d6fd9f8023ea24a97c2e392e2f35c5f8f852a795121dc8b9bc6734a50e36a7e3

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_40d1757e9c780835836d1810748c2435
Size 804KB
Sample250127-shavwsvmcr
SHA256 d6fd9f8023ea24a97c2e392e2f35c5f8f852a795121dc8b9bc6734a50e36a7e3
MD5 40d1757e9c780835836d1810748c2435
SHA1 369dee05027c3bca1043a2e74a1c481832f4177c
SHA512 28bdcafa515a1261b672fe871d62c77829a8b9e6565100332aea55e6a7eef7d398a3eae1ca454fb6fab6eaa0a0e2b9e4ceb9d83f91894a18bed796d1407d342f
SSDEEP 24576:M0aNNdDEuDbbETLHzQlrnTfvecXz7tcTIlXdtQO6kldiDDUn:MLVDU3HQzeScTIlXdtpjim
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  JaffaCakes118_40d1757e9c780835836d1810748c2435
- Size 804KB
- SHA256 d6fd9f8023ea24a97c2e392e2f35c5f8f852a795121dc8b9bc6734a50e36a7e3
- MD5 40d1757e9c780835836d1810748c2435
- SHA1 369dee05027c3bca1043a2e74a1c481832f4177c
- SHA512 28bdcafa515a1261b672fe871d62c77829a8b9e6565100332aea55e6a7eef7d398a3eae1ca454fb6fab6eaa0a0e2b9e4ceb9d83f91894a18bed796d1407d342f
- SSDEEP 24576:M0aNNdDEuDbbETLHzQlrnTfvecXz7tcTIlXdtQO6kldiDDUn:MLVDU3HQzeScTIlXdtpjim
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 27KB
- SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
- MD5 6f73b00aef6c49eac62128ef3eca677e
- SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
- SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
- SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 36KB
- SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
- MD5 1cc87d2b5a79b18f133b4f944e2f2f74
- SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
- SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
- SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
- MD5 a88baad3461d2e9928a15753b1d93fd7
- SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
- SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
- SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/inetc.dll
- Size 23KB
- SHA256 10a003f8e01c55d95a72f94ea2c3ae0ce0fd522832d88a51ea40cfcb3e44f907
- MD5 31798167b0cfba85d5deca0261596b1d
- SHA1 b13525b6cd9dd8ccd0a630644dcdf045ae67befb
- SHA512 7ece77c9335651d48890f3bc82eef0fb018856492af91faa170f6510043c47448ee291dd9249e28bc7da58577b10358f0d49e0a797539166f4801465294b2d3a
- SSDEEP 384:dZ8mr5/qvsHWqgBf4UGehYpB/7f+jFJDhgRZwcYa9h9nRgw1:D8W5/qc+w1wk7f+RJDhdajdv
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
- MD5 f7b92b78f1a00a872c8a38f40afa7d65
- SHA1 872522498f69ad49270190c74cf3af28862057f2
- SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
- SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $_0_/Helper.dll
- Size 1.0MB
- SHA256 d0b3e7f9b304b88fe7de3b81afc1c64f40d7b2237721225a15a564ae62b34e66
- MD5 cf0e9192667cdedfacc8646e38bd9686
- SHA1 4741ac6de1d309210279795e1c7cd7f21cee6f17
- SHA512 b8a47fc2c706822eb0adfa820d24330901454fe37b6c93270f2fc89aa4b05e9e1527820af1f3f674b6d8696ed79722cc51eeb12e7e1762e112e7bad69327d36c
- SSDEEP 12288:6atQ0QAsqP85SFuNrC8b+qyPyTlkmn4IiaLgfeC:jtQ06M8Sqy6Tlkmn4IvieC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Helper.dll
- Size 1.0MB
- SHA256 01958a70df5d683d53dac05da2b8d571271299c648d7209be065f6d53cbe8bd2
- MD5 08307e144b2eeea7f1e3ef1a7e3ad233
- SHA1 d0606a572575ea0ef1f1bca801f996a6eff453bd
- SHA512 5fcb5dd8f9b2338f5f84c9e3cdb7407d186a5776acfcfe9a8d0a8228c10df902d480e844c0c032f5d55820e0c5b6e2278e4ffed5a379f7a6f46afefee1b88f81
- SSDEEP 12288:DkayrdS8MBwyRpEXtsVsX0xuq3aEnfpOEPzj5SHECY2QNYOKkf+Y3Z:NqdSdzvEXanUEPzj5MdY2mKu+Y
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral19 behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20