Overview

overview

7

Static

static

3

JaffaCakes...a6.exe

windows7-x64

7

JaffaCakes...a6.exe

windows10-2004-x64

7

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...pt.dll

windows7-x64

3

$PLUGINSDI...pt.dll

windows10-2004-x64

3

$SYSDIR/ad...ve.exe

windows7-x64

7

$SYSDIR/ad...ve.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$_5_.dll

windows7-x64

6

$_5_.dll

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_277ca3aa4a3aeddb75c7c02f7c6dfca6

  • Size

    331KB

  • Sample

    250125-c6a8kasqer

  • MD5

    277ca3aa4a3aeddb75c7c02f7c6dfca6

  • SHA1

    d96988333d2222826b83423598b3334f6ea7ec61

  • SHA256

    e1f619f440e6fa957d563ab4ed0e38d95c7b29b46b5e93ffb4075cdced027443

  • SHA512

    f8ec18573a290de799262e0d486c29c2127f8f16c8b60223c23ac8e9e8e0a3b90f6be6e251999929c838506ab21ac27bc107a8c9109a2a1b63cf21fbd6e803fd

  • SSDEEP

    6144:WXXE1Q0ucQ9lIIo28ohm7YV1NnUH1DrlCQ/XzmsKcWKHA0e/nq:buII2o47MUH196sKr7/q

Score
7/10
adwarediscoverystealer

Malware Config

Targets

    • Target

      JaffaCakes118_277ca3aa4a3aeddb75c7c02f7c6dfca6

    • Size

      331KB

    • MD5

      277ca3aa4a3aeddb75c7c02f7c6dfca6

    • SHA1

      d96988333d2222826b83423598b3334f6ea7ec61

    • SHA256

      e1f619f440e6fa957d563ab4ed0e38d95c7b29b46b5e93ffb4075cdced027443

    • SHA512

      f8ec18573a290de799262e0d486c29c2127f8f16c8b60223c23ac8e9e8e0a3b90f6be6e251999929c838506ab21ac27bc107a8c9109a2a1b63cf21fbd6e803fd

    • SSDEEP

      6144:WXXE1Q0ucQ9lIIo28ohm7YV1NnUH1DrlCQ/XzmsKcWKHA0e/nq:buII2o47MUH196sKr7/q

    Score
    7/10
    adwarediscoverystealer

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Math.dll

    • Size

      66KB

    • MD5

      468914ab4ea3afc6fda29031c758394e

    • SHA1

      d3b632778a03567efa761401151bfe80d0fe956c

    • SHA256

      8a8d78657f0f6b44f18b16e7eea3e62eef6720e04cd2efc820d62bbe987afac1

    • SHA512

      0b3df17a3a17a82ba7092ff384c7d820d9f1103fcfa732fb399cf0ff065ec6913a73bea433e19ad787bccf272059e39d196322445d9a6327bb25738f343926ce

    • SSDEEP

      1536:zPyr/G6SdHg4amq2MwtmIuqFVxL9NvImlRo:z6AHg6bH5lq

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      997ae296af5b7ca9aaa52f6844075439

    • SHA1

      9814f0b09219ac2eed875d842b9362c3b32bec6f

    • SHA256

      1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8

    • SHA512

      a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349

    • SSDEEP

      192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      32465a07028b927b22c38e642c2cb836

    • SHA1

      309cac412b2ecf6a36f6e989c828afcdd8c7a6e4

    • SHA256

      eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292

    • SHA512

      9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff

    • SSDEEP

      192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsBrowserOpt.dll

    • Size

      315KB

    • MD5

      b6e4392a71867ca9dc6580de54acb34d

    • SHA1

      b105e6b1f61e90ae46a760e8bb98d8489c43b968

    • SHA256

      09a395cdd7f124e04a765b82f68cd9b5c4912ea4a07f512b3e5b098af007762e

    • SHA512

      1b28caac78c57901827f058aefad3e2c3b6710a0f7a339b3b9e39775f54113bba50c2d430e1f71ffd812705dd67a3d2ac69bf10838b5bd6aeb8833b6495e95ad

    • SSDEEP

      6144:zo3WlsbCU4L8FyTVckgNsYXnzI0LdGY1TBLXSU4t/L:U3WGbvK6yxcpNsY3zIKd1TRXSUYL

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $SYSDIR/adzgalore-remove.exe

    • Size

      99KB

    • MD5

      31709de9a5d9f2906dce36c836e4e055

    • SHA1

      cc59ca78fa077fff9384570189ac16b091bf49ec

    • SHA256

      21f7cb13c3a8d35e8533ffa55485a4c1c7c35e41d93893cbc0dda43b3b00e7e5

    • SHA512

      bfd57f3bf8ec9c7ed04e51e67b2e0f0428cb811f0d1bf2015b78a0d5e93c65aa4da1648fe49bfecd88b7f613ef6ba4b9106fc19053c39d96011d0f18ce2ddf74

    • SSDEEP

      1536:WUeHiWRgkkjH8nyWmJPnWb/Nv07LVpN6MzPY0rBAWCKSjqBkHBTXHccDuVbH8k5O:Wd/vyWmJqG7/wu6WCqGdccDc775kMZI

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      117KB

    • MD5

      cd6e705cc6992e869f488ab211ac37cb

    • SHA1

      c9c71edd929c15bcf5ee286d4a9e9259d1590eb5

    • SHA256

      44e729371099650904bcd5db0af7fdad6ffc01e336ae464f0bb151f329175292

    • SHA512

      460173bbcff640721e54bb403e1f46d274e649a9db7d3b83d009a7f00354d434874dfdc009679e98cfb05548801b9eee78c25fe17b083fac396087ad3327debf

    • SSDEEP

      1536:G8jeHR5cxDyiJu+Sp3o7lCNj+fgERBNxOtyg5Fu/oZSY0vXuHznnULYU455YQ+5:tZHK4Z2j+fP31gu3eHTnULB455y

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      997ae296af5b7ca9aaa52f6844075439

    • SHA1

      9814f0b09219ac2eed875d842b9362c3b32bec6f

    • SHA256

      1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8

    • SHA512

      a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349

    • SSDEEP

      192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      32465a07028b927b22c38e642c2cb836

    • SHA1

      309cac412b2ecf6a36f6e989c828afcdd8c7a6e4

    • SHA256

      eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292

    • SHA512

      9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff

    • SSDEEP

      192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $_5_

    • Size

      306KB

    • MD5

      069b38d65b12c89ce5531da46359cd7e

    • SHA1

      f041d92369f971b6d46d8bd63b3b773c51833dcb

    • SHA256

      c536e06b05d752d1e9cbe134c5b8e764dd0aff943c6d5ac63c8c7a73fa24b39c

    • SHA512

      013763c11e330c87a70677006d489a58a7cb3d615359b6ee3d8b895191fea2b8fed9f31eb2631e84e2ab29718f3de0fa079dadf69cd0e58e2a318a942ccfa277

    • SSDEEP

      6144:tXE6GJOmwB1lQBazcPFqR501Nh34TB/mQCzhm0:tXE6GJhqTzzcP6Uf34T1mQCzD

    Score
    6/10
    adwarediscoverystealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks