Overview

overview

8

Static

static

7

ab40b4d665...18.exe

windows7-x64

3

ab40b4d665...18.exe

windows10-2004-x64

3

$PLUGINSDIR/Aero.dll

windows7-x64

5

$PLUGINSDIR/Aero.dll

windows10-2004-x64

5

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...md.dll

windows7-x64

3

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...mp.exe

windows7-x64

1

$PLUGINSDI...mp.exe

windows10-2004-x64

3

$PLUGINSDIR/RP.exe

windows7-x64

4

$PLUGINSDIR/RP.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.exe

windows7-x64

$PLUGINSDI...er.exe

windows10-2004-x64

7

$PLUGINSDIR/Aero.dll

windows7-x64

5

$PLUGINSDIR/Aero.dll

windows10-2004-x64

5

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...le.dll

windows7-x64

3

$PLUGINSDI...le.dll

windows10-2004-x64

3

Uninstall.exe

windows7-x64

Uninstall.exe

windows10-2004-x64

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab40b4d6657e67053c9e36f9f6bf25cf_JaffaCakes118

  • Size

    20.0MB

  • Sample

    241128-gt4rkavjaj

  • MD5

    ab40b4d6657e67053c9e36f9f6bf25cf

  • SHA1

    8a31c59ac2873a8ed9132685449a0831bf3405a8

  • SHA256

    da437cbf9bd975a8916654aca547e35bbf88df60fb18c57db07401efb33420c9

  • SHA512

    9830b6870a6ba3a5cd8f6e590d8ea3dfe3dcc98639093d81266132106d97ada8322561e78cc30029bc975d21a62d45db141e9f977758d7b092a9f89d5e6fab0d

  • SSDEEP

    393216:/zP3tkQlGDmv9t7Jqqhi4ToFe4UE2kk7ZcPpT4mtq0veVSr+7zejhGgYZS7kxJp:/zeQ8K1t1q+qew3kNcPpT4mtv27SE7S8

Score
8/10
defense_evasiondiscoveryexploitupx

Malware Config

Targets

    • Target

      ab40b4d6657e67053c9e36f9f6bf25cf_JaffaCakes118

    • Size

      20.0MB

    • MD5

      ab40b4d6657e67053c9e36f9f6bf25cf

    • SHA1

      8a31c59ac2873a8ed9132685449a0831bf3405a8

    • SHA256

      da437cbf9bd975a8916654aca547e35bbf88df60fb18c57db07401efb33420c9

    • SHA512

      9830b6870a6ba3a5cd8f6e590d8ea3dfe3dcc98639093d81266132106d97ada8322561e78cc30029bc975d21a62d45db141e9f977758d7b092a9f89d5e6fab0d

    • SSDEEP

      393216:/zP3tkQlGDmv9t7Jqqhi4ToFe4UE2kk7ZcPpT4mtq0veVSr+7zejhGgYZS7kxJp:/zeQ8K1t1q+qew3kNcPpT4mtv27SE7S8

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Aero.dll

    • Size

      6KB

    • MD5

      243bf44688b131c3171f2827a93e39dc

    • SHA1

      07e9c7bd16ae47953e42c06ae2606de188386f35

    • SHA256

      04a577df50431eb0ff6fb103566402bf66c50415bcc1f8a86b9c235053131455

    • SHA512

      a1a8c21d38c54a43d1c6c394f481dfbddcb359c617e9928ecca8f84d47354616a78d20735a1fe7bebd21626c21cf96d0e1a69e3e98f6b35f2a774cc0244f9516

    • SSDEEP

      96:Mh1Wh+rTUNfwRtoqLOk+UVud5Wa7U2ZG:MTWh+cZG2qLOkjud5Waw2Z

    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/Banner.dll

    • Size

      4KB

    • MD5

      0116a50101c4107a138a588d1e46fca5

    • SHA1

      b781dce23e828cf2b97306661c7dad250a6aaf77

    • SHA256

      ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b

    • SHA512

      55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/ExecCmd.dll

    • Size

      4KB

    • MD5

      b1d08c24cad3f8f6ccd6b9ebd24d30c0

    • SHA1

      d01549db25d0345c05d3c2eb90b173f937966ce5

    • SHA256

      c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69

    • SHA512

      9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/JpgToBmp.exe

    • Size

      44KB

    • MD5

      a3e8696c93ad86d6b76a455e9d04582f

    • SHA1

      17368dc01a16b6a67663c1900575aa96f5e170ba

    • SHA256

      cce22a24171bca94741e8e5aed408b8abf33f20a27c6fe8696947285e7e7da70

    • SHA512

      85de5fcdc530c787aae8aa9ef3a0c27f22ac65dd8ca066e71859b417d141cf49d4013fc05b008cd49dad66a90f23efcd8bd37bc7360c6873171e334cbb7ce30c

    • SSDEEP

      768:VZmjJPk428s6nJrvfB/yLtpMUnN3aml6:VS3JDfsRdNHl6

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/RP.exe

    • Size

      97KB

    • MD5

      2b585ec745d0d5e94850e615f35dfcc0

    • SHA1

      32b2b64e6c5090152c19e50339a5fbb175ce044e

    • SHA256

      bb62a3f34f180e8becbba7bcc752bde4ee91e17c171d154939117c47d80994db

    • SHA512

      91f6368b4043e9eebb184f9f79b444daafd5862cd7baade71e54ba6706371323d09cf9e4571b99bd7bfd053e9e2041506491919bf1cb940a705730cb014d92db

