768:VZmjJPk428s6nJrvfB/yLtpMUnN3aml6:VS3JDfsRdNHl6

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      $PLUGINSDIR/UXTheme Patcher.exe

    • Size

      72KB

    • MD5

      c35efaa15f6f1da888efc247e886389d

    • SHA1

      e3f35519380a564ff62f5ea2fa95fd5bca38bb1a

    • SHA256

      558f6e38c300957234231234c44ccf41217182677e859c9005a51094bdf01794

    • SHA512

      fd3d27271cab60f51929a4e92cccd0ce2edf8c95fd2db6cc957620ff2f7522e644b67862ec7803e6068f5ae75caedad9daae3dafdd4b7f4898c618c8498dca16

    • SSDEEP

      1536:oI78vwnEmMpryYRt2M5d3YieAB3iW+IalC6L9XMI+l1+hX:/78vwnEm+1RAkd3deANZ+IoC6xXMIYg1

    Score
    3/10
    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      f02155fa3e59a8fc48a74a236b2bb42e

    • SHA1

      6d76ee8f86fb29f3352c9546250d940f1a476fb8

    • SHA256

      096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999

    • SHA512

      8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

    • SSDEEP

      384:voJLJVqG5WLJgu/Emx1Ywxd2ZmX66vwUhU7ya4LC0Ac9khYLMkIX0+Gv8gcLom7:AJVkN8mHYwxdWmX3wUhUua4LeT7

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      acc2b699edfea5bf5aae45aba3a41e96

    • SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    • SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    • SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • SSDEEP

      96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX

    Score
    3/10
    • Target

      $PLUGINSDIR/xml.dll

    • Size

      118KB

    • MD5

      42df1fbaa87567adf2b4050805a1a545

    • SHA1

      b892a6efbb39b7144248e0c0d79e53da474a9373

    • SHA256

      e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    • SHA512

      4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

    • SSDEEP

      1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK

    Score
    3/10
    • Target

      $PROGRAMFILES/Angry Birds Space Skin Pack/$PROGRAMFILES/Angry Birds Space Skin Pack/uninst.exe

    • Size

      464KB

    • MD5

      12341788cbeea061df74e281e568ebde

    • SHA1

      421f17a4a59eede1263bb749ba5a67b43cb4fba7

    • SHA256

      3a0cd378658b6ca19c95025805dabc4072f83917bc66647981aefbc872c25737

    • SHA512

      197ee1f1fcccd00eead1f15b2b7fcd1080af2d0c47e42345d03f27a3530809cfd5813ba96ef9269501c847e0b92d687cbada312dd911bac722cc5928095910ba

    • SSDEEP

      12288:o4KBAG8S3ffvzMU1i9xtQlN0WGTKnkGx7YCJ2GC:oleG8S3oKdMWGObYA2GC

    Score
    7/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Target

      $PLUGINSDIR/ExecCmd.dll

    • Size

      4KB

    • MD5

      b1d08c24cad3f8f6ccd6b9ebd24d30c0

    • SHA1

      d01549db25d0345c05d3c2eb90b173f937966ce5

    • SHA256

      c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69

    • SHA512

      9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      acc2b699edfea5bf5aae45aba3a41e96

    • SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    • SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    • SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • SSDEEP

      96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX

    Score
    3/10
    • Target

      $PLUGINSDIR/registry.dll

    • Size

      16KB

    • MD5

      1c9523d1c77e5c18d7f1cf3be21c9392

    • SHA1

      f6afd13a7e0585082f64600959c3b31d18e55946

    • SHA256

      d1bd1879f4c1e9a7c3233ba79eb44c93fecb4d3ecdad7b896e4e2e1b14690459

    • SHA512

      52662a37ed0ec9db7a94c245488bf3639e7d2dd76ec28b08415ee93b53489bdf7fc38c1df768033a6a2a2a2571709518e81d66a325f6609d6552442a1aef4c4b

    • SSDEEP

      384:Gw418n2r8Qt89Bo/VLkSgPXmSicwocAnazI:F4pF8A/l2WSicwJz

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discoveryexploitransomware
Score
8/10

behavioral2

discoveryransomware
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
7/10

behavioral22

discovery
Score
7/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10