06cfba5aac3903e77f9ee5b6412141ce30dc531ca25b08d5dafe89cdf8f0fa8f

Sharing

Copy URL Twitter E-mail

General

Target

3ad5bde8a365e628b5fd00704e9ade2b_JaffaCakes118
Size

242KB
Sample

241012-s7hxsssepj
MD5

3ad5bde8a365e628b5fd00704e9ade2b
SHA1

c0552dced29c72b5a4cb8d11a5f68565882694b5
SHA256

06cfba5aac3903e77f9ee5b6412141ce30dc531ca25b08d5dafe89cdf8f0fa8f
SHA512

762fe8145356519a0c0c0d8c256cc4e1cba288b1d830526a9d65ae294288429f2b4ee8fc5924f5d872bc784a9654f00c63bd79a4b3896a2c71ee5a69b6b5d6bf
SSDEEP

6144:esvGvYo9Gkg8kiKbJhC3HUrfuQcPCCdxIA/Ahf:dGwo0kwiKbmErfsz/Ahf

Score

7^/10

Malware Config

Targets

- Target
  
  3ad5bde8a365e628b5fd00704e9ade2b_JaffaCakes118
- Size
  
  242KB
- MD5
  
  3ad5bde8a365e628b5fd00704e9ade2b
- SHA1
  
  c0552dced29c72b5a4cb8d11a5f68565882694b5
- SHA256
  
  06cfba5aac3903e77f9ee5b6412141ce30dc531ca25b08d5dafe89cdf8f0fa8f
- SHA512
  
  762fe8145356519a0c0c0d8c256cc4e1cba288b1d830526a9d65ae294288429f2b4ee8fc5924f5d872bc784a9654f00c63bd79a4b3896a2c71ee5a69b6b5d6bf
- SSDEEP
  
  6144:esvGvYo9Gkg8kiKbJhC3HUrfuQcPCCdxIA/Ahf:dGwo0kwiKbmErfsz/Ahf
Score

7^/10

adware discovery persistence stealer
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $SYSDIR/$SYSDIR/$_1_.exe
- Size
  
  59KB
- MD5
  
  ff88d047122802233a05beca757f266f
- SHA1
  
  08e071c69db396187388bdb356879440d64fddc3
- SHA256
  
  03023c53836da08fe6432abf34eacc0377110ee6d492bb9d95086ec934961a2f
- SHA512
  
  f523381a60d2ba3fb30352949a6a2d0ff69eb91b9543827b3495386396d6bd041073ea5e26c0593996086594eedc2af1032655084e71a9f647ff486ce75baca6
- SSDEEP
  
  1536:eQpQ5EP0ijnRTXJF4Romu/k5YYAEdyCg4MEbl:eQIURTXJF45L5YYTws
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $SYSDIR/$_5_
- Size
  
  396KB
- MD5
  
  053541070466b4dc0f8b2b79545681d4
- SHA1
  
  e68982ab132b553fe1ffa99d367d7b2ffdb793a5
- SHA256
  
  5d292249e6cf6e2bffe6e3288fb687b6af57599e5e1b58ad689fd24dc4ab8826
- SHA512
  
  43e39e7d50b1fd71d3c586903420f35f3973d8c5e79f178865365c67f2a3b28a337535f571f152dddeb355c493ae627507016175c1198be004dafe7bf89f4d4a
- SSDEEP
  
  6144:Z2sizbp4h+bANskjE+h1M/4gmNpGmC5+BoOzVOUJvOBd3ZX+FlNzH:jizzbANsN+DtJ7GmVlhOUJGBd3ZuFb
Score

6^/10

adware discovery persistence stealer
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral11 behavioral12

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

Maps connected drives based on registry

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Installs/modifies Browser Helper Object

Maps connected drives based on registry

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12