20d10e741e4e96e2598b104740f7a71875e67a64fe5f3be2fcb54a518ab4fab2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
6d56f478df932204bcf02bf454aea839_JaffaCakes118
Size 916KB
Sample240524-e5z7eadd43
SHA256 20d10e741e4e96e2598b104740f7a71875e67a64fe5f3be2fcb54a518ab4fab2
MD5 6d56f478df932204bcf02bf454aea839
SHA1 9ca213836edea24fc305afab08f1f903ec6347ec
SHA512 1bc69777a9b5220e1c26a1a2b529a103434c532d26f76f19ea8e80ae015ffc9bd6dc4c98ab5ec9d16001dd7769e91921df55ada39c2833745b33ae960e7f8ecc
SSDEEP 12288:OxpJMyVWJ0q4kfS6wKhmcRf6vEh7+KAFgtp51idtDWEqOWtVr2/NoPH48:6panJ0ZkKIh7mFgfidtDWEn20/No
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion execution trojan upx

Malware Config

Targets

- Target
  6d56f478df932204bcf02bf454aea839_JaffaCakes118
- Size 916KB
- SHA256 20d10e741e4e96e2598b104740f7a71875e67a64fe5f3be2fcb54a518ab4fab2
- MD5 6d56f478df932204bcf02bf454aea839
- SHA1 9ca213836edea24fc305afab08f1f903ec6347ec
- SHA512 1bc69777a9b5220e1c26a1a2b529a103434c532d26f76f19ea8e80ae015ffc9bd6dc4c98ab5ec9d16001dd7769e91921df55ada39c2833745b33ae960e7f8ecc
- SSDEEP 12288:OxpJMyVWJ0q4kfS6wKhmcRf6vEh7+KAFgtp51idtDWEqOWtVr2/NoPH48:6panJ0ZkKIh7mFgfidtDWEn20/No
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

evasion trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BrowserControl.lua
- Size 4KB
- SHA256 40458af79f4fe53dba5f526e5442df47454ee8ebd21be1063d6706f87ac40e15
- MD5 3e3f492cc3a33b452bd8c6a1c611856b
- SHA1 3b24b28852dc2cd26fc0586ce7d3f0f91bb2d0c6
- SHA512 3a190e92be927a3393713b5a40a049ad8e4fc493225d3536a1b3ad26693202622f88d5ce2b3b24f23bb61c754e8ca2682a7f884c7bbccac6f96fa9b56a0ed1a1
- SSDEEP 96:YcPFcSnAqMP6HAjidEJNMLwLzm1Bh25NsWhPEEPNeCmhLCzgtKE:YcNcSA7PNMAzm6blV3mc0tKE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $PLUGINSDIR/ButtonEvent.dll
- Size 4KB
- SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- MD5 fad9d09fc0267e8513b8628e767b2604
- SHA1 bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA512 b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/DownloadList.lua
- Size 15KB
- SHA256 e7acd216e01c0fb299c5d42d85ccd90d579a7adf8f3eaf3da5acf447bbac80e2
- MD5 6cb4ac3d391aeae3f690e7429d152967
- SHA1 fbe6a34dc51c0c3054ab5da96eb361a9580c3ef2
- SHA512 1a08c6f3e948846a9b5e89b47573cb97f9cf6d00c61bee6a53f9cfe49b7e8b19a7df0ed1ae5d693629b42528e3d23ee3e92b561408fd14743ff837d51c0bec81
- SSDEEP 192:sz4OaYdx2oaQiviapMCImuxijxU6PdrqoV4d4WUJsQO3M3SSorDGr:sGY6AMppu0xUodr6d4pvO83SlO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral7 behavioral8
- Target
  $PLUGINSDIR/FloatingProgress.dll
- Size 25KB
- SHA256 0cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741
- MD5 0f26c6d34d3841e93145dd00d0175651
- SHA1 57b068569d0eb2336503beed87589629ab2a6f1f
- SHA512 72785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5
- SSDEEP 192:1cpwREp+D1UTyFDoUjSFWbY3Lf+25meJVOuN+Sx10mvmWc4b61n:1fU8fc7fV8C+I2mw4b61n
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/GuiInit.lua
- Size 161KB
- SHA256 ab08d2313c05f9f58a3c6b6d5338e236313bdacdde469c9c7b98de7d230f31d4
- MD5 d277a99093503c0cbc86f1e29389fd7b
- SHA1 139f5e61f5b063627eb6858ae8d9e078bc06ee34
- SHA512 42c81601378f4029bd61eba735b3b772d4167afb4f5e129e5da5c7e15f694da2050f097bd9d98ea73ae146faebca70deb2b37ff6766f8ad2a74b2fa4