Overview

overview

7

Static

static

7

JaffaCakes...d5.exe

windows7-x64

7

JaffaCakes...d5.exe

windows10-2004-x64

7

$PLUGINSDI...SC.dll

windows7-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...rs.dll

windows7-x64

3

$PLUGINSDI...rs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

5

$PLUGINSDI...on.dll

windows10-2004-x64

5

$PROGRAMFI...er.exe

windows7-x64

3

$PROGRAMFI...er.exe

windows10-2004-x64

3

$PROGRAMFI...32.dll

windows7-x64

3

$PROGRAMFI...32.dll

windows10-2004-x64

3

$PROGRAMFI...en.dll

windows7-x64

3

$PROGRAMFI...en.dll

windows10-2004-x64

3

$PROGRAMFI...ce.exe

windows7-x64

1

$PROGRAMFI...ce.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_991cfb1a1d10405409631afc67583fd5

  • Size

    518KB

  • Sample

    250330-zvpcdayrv9

  • MD5

    991cfb1a1d10405409631afc67583fd5

  • SHA1

    a5b33924231bbce1284753f910eeae5bc822ca85

  • SHA256

    87446a4e1056b7302a7bf9a0d96f62c7dee29180172ca20cbf6e0a5722baaeef

  • SHA512

    8d3ce53254075f2450503a49dc081849ca0af5e07aaad193d70176cfc8a82c5e09105b6d9df72b77a786c2869d59f3ab2a0246c37b2f49901a4328265c4535fa

  • SSDEEP

    12288:57bItJ8rSLE+aoukeIyc5+h3bznUItJqT1XWc8:570z82LEmMDhbznrzqT1Xd8

Score
7/10
discoveryupx

Malware Config

Targets

    • Target

      JaffaCakes118_991cfb1a1d10405409631afc67583fd5

    • Size

      518KB

    • MD5

      991cfb1a1d10405409631afc67583fd5

    • SHA1

      a5b33924231bbce1284753f910eeae5bc822ca85

    • SHA256

      87446a4e1056b7302a7bf9a0d96f62c7dee29180172ca20cbf6e0a5722baaeef

    • SHA512

      8d3ce53254075f2450503a49dc081849ca0af5e07aaad193d70176cfc8a82c5e09105b6d9df72b77a786c2869d59f3ab2a0246c37b2f49901a4328265c4535fa

    • SSDEEP

      12288:57bItJ8rSLE+aoukeIyc5+h3bznUItJqT1XWc8:570z82LEmMDhbznrzqT1Xd8

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/SimpleSC.dll

    • Size

      61KB

    • MD5

      d63975ce28f801f236c4aca5af726961

    • SHA1

      3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

    • SHA256

      e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

    • SHA512

      8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

    • SSDEEP

      1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/ToolkitOffers.dll

    • Size

      245KB

    • MD5

      3c6a9490f32cf8aca12252188874dade

    • SHA1

      4df69fe59c10f2cd6de472e5fc05eed5a489998b

    • SHA256

      89ebab8d0675d7b79a3d0a455ec55d0b87aa0804cfd092e30f3d1142f0ce1109

    • SHA512

      e8ce3378bb4cfb95cbe5ea0ad83fbf8e129cdfa0e724346b789c3f43c76b8a81d85b1c1b1c1c3fe7de0bf2b00e3c8fe485b2d784d8bbaf2221faa2ce20aa6be5

    • SSDEEP

      3072:hb0VmAw9fh4OZGsz7dFG3plCyUSSOpITbI/o29OzU+VYeEuaQWkMx0mBo:hb0ont+PXCypeQgyDZQWbnBo

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      acc2b699edfea5bf5aae45aba3a41e96

    • SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    • SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    • SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • SSDEEP

      96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/version.dll

    • Size

      6KB

    • MD5

      ebc5bb904cdac1c67ada3fa733229966

    • SHA1

      3c6abfa0ddef7f3289f38326077a5041389b15d2

    • SHA256

      3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

    • SHA512

      fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

    • SSDEEP

      96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9

    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral11behavioral12

    • Target

      $PROGRAMFILES/SoftwareUpdater/AppsUpdater.exe

    • Size

      98KB

    • MD5

      feb6acf13060d20705f1c30ba6e35254

    • SHA1

      62d950ddd65fbf0d62dbddd9ad8d520ddb8d85e0

    • SHA256

      c998944a3203bd2f80c8844c56d84abf9af2cb7a624be09eb373691bdeed3981

    • SHA512

      62cb4a96ed197c8bece71b20a3a9fda0692fab3279e943a72bc37b7c1494f145c16353e36e0594799fc613585004ef250fe7450d85e17cbdb96132e9da18d8da

    • SSDEEP

      3072:A4BD4B0wxpH0b9HT6dmRfSp52S/W6W4B1:++T6EIpW0

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PROGRAMFILES/SoftwareUpdater/Interop.Shell32.dll

    • Size

      48KB

    • MD5

      6d3eebe3b94b5c98467d7111bcba269f

    • SHA1

      322e2fa9968071f0f2c0a82e6e5dea71c638d706

    • SHA256

      46cadda3634354330ff142e19b7435e77a8fdf4fd08a6f18fa585e2b6e66e5ea

    • SHA512

      e902a522035a74b0edfce0f16f675e80ef713d5d10e8906c801f2cea90be4a97edae90fb45b1d3d43ccbe44c857dcea39fb50ffa2b9737bcec2a131519e1b4b5

    • SSDEEP

      768:wexl81nX6ZxlvUAa7KoBv7epginbCe7AXjuw9tL0Duxj7tr+Br+FHy:wexl81nK34PJepgqcVzhy

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PROGRAMFILES/SoftwareUpdater/KeyGen.dll

    • Size

      89KB

    • MD5

      cf1883c51729f269147a51f43e53976c

    • SHA1

      349b4f6a2732c60230953a771a3e313ec510acda

    • SHA256

      9a4d42a0b25bb63daeed0cbb044867f9b90e00f1870e9b93fac5f9746eefdaa0

    • SHA512

      1dcc7e303826f5b0c4ea896199bfa1bb9d446becb4e1e7da04bc3e59527bc6ca0260d67fec5642252f7b4cbaafcc8319410ca181e66375e2d92e08ac6c7afa2e

    • SSDEEP

      1536:Bb0VLMwT0o38GGDd+PcLZsWjcdOkW9GRwy3:Bb0VWopGDd+0mO79GRwy3

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $PROGRAMFILES/SoftwareUpdater/UpdaterService.exe

    • Size

      31KB

    • MD5

      4c26cd40c0ce9b443e9d35401b2154ba

    • SHA1

      7199b4c90cbc3afc9b02f21987cba50cacef3bab

    • SHA256

      5f97cc5d8a6d138af535c3c98634d6c7612768bfd3a3ccab7bc5a449570d24b6

    • SHA512

      e86505826038e60251a14ba1f4ee93b0fa0f9ed727bf9bf1fd89921ad5d13395296a429c365ce06e5c39483465cec7b4031d627c902dfce3c05d6f5b0c3f883f

    • SSDEEP

      768:1DIEPyPXEohNzb8hrdmEe+YEvvVYcq42:ZzysAz4hB17vv44

    Score
    1/10
    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks