3e9577a0042aa60a8be5cc4f7d61b196131e1d030921347f7cc251246a2ea389 | Triage

Sharing

General

Target

34a441b56b65b26881f89a337949e12e_JaffaCakes118
Size

576KB
Sample

240511-px4vqsgd5z
MD5

34a441b56b65b26881f89a337949e12e
SHA1

f84e17d58f6d7a61edb61b5244a6785367380eb7
SHA256

3e9577a0042aa60a8be5cc4f7d61b196131e1d030921347f7cc251246a2ea389
SHA512

824c34267dfc53dc6dfecb6d14846de9608b967d249eb14cd9e42e1440e80c42198309a18ec3cfb8c36cc426118088b9a9ca8b76d4b0a1015d6a248925db495c
SSDEEP

12288:TYQxt2ctKQEGvjITZD+jcEckHnyudpc5y/zDnYDBrfw8A:TlxIQEMIT5dAzc5y/zUDBr

Score

7^/10

evasion execution trojan upx

Malware Config

Targets

- Target
  
  34a441b56b65b26881f89a337949e12e_JaffaCakes118
- Size
  
  576KB
- MD5
  
  34a441b56b65b26881f89a337949e12e
- SHA1
  
  f84e17d58f6d7a61edb61b5244a6785367380eb7
- SHA256
  
  3e9577a0042aa60a8be5cc4f7d61b196131e1d030921347f7cc251246a2ea389
- SHA512
  
  824c34267dfc53dc6dfecb6d14846de9608b967d249eb14cd9e42e1440e80c42198309a18ec3cfb8c36cc426118088b9a9ca8b76d4b0a1015d6a248925db495c
- SSDEEP
  
  12288:TYQxt2ctKQEGvjITZD+jcEckHnyudpc5y/zDnYDBrfw8A:TlxIQEMIT5dAzc5y/zUDBr
Score

7^/10

evasion trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BrowserControl.lua
- Size
  
  4KB
- MD5
  
  070423fe2107d490608f66d84f0f41ec
- SHA1
  
  9193ccdcd502ce7bf2996149f6c437e0bda6b981
- SHA256
  
  b9d4b9ade4d9af682152cc9747bc134dc6414a7b3145de93ac1e37d5ba13f193
- SHA512
  
  ec8dd8e60f62392005b08baa00a65971ecd13aa98df5a3165c1ef55b2d008e8b82995d30037077ea2ad11d0049622d615696eec6c4d7b7c109691758bb6cf4d4
- SSDEEP
  
  96:YcPFcSnAqMP6HAjidEJNMIwLzm1Bh25NsWhPEEPNeCmhLCzgtP:YcNcSA7PNMjzm6blV3mc0tP
Score

3^/10

execution
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/BundleInstall.lua
- Size
  
  10KB
- MD5
  
  1fcda96f2173c31990e895c08a08ec6b
- SHA1
  
  22719ee66aaa898d84eb0176036914c5fb2acc89
- SHA256
  
  7cbb964affa7e46326c44b65e71edda94e3c5e23b2dbba6869e3b3566a2f042d
- SHA512
  
  022f2997a5c743e29942d9e5ae1dc69f0557f2e9d0bca44f397ee9ca862b99bb4d2d1039397619ae87208613a70b79b040b7b2615caf81ee5814ce32e0958132
- SSDEEP
  
  192:wPRXwtq5QCSvwJrhOCYI8LIdz0zSV2uEZSk4Mz6p51QC:ayZCMwRhxYI+IdQJXskygC
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/ButtonEvent.dll
- Size
  
  4KB
- MD5
  
  fad9d09fc0267e8513b8628e767b2604
- SHA1
  
  bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA256
  
  5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- SHA512
  
  b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/CallbackProxy.lua
- Size
  
  5KB
- MD5
  
  412e9a95b337edd51aa3ab78f55d1c2d
- SHA1
  
  abe08ab1394eca8fea5b9b80543aed81b4ae52f9
- SHA256
  
  cf8d7d1866b230881f8b70b992c24fdd4dc3f52c7a761be1211e3d5371a48a9e
- SHA512
  
  f393433319a86d976f7607d4b2f4d65f6753a9b854b9e1a60d7c327e5911bff8ed2ad7224e29b4e245ab2646141fd528bedeba97a57c7753eb2a53cf46f52454
- SSDEEP
  
  96:JqO1UsvH0vChw1x6PtVz4MAlK9Ru/Jq1QGstqiMSJMq89L9RAJR16/gC:JqObvH0vChDPDJ9RP2GsDFJH89ZRAJQ
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/DownloadList.lua
- Size
  
  11KB
- MD5
  
  cea93aee4ae392ff6c8f060c85628e47
- SHA1
  
  ad8612d6eb42d1c98f777770e23b06b003a0a850
- SHA256
  
  9f50052623dd77c35f530e2abc9873aa7efc68f232f312a017938b39cc0ae23d
- SHA512
  
  2899a03f5428ccb0115dbafefa29b0628a5e77fcc603d612deafcb667fdf53d8f105263e320653b1a7fc52a1f717285c4dce7b4c5c2f65318fb3c4e497c0c6b5
- SSDEEP
  
  192:ezEiapMCIJxGlQ6Pdrq84V4WUJsQO3M3SSorDGz:eJMpkUlQodr+V4pvO83SlW
Score

3^/10

execution
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/Downloads.lua
- Size
  
  9KB
- MD5
  
  1b8676b00e0dd309ac33bcb2a72c2da0
- SHA1
  
  2d744d48fc50d805c39a6889c8938d71d7d6f686
- SHA256
  
  a8b64d8438e0ceb6f97818dc657f6a6772c34536411fe59e91edf08a522b9728
- SHA512
  
  58bd8748d52a3f21cb121134b34632b12943496a3535d3e7244251bdcb9f1a333d4dfde5aa9bb43aeac420dde79d286d93e04341cfb4b6e507bc30e394040699
- SSDEEP
  