    • SSDEEP

      1536:cfL8WaRkYVE2N/ghGf5TgeYPYlEZYhqqZYn9ACkxWr7uFc1U3leTW:I4lRkAehGfzmuqTPryFm8leK

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/UXTheme Patcher.exe

    • Size

      155KB

    • MD5

      3156c1dfc05cb509aad5cc94a77511ee

    • SHA1

      e9be935ea42141277d618e02f49fb77df56d7279

    • SHA256

      602fa4344d7fdb830e6c0f8b1f94c38fae71adf75a194bd6e86028d849677744

    • SHA512

      e043ce7e2a84d960632abd9abc56baa8b749cb75951ad655620c660583a9dbcadf0b8d73f5ea83a505cedd41a5ce2ffe760375836844fac2ec85d3d1897a07d0

    • SSDEEP

      3072:WQIURTXJ6stVm12xqQzIQsAYG33xb6nCaPpVti4pfUtcT1Gt+4:WsdtEgxn2ngxb6nCaPpVtiCcMI3

    Score
    8/10
    defense_evasiondiscoveryexploitupx

    • Possible privilege escalation attempt

      exploit

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/Aero.dll

    • Size

      6KB

    • MD5

      243bf44688b131c3171f2827a93e39dc

    • SHA1

      07e9c7bd16ae47953e42c06ae2606de188386f35

    • SHA256

      04a577df50431eb0ff6fb103566402bf66c50415bcc1f8a86b9c235053131455

    • SHA512

      a1a8c21d38c54a43d1c6c394f481dfbddcb359c617e9928ecca8f84d47354616a78d20735a1fe7bebd21626c21cf96d0e1a69e3e98f6b35f2a774cc0244f9516

    • SSDEEP

      96:Mh1Wh+rTUNfwRtoqLOk+UVud5Wa7U2ZG:MTWh+cZG2qLOkjud5Waw2Z

    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/GetVersion.dll

    • Size

      9KB

    • MD5

      225f776172f1baccd2721a6e5d512b36

    • SHA1

      2dbbc86f7b0285682880a627b56a75de09f4bed6

    • SHA256

      ecfcbe30f5b248673f9cbebb734b9981ed14b06380ea787c563d67b30e2d069e

    • SHA512

      4b99a5ac68122501a5913cf54bd3ae99d851d57656b0e136980122739cceef739fa2d5ea097f2442068b9489a4c25ea0884653c41d85f27f25996792bf6c21bb

    • SSDEEP

      192:MMr/9XGqK7s/AlHdJZBi46AQ5VuNxHA8/:MsXGqM93Bi46AQ5Vujg8/

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      $PLUGINSDIR/nsisFile.dll

    • Size

      5KB

    • MD5

      a35adabef191a1d5870096543ffc18ec

    • SHA1

      76a77d50b8f0be5a77fdb7b71a661a356ead1b7f

    • SHA256

      bb5be80416d8e381fbcb0f03ea3433d94a75786e3842e8cfe1b7b8bd57354457

    • SHA512

      97eb8186abc0ae5a6c1858b78042c41fa377dea33ea0bae3c6957b7a22486ba0f1e0a4a43d817627bbba85d5de786c82e05d7505dc7df62bff51439fd0f8401c

    • SSDEEP

      96:DBcvub8wwAwqr70/oGNh6e31JTLTNFh9552Qs:dcvm8wZw0L4h6e3PTLTB9552T

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      Uninstall.exe

    • Size

      96KB

    • MD5

      1b48e1d5d2a00a916c7df2f7abbd2713

    • SHA1

      4a052f97b760fa2db89974069cbce2d3cb0d560a

    • SHA256

      589dd07c5163c550e794000a67638d52ecf86477976527052fc99304aa74a46b

    • SHA512

      d3dd85a74f4455266f8ac055c5f31c51fbba7fa6525a4eac0040676acc22fcab1d4fcf636c191521790afd2a7059a89f855a5081926f2ae994532e442501997b

    • SSDEEP

      1536:WQpQ5EP0ijnRTXJNe5wP7+VCusaarmj8ZNF4a1OCWMSF5I7GcqRh:WQIURTXJ6stVmkOd8p8

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral27behavioral28

    • Target

      $PLUGINSDIR/GetVersion.dll

    • Size

      9KB

    • MD5

      225f776172f1baccd2721a6e5d512b36

    • SHA1

      2dbbc86f7b0285682880a627b56a75de09f4bed6

    • SHA256

      ecfcbe30f5b248673f9cbebb734b9981ed14b06380ea787c563d67b30e2d069e

    • SHA512

      4b99a5ac68122501a5913cf54bd3ae99d851d57656b0e136980122739cceef739fa2d5ea097f2442068b9489a4c25ea0884653c41d85f27f25996792bf6c21bb

    • SSDEEP

      192:MMr/9XGqK7s/AlHdJZBi46AQ5VuNxHA8/:MsXGqM93Bi46AQ5Vujg8/

    Score
    3/10
    discovery
    behavioral29behavioral30

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discoveryupx
Score
5/10

behavioral4

discoveryupx
Score
5/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

Score
1/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
4/10

behavioral12

discovery
Score
7/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

defense_evasiondiscoveryexploitupx
Score
8/10

behavioral16

discoveryupx
Score
7/10

behavioral17

discoveryupx
Score
5/10

behavioral18

discoveryupx
Score
5/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
7/10

behavioral28

discovery
Score
7/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10