Overview

overview

7

Static

static

3

b0aaa8a594...18.exe

windows7-x64

7

b0aaa8a594...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$TEMPLATES...at.exe

windows7-x64

1

$TEMPLATES...at.exe

windows10-2004-x64

3

$TEMPLATES/readme.exe

windows7-x64

3

$TEMPLATES/readme.exe

windows10-2004-x64

3

$PROGRAMFI...ar.dll

windows7-x64

7

$PROGRAMFI...ar.dll

windows10-2004-x64

7

$TEMPLATES...cs.dll

windows7-x64

3

$TEMPLATES...cs.dll

windows10-2004-x64

3

KKDock.exe

windows7-x64

3

KKDock.exe

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0aaa8a5948c20836ba7b590cd451551_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241129-mlxwyavrem

  • MD5

    b0aaa8a5948c20836ba7b590cd451551

  • SHA1

    0bf5d01289ba0a8aa9b7d0da45e04eb1764f8b57

  • SHA256

    1dc7a2a9342ad70698ea3358048dc17072faff8fd90201ee80344bea5000d610

  • SHA512

    7f0d08417d1b2157fefa9a70c129fc6a124fdac3089b6ba3e18701cdc0c011d78512df85e9f1b3697b8c3cb813fed615ee73581aaa903012cd618f592df26848

  • SSDEEP

    24576:80Men6rCMVvdVjwADt34svKIL5Ia6qdHsLS23i0iDHvJR7wGGgg:dMepGvE8o4KItIafdHwrkDHvJVW

Score
7/10
adwarebootkitdiscoverypersistencestealer

Malware Config

Targets

    • Target

      b0aaa8a5948c20836ba7b590cd451551_JaffaCakes118

    • Size

      1.1MB

    • MD5

      b0aaa8a5948c20836ba7b590cd451551

    • SHA1

      0bf5d01289ba0a8aa9b7d0da45e04eb1764f8b57

    • SHA256

      1dc7a2a9342ad70698ea3358048dc17072faff8fd90201ee80344bea5000d610

    • SHA512

      7f0d08417d1b2157fefa9a70c129fc6a124fdac3089b6ba3e18701cdc0c011d78512df85e9f1b3697b8c3cb813fed615ee73581aaa903012cd618f592df26848

    • SSDEEP

      24576:80Men6rCMVvdVjwADt34svKIL5Ia6qdHsLS23i0iDHvJR7wGGgg:dMepGvE8o4KItIafdHwrkDHvJVW

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $TEMPLATES/installstat.exe

    • Size

      44KB

    • MD5

      7c30927884213f4fe91bbe90b591b762

    • SHA1

      65693828963f6b6a5cbea4c9e595e06f85490f6f

    • SHA256

      9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

    • SHA512

      8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

    • SSDEEP

      384:H+HHi0nKwn0RDbwemPK7BywsgtDgHJR0bA6VWqaCL6VuhV5bIle+vEv5aY3uBRgl:en1nKwn0ZFmKApg7AqaCL6Y16Ha5/uO

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $TEMPLATES/readme.txt

    • Size

      240KB

    • MD5

      f48f6b45f3e2bd243342833088125da2

    • SHA1

      6df69ee997c29bd9e302d2791db53ecdaa28a999

    • SHA256

      6b193a8a230c40922af714f86d8372235cb8a15609430d9106a5441ea3fe9290

    • SHA512

      c678c00e35e9a24d13a77e596bfc6562fc1f10523d2b53de29e29ab290fdeee8ac98f40ec9b9663f0b2c790c32d6ab514b9e5e5c06e3aa940dd8ff4cd8c430ad

    • SSDEEP

      6144:2APRxoNm3OsX7Q79Z9X3EkiGF+emYXUPB:rxoNf7qkidoUPB

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PROGRAMFILES/Baidu/AddressBar/AddressBar_Tmp/AddressBar.dll

    • Size

      510KB

    • MD5

      09279fab3646f9cce9a59b56042eb1d4

    • SHA1

      0c7b50c7ba7aad340eefad07f0e2550ea20af95e

    • SHA256

      ba4eff0e211de087aa56d1ea4acb429b1c7ec642451c16c7a54e2f1b453f3d9c

    • SHA512

      45f7f0c7daacecb210d7c6b73d96ec89cd992741b707634f145a3b930523437565f8d14faacaf4a1ccf45a81f7860d776c74ac6a2476e78ebadf9f137c37715a

    • SSDEEP

      12288:NkvfqN8YA/XWvDs6YRZpVGE2tYz0r/kq6ljj:NFDs6YRZpVGE2a4rP6ljj

    Score
    7/10
    adwarebootkitdiscoverypersistencestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral11behavioral12

    • Target

      $TEMPLATES/statistics.dll

    • Size

      528KB

    • MD5

      b9b3b41e4d144b886af1cada8251d16f

    • SHA1

      b18724bab7f10d1b3876ebf5f96e6b5dc97211dc

    • SHA256

      fe094423639deae8fea8859935b611006c107a2e571084498820b21ebcc38626

    • SHA512

      d99fe8b54dd16466c140849bbbdd394d481bb6f350fb8e21ce88e390f92d8970c93c654be9094f93a0b87570b3ba0bc3f28127eae2f96b6bc2455b83be2c6579

    • SSDEEP

      6144:00KrP3aHbaBGCUiSG1IMo9G3mMDlKyoGMojHgDpokrJvgEwqd4bF1sdJJT:00KDq7s/9S8zygbgDpoyJvrdh

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      KKDock.exe

    • Size

      430KB

    • MD5

      9f2d4b3cef9fa0af1428dcf5e8b1331a

    • SHA1

      247a495cce345aeede728ca68c8831e40f954365

    • SHA256

      d7871276d80cf9e009cb3b756d8a49d1d0fd7f2ee84b530cf68eb0182a1a29e6

    • SHA512

      03dc35b4c593490fcb861aa0c5b5734c835c2bbfe34ca133c5a1c2f69452d39db724add7d48f39a916795836aa2aae9fcb2256346ae7e05b8e7759843eec1dbb

    • SSDEEP

      12288:TKO/e68Qx7nKuKGuMKHRMTGcjuOV/HT6+DzgN:7e679najWuSrG

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      uninst.exe

    • Size

      37KB

    • MD5

      2a920c23ffc5970a07d5eb9f90ee1d5d

    • SHA1

      462e6c75d4757e5bf0ef2224b616f09487611ee2

    • SHA256

      9de19940309743c988de7e8f445b0baffb1c8297696ccb1839ab6c2035fcc106

    • SHA512

      a0a8795271f60e7190087f794900b9ae67a9e59d25bbbe1d510b7c387672131fab0f7fdf35b1d167f1595e0afe7f55260f1003e3a76baaf84e4c7dcac7d113bc

    • SSDEEP

      768:EHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJqTQvDXACvV:EpgpHzb9dZVX9fHMvG0D3XJG8pV

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks