1107fab9ef36e6a65c3353d545ba63d022f36b0b7dafc15f5f25d3ed44ef7d5f | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
0f56264e3414b713b157a1d19b4764bb_JaffaCakes118
Size 4.6MB
Sample240503-bm46vsdd86
SHA256 1107fab9ef36e6a65c3353d545ba63d022f36b0b7dafc15f5f25d3ed44ef7d5f
MD5 0f56264e3414b713b157a1d19b4764bb
SHA1 493208206175a29f929295d46806b2e7c9af0103
SHA512 987199c39cac8b1c3752e09fa94ffebaf5f45042e68b5919a057f9d4c54752042283b74423c0bd395ff4bc63eac47500ab8ec3dcf4b9c48fe84ce7a07e9fb61f
SSDEEP 98304:eJ97nE05ldowmRIYE0UcdR1mo8ydN/wE0fddgwmpaOE0K0dpvmAkq:sdnPJowm/P1R1molwPHgwmHPNpvmG
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft execution phishing

Malware Config

Targets

- Target
  xoxo/cloud/a2/geoplugin.class.php
- Size 5KB
- SHA256 effe117fa89a3389108542ad6bd16616d3da3f5223ce130681a7cfa904a346cc
- MD5 855843d9cb173722e425fa36a67fa6d9
- SHA1 824ccc74216a122be3327a36c575e91446c76b40
- SHA512 d6f4414bcf3ec4492adaf4aec858e71af42c9abdb4f096f27843bcb9763f939452aa766fe3a74331b48f6635d24756cac31441996234c66f7a594c564041853a
- SSDEEP 96:zQapMrp1cwAzq1YZgwQIKAqh2iCYqWGXUQaVc96oAeQeLN/YoLQhyiHQG:0apMrSlgw7C2iGWGXucr9M
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral1 behavioral2
- Target
  xoxo/cloud/a2/index_files/guid.html
- Size 150KB
- SHA256 645afc59f9f878d2c96ed75e5af641c6f32f782d6d3a0d5508c87ece87d72724
- MD5 93ef6b2dc45cc3009e753c1a606ace1a
- SHA1 ec9e77ceeb0ddfd3152e0d5f347200a4d48c04fb
- SHA512 93abd92d135d90fef53e98d5f2e585052b594bd41b4a398950761246794d121c1b830045f21414765b8c9aabb708085f134ebf5c21c03206c336de25c5a4238b
- SSDEEP 3072:vW2Km0BEM7QbpDRa/9WCoGeMvrDdNuJMcjMoLxemrvpWHJa:vWFBEM7cD6wIlgJyo7BIa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  xoxo/cloud/a2/index_files/saved_resource
- Size 78KB
- SHA256 3850c356bf2fc41a38ba5b66fd8f269ed9e1be291bdd9472f1a9485e7e35d082
- MD5 b277c998abf3f611ccda874ae502f051
- SHA1 09c00054e61b50c51e5e8a89ab62b4fdb9c89562
- SHA512 fd18122c78c3be2b6446bbea36c8607f9dcc72f95011cabc4b3deed2d53080fa295ef372031e876762028961390c8c0a1a4b7ff7e6019a8d8d913e5c046e2989
- SSDEEP 1536:PmwZJxMTZ0+KOLSFXDB5aoVabRSNA1RvMbDiU5i3rjVyPjHRBpW:PmBTZ0rWSlDoS6/vMz5IQVW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral5 behavioral6
- Target
  xoxo/cloud/a2/index_files/saved_resource(1)
- Size 95KB
- SHA256 5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
- MD5 cbb11b58473b2d672f4ed53abbb67336
- SHA1 66f47b885d587aa9a6c453ae3f2c9a382e5c7ec7
- SHA512 2bb663ecf1ac1e4d9fa58dc9c2f6eea3d9ca739e353287c5aeb2da5143bdcea8219c9c5b677667df95bf65e5ef6d3d91b52ba3c466f0f0f824aa9a195d76c687
- SSDEEP 1536:eYE1JVoiB9JqZdXXe2pD3PgoIK6alrUSTJWFk/zkZ4HWLZoHsrOa99fwk6b7/Hpu:V4KZ+S3WLZICOaLfwk67qD1PaUa98Hrn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral7 behavioral8
- Target
  xoxo/cloud/a2/index_files/saved_resource.html
- Size 36KB
- SHA256 62f3db2a3bc2c47b3628bd9060929fe3a6f4d08b44987fbc637c3e0d15f14019
- MD5 0ec8647f3766b8017517328ac4154b16
- SHA1 037310184bde4430d0787b477e6bc2ec45a88c74
- SHA512 ee288c76d9241bb642e2ce8d6fdfa8602c10f9e717c4e4ba0ebc4e05490e69a48a0c36c931e926e49e7280499003f6f99e35e890f7bcabac821abcfdca6f305f
- SSDEEP 384:qav+ZgcBoU2+mrAOp/HScDlqwB9CN3uKD4wzzrXdhBW/7S7MIBoO:/tTb5p/cOc3lBe7S7H7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  xoxo/cloud/a2/index_files/tcode3.html
- Size 150KB
- SHA256 a2080970ae2d50637e0b774728c2e049f835238e0ce06664ded3697ea24253be
- MD5 9f34f9d883b7aada0e6c7853ecd23487
- SHA1 8c65e4f262017ee27594d33e8831ec2851f9b9c6
- SHA512 102d955a877723c80807cde355e9eec3e53b4bf24e4f2bbb35853699cb93a51cb5ffe0fde80d68abdf4ce0baebbb15060cb4e7d2c3fb62557e59e7751eb71c9b
- SSDEEP 3072:2W2Km0BEM7QbpDRa/9WCoGeMvrDdNuJMcjMobxemrvpWHJa:2WFBEM7cD6wIlgJyoLBIa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  xoxo/cloud/a2/main.html
- Size 61KB
- SHA256 7a9399394ad748f92b64b69920253ec1f7676079db618c10a9a42e503e895256
- MD5 d04b332f92d9f29d584c9eb4d95b9201
- SHA1 4464b60ccdb11af1682829c7be9463de1f8fe486
- SHA512 800046aca9218250542c0901c3070ac5687a6448646e6b63f0484dfafb268e259ab50c37f5a8a3a8dac03f9b64f1ed05eabb3a2e999429bbb49f3557f01a68c0
- SSDEEP 768:H59A77kuui8J75fXtCJXKzc+e3EcyGzoxOVMcmeg0bLy54ct7tl0:H59okuI5fXBcv3pzo86chg2jmw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  xoxo/cloud/main.html
- Size 1KB
- SHA256 2abfef3c7df6af64e4c40a3f55027bbd691dae1e0fc508245f28f5287c83dc21
- MD5 42b9b283e2a935bb03608bddfc4438a6
- SHA1 6d3021cba6158c587be85347fe00f9095a0af952
- SHA512 ed3f5ad3eda5be94d62f2f36a95eb378eb07551086c7ad0705ac156b0325856737aec4f8adac35c1643e067e2f6990319380415cca9b83bc0a329b6cf7f97dde
- MD5 SHA1 SHA512
Score

