b157fd3064fc77b986f5333b9f0b898c5ea3677f1434fb8ca2369e18b43af166 | Triage™

Login
Reports

Overview

overview

7

Static

static

7

21722a110b...18.exe

windows7-x64

7

21722a110b...18.exe

windows10-2004-x64

7

$PLUGINSDI...el.dll

windows7-x64

7

$PLUGINSDI...el.dll

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$TEMP/SDM1...er.dll

windows7-x64

7

$TEMP/SDM1...er.dll

windows10-2004-x64

7

$TEMP/SDM1...es.exe

windows7-x64

7

$TEMP/SDM1...es.exe

windows10-2004-x64

7

$TEMP/SDM1...er.dll

windows7-x64

1

$TEMP/SDM1...er.dll

windows10-2004-x64

3

$TEMP/SDM1...er.exe

windows7-x64

1

$TEMP/SDM1...er.exe

windows10-2004-x64

1

$TEMP/SDM1...ll.dll

windows7-x64

7

$TEMP/SDM1...ll.dll

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
21722a110bb1e6b58669826818f86cda_JaffaCakes118
Size 1.2MB
Sample240507-yfrnhsfa32
SHA256 b157fd3064fc77b986f5333b9f0b898c5ea3677f1434fb8ca2369e18b43af166
MD5 21722a110bb1e6b58669826818f86cda
SHA1 314fb1740ce849295e5c34f71671cf631853872f
SHA512 4b30a12909ed2149e7a076d4b287d19b0fa012365decfe8aef989f330157d8505d1cd0e639127d1a977e8e3a361bd33300662a3ebb0edc8cc23dbd62e7180b5e
SSDEEP 24576:oDX2vzptbfKL1oX1Y5wrrRsrW7RdYxMn4iuKbQaqfQN+Qfsqo:QGvz5Xa0Nsr4Qx64qfqqB0qo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence spyware stealer upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe

Resource

win7-20231129-en

windows7-x64

13 signatures

150 seconds

bootkit persistence spyware stealer upx

Behavioral task

behavioral2

Sample

21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe

Resource

win10v2004-20240419-en

windows10-2004-x64

10 signatures

150 seconds

spyware stealer upx

Behavioral task

behavioral3

Sample

$PLUGINSDIR/SelfDel.dll

Resource

win7-20240221-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/SelfDel.dll

Resource

win10v2004-20240419-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/nsExec.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/nsExec.dll

Resource

win10v2004-20240419-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

$TEMP/SDM143/ExentCtlInstaller.dll

Resource

win7-20240220-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$TEMP/SDM143/ExentCtlInstaller.dll

Resource

win10v2004-20240419-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

$TEMP/SDM143/Free Ride Games.exe

Resource

win7-20231129-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

$TEMP/SDM143/Free Ride Games.exe

Resource

win10v2004-20240419-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

$TEMP/SDM143/Splasher.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

$TEMP/SDM143/Splasher.dll

Resource

win10v2004-20240419-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

$TEMP/SDM143/cmhelper.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

$TEMP/SDM143/cmhelper.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

$TEMP/SDM143/resourceDll.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

$TEMP/SDM143/resourceDll.dll

Resource

win10v2004-20240419-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  21722a110bb1e6b58669826818f86cda_JaffaCakes118
- Size 1.2MB
- SHA256 b157fd3064fc77b986f5333b9f0b898c5ea3677f1434fb8ca2369e18b43af166
- MD5 21722a110bb1e6b58669826818f86cda
- SHA1 314fb1740ce849295e5c34f71671cf631853872f
- SHA512 4b30a12909ed2149e7a076d4b287d19b0fa012365decfe8aef989f330157d8505d1cd0e639127d1a977e8e3a361bd33300662a3ebb0edc8cc23dbd62e7180b5e
- SSDEEP 24576:oDX2vzptbfKL1oX1Y5wrrRsrW7RdYxMn4iuKbQaqfQN+Qfsqo:QGvz5Xa0Nsr4Qx64qfqqB0qo
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit persistence spyware stealer upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SelfDel.dll
- Size 5KB
- SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
- MD5 e5786e8703d651bc8bd4bfecf46d3844
- SHA1 fee5aa4b325deecbf69ccb6eadd89bd5ae59723f
- SHA512 d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3
- SSDEEP 96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
- MD5 a436db0c473a087eb61ff5c53c34ba27
- SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
- SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
- SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
- MD5 14f5984b926208de2aafb55dd9971d4a
- SHA1 e5afe0b80568135d3e259c73f93947d758a7b980
- SHA512 e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
- SSDEEP 96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $TEMP/SDM143/ExentCtlInstaller.dll
- Size 100KB
- SHA256 76814c96196776c5ed4d65b9144d66423c78fda2faa61daf87cf4c742c07551b
- MD5 6b2c9276b76ff82abc5b12626a6b3201
- SHA1 ff1c09a79230e66eb6df7f6d7848710f1acfffa1
- SHA512 20bc0e0f236bf7f4cb91dfa205b41175abe2a830d4adb9f210d2da2291ddc444c8484485c5c97a0141cfb3763b1e46542f5b211057966d85dc4d4c764e8eefe0
- SSDEEP 1536:GyrB9NViYoJ3w1NjSzF5yfBsiZpsVI2TFQblrjgZYBmmlNL9bnouy8/Dvs3h5h:19eS3sF5EsuyQgp2out/DvSh
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  $TEMP/SDM143/Free Ride Games.exe
- Size 504KB
- SHA256 18f4519d20252bf579b887adec25554ac412bd79604547cca12f9f589549f952
- MD5 23cad4075e1fd5d47c0434fef549efde
- SHA1 d7cdc7cb933466474986ae37fc7ebefdad601aaf
- SHA512 e4176411caac89db8dd073f2b47b7970168dacad4cdecc6edae310591e279149430b10ab1f956a7722ab22677ca893bfc4eb3fe17009b9b73a95e288c12c89b1
- SSDEEP 12288:0obl5KiSHoYxGZ2YI7jjN3iR4S/RQq4jrY+vyRPZbN7yTMhHoSKU:/bzKLHoV1wpwxZRsrY7RJATMP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  $TEMP/SDM143/Splasher.dll
- Size 475KB
- SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
- MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
- SHA1 add92b031eb36b26335763780df88bca58636ed7
- SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7
- SSDEEP 12288:2I2EL1NaycNyL+kNmQLnmQtMleiQ8Zceqw1:tTayPLDltMUiQ8Zceqw1
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $TEMP/SDM143/cmhelper.exe
- Size 234KB
- SHA256 93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5
- MD5 3a9774028e1e3968b8c202fd199d0084
- SHA1 6e19763c3f42c8d6596135a7566bef07a0cbeadd
- SHA512 ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06
- SSDEEP 6144:VcF3h+/MWLriz/BaQKoiQH22uhJFJoaMOKFNgv5x48yH2geFELNtgxQh:VcF3h+By/BaQKoiQHa7oG/Fh0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  $TEMP/SDM143/resourceDll.dll
- Size 171KB
- SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
- MD5 5cf0fba9e8775382233c8e63e52c838a
- SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
- SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25
- SSDEEP 3072:+ZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vg/ySQGdXMd86a30GCooutkzjO:YWwqGaJfGZ1Mq5BRj2/yR8XMZ0CooSkz
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistencespywarestealerupx

behavioral2

spywarestealerupx

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

© 2018-2026

Terms | Privacy