  192:ZZTESfvMF2y5qWxrpzrclIRjQEAeekUrAgYfYpV0xU89bKuL+x3QiG02gE3VJ4oX:ZZTEGkEOq4rVIWlQEne7rdYfYpaxU89N
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/EagerInstall.lua
- Size
  
  4KB
- MD5
  
  7a9880aaa30616f0fe73423da4889e3b
- SHA1
  
  a5eea44b8ef3902a3b7711d49ab30a9c633772c9
- SHA256
  
  5f4dcaa517b0d7daa524367e02c6c7cdb5c77c00a24885063915f546264d8cba
- SHA512
  
  700035ae72d45e58a4cad8ec6132a3ad7add1cbfc6d76df5ad57478bdc21bcf1e8537b25b7a1d9ab5994001ea5a4eabc4409f67b3454fe6311dc432358616323
- SSDEEP
  
  96:+35KStAOUYLzvg30K6I8/uvfQOpOL6c1Gr/m:UqOPng3J6I5QOHK
Score

3^/10

execution
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/FloatingProgress.dll
- Size
  
  25KB
- MD5
  
  0f26c6d34d3841e93145dd00d0175651
- SHA1
  
  57b068569d0eb2336503beed87589629ab2a6f1f
- SHA256
  
  0cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741
- SHA512
  
  72785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5
- SSDEEP
  
  192:1cpwREp+D1UTyFDoUjSFWbY3Lf+25meJVOuN+Sx10mvmWc4b61n:1fU8fc7fV8C+I2mw4b61n
Score

3^/10
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/GuiInit.lua
- Size
  
  129KB
- MD5
  
  b8dc8b2500e4cb5e5329e761740c71c1
- SHA1
  
  a0a8f366e68ddf1d4cb5548340f7e579e7313e10
- SHA256
  
  3a93e32e8d4b162ebb7da103841ace2c74b78a6929934fcedc9737a039305993
- SHA512
  
  05474c13138c20230cc4a13a29b86c8e078f51cdf2633f06e94da7087d2d96c74da051458d90f0cc1c1faca8989f5584eaac97ef20941d24459f70231ccebd8e
- SSDEEP
  
  1536:bkQyytIR7xHoO85/07IQeBADmTWO3b+aYw2KKNrGLyi2D7fxjfFs:g62doO8WdOZy11ds
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/LuaBridge.dll
- Size
  
  39KB
- MD5
  
  1351244af9ca179c9081eda09662e904
- SHA1
  
  ca6667dd78b0435638dc00c7cc2a5667705b1905
- SHA256
  
  f70662193cf298b798a6c6535ef8f04779c1a2a7c9e26bd0db9c0659081b561b
- SHA512
  
  9cbddafee5c6db33cd3405ae26af063271db1022dc8923aa94d486c89fc666c0487a65a4ddce18688a5e6a08a1743accbe1302229edbc809cd88470afa6e3074
- SSDEEP
  
  768:/CBohqsJ6O1WAhBLQjtR5QYDibH2/ZZDsrj2qeQ4pXDHWPX:6oA46O1Zt2r5xmH2/ZVsT
Score

3^/10
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/LuaSocket/lua/ltn12.lua
- Size
  
  8KB
- MD5
  
  e440044afe6c761507a996b5b45ab0f9
- SHA1
  
  ef772c758fd5d6098b41375f35ac26f3963cc306
- SHA256
  
  b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
- SHA512
  
  8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
- SSDEEP
  
  192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/LuaSocket/lua/mime.lua
- Size
  
  2KB
- MD5
  
  4bfdaaab9014fe129bc6388fd5687c8f
- SHA1
  
  2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
- SHA256
  
  e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
- SHA512
  
  3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket.lua
- Size
  
  4KB
- MD5
  
  74dbe1060e91112e1c21ef9870b4a587
- SHA1
  
  86afb6aecb0a8387ffa5dead1cc9808332f94310
- SHA256
  
  15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
- SHA512
  
  73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
- SSDEEP
  
  96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/ftp.lua
- Size
  
  9KB
- MD5
  
  7309f4294ae4abb4f6ae657b2a98d488
- SHA1
  
  327d143e9f7a1835a58fdaf569a8f7a937fcf2c0
- SHA256
  
  9ba5df91091c46f0ffe0a93ace577a4833c92cbec1742113d0a2da9e568f9a10
- SHA512
  
  a44d2603af63828e8a0b1fbc7455305c616e5bae4a351b429e7e94a6aa7e4d6425f69d57d6a44ba87ee5d29accfc01c1f3ff288652120ff8f08a66543d357895
- SSDEEP
  
  192:GsooRaLonJfMxBs6gZO2zMAcTcGZqxOU6iOeBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7U6iOeBRkfYtW
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/http.lua
- Size
  
  12KB
- MD5
  
  c392297e9dd9c24f6b3743ee3c64732e
- SHA1
  
  04f1f88da966e0e307cb64e1bc74a6f7e83a0538
- SHA256
  
  ef4ad174f5d156c044c3f92b7a70d7937a018c3eaecba9e08f272c800d10a707
- SHA512
  
  51fc9a7278a68502ee8b88d1f913719283d65e07e614393b159ec1d4ec06af60de5eb0b4220abcea95d6493d45d35e48f3f9ff43bf56200cd59ba02714bdd1f9
- SSDEEP
  
  384:x7/thyc+f7zLajrZhVoaOt2yyVizDvcGwkD:F/thyc+f7zyoaOt2yqizDLvD
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanupx

behavioral2

evasiontrojanupx

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32