1^/10
behavioral15 behavioral16
- Target
  xoxo/cloud/o1/geoplugin.class.php
- Size 5KB
- SHA256 effe117fa89a3389108542ad6bd16616d3da3f5223ce130681a7cfa904a346cc
- MD5 855843d9cb173722e425fa36a67fa6d9
- SHA1 824ccc74216a122be3327a36c575e91446c76b40
- SHA512 d6f4414bcf3ec4492adaf4aec858e71af42c9abdb4f096f27843bcb9763f939452aa766fe3a74331b48f6635d24756cac31441996234c66f7a594c564041853a
- SSDEEP 96:zQapMrp1cwAzq1YZgwQIKAqh2iCYqWGXUQaVc96oAeQeLN/YoLQhyiHQG:0apMrSlgw7C2iGWGXucr9M
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral17 behavioral18
- Target
  xoxo/cloud/o1/main.html
- Size 12KB
- SHA256 6f1b9788e44b45909d5c26a18bc23768363b7b59f9c031a4fc34f2e32803ed74
- MD5 83e933d61c5b2fcbb490872a6ef39148
- SHA1 f934de25bdba15e73cbe27178543aad85ff05429
- SHA512 7cd32f3f9742e23547e0c04a7d4327e1b4e9b4da6f625c44eaddeb90bac5f167139e09d2e3d4aacc95c206cddfa14c0ac50b7308c4c12da8feee387567825537
- SSDEEP 384:uTWtFdZKsmlKiCJyV/QKcWHMxKA4xKrLtOOYwgfVEjgxMwYM:7tytTr
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

microsoft phishing
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
behavioral19 behavioral20
- Target
  xoxo/cloud/o1/main_files/boot.worldwide.0.mouse.js.download
- Size 642KB
- SHA256 6967378adf11fd24198466ed8f9b8a003166a71141290c089ee949a244d2d1c3
- MD5 48b6db3ea97baa5b215821a10cf3c0f4
- SHA1 aa00363335f2066077b25b5d324a1c254afea106
- SHA512 b9e0837cd5ec75f742835f804235615ff9ff5084c2bc6af5ac8c677a7c182416aa89f4674b47e2c668781ca80e56ed28a33e45bb2e2a4ae06793e8792319821f
- SSDEEP 12288:QhqrxkG9ApRZbINE1CEJS8Ju58sj0XHmUlf+5x6Ere9hCunfh4dXy:QhqrxB9A3Zb1CEJS8Ju58sj0XHmUlf+e
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral21 behavioral22
- Target
  xoxo/cloud/o1/main_files/boot.worldwide.1.mouse.js.download
- Size 639KB
- SHA256 772c5ef34bbffb68dbc52564769fbd47ef61235baee31bc3dfa08922638fff98
- MD5 99c73189a064e9bfa332198e9304537d
- SHA1 bc484587b9c56134ad2efeb7f086e5138040e261
- SHA512 86c92da657382c037ecd0b8c7a5fd1873c7b2f4ae6edc0413609efb025c78c4d69f1c4b596e5b24586d55a6c0208a0af5e56046607a4dab27e6d64ac713cdca1
- SSDEEP 12288:hb4SlnrKGQYJo+xUTBypBUkVkZWBeMzcj6T1ZkQ1:hb4Sl+AJoEU+UkV/g6T191
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral23 behavioral24
- Target
  xoxo/cloud/o1/main_files/boot.worldwide.2.mouse.js.download
- Size 642KB
- SHA256 4b353eb0c195c6da19d5c17db5f70ef602810e78205b2bd6116aa529777470ea
- MD5 5673665efaac4ac08cf1ab71145e5082
- SHA1 81e83b120a8973b09a4f1d0a82c005fd266c58ec
- SHA512 d22c55073239f5166863c67f5cdea30784d79253779fa0d434df5e1b165a403c70413f68e734cc2afcf0a2f596a08815d1da2d10c2681e1ded8ee9a940d0dc8c
- SSDEEP 12288:IfUhQzLGb2+b7I+2bdopqplPetaHHimaFnFB0mVWWcA:IfUhTb2Wl4KqfPetaHH7aNFB7VpcA
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral25 behavioral26
- Target
  xoxo/cloud/o1/main_files/boot.worldwide.3.mouse.js.download
- Size 640KB
- SHA256 0f4e28725a464c260dafaf8d1edbc59734d4f6e78f621ba489d9e3b5c0451558
- MD5 b61e682d16bdacb7667065eea4f8398c
- SHA1 a0834461c34820f78bee441e9922a14d0570c4bf
- SHA512 9e9d003187cf2efb64cec8a99f93666452f29147cdc4ee73da0b11c3be30da4356847d9765ab6d088e28e0987473ff24dab1c9fa6b65fc1954c4f9fe64fb4349
- SSDEEP 12288:HddKdVEVKbuLs12zDbME123EsHFgYt4FUC:knA8zqUC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral27 behavioral28
- Target
  xoxo/cloud/o1/main_files/convergedlogin_pcore.min.js.download
- Size 326KB
- SHA256 57b8d60c04d8c3d975b055f4f072a5b4c7825291515b59f57d2394188879174d
- MD5 67e4414e23e418492d59b159616e4a7f
- SHA1 20a5f132b785a8cb638d606635fcae7d49fb0ce2
- SHA512 60b697ee084ed892bf6f8a335f3defeb986dd7b1a6c597ac06b321b92de142c8ee3a124cf264103a2bda5df68c7face338906ea57c6327ae599dcabccbb61cd6
- SSDEEP 3072:2jxTeuHKA9YWLNlhX0h0Q/t6M0ZFRpKl2LHtyIviyaS46GmCjqVc74SOr3Zar6ed:kL7Ys7A5flUGyaSBc7+3/2j47Y0oBh
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral29 behavioral30
- Target
  xoxo/cloud/o1/main_files/convergedloginpaginatedstrings-en.min.js.download
- Size 10KB
- SHA256 234fafa3318094ce122bfa1852f5e53335f75f19a03122e5b16e4bc453d36758
- MD5 c19bea1e1cefa698833ef55b5ee74e73
- SHA1 35c93f5b33dd148db5c9ac551ff795a28e636f00
- SHA512 0920d3fc8dd78d25d5f1278760ff32eb23f98455949c0dee4067ba45b4104b9314b5170fbd8d9039066c10d3bdc2af8cd9e3b2e4a6fef490ec537991c3931c7b
- SSDEEP 192:0tZVbAHZFtke38XQxCB7cfOTFckcj8sFtOErU+B/nemNh0n:iZpAH3vcB7cfOTFckcdFtOEFtD0n
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

microsoftphishing

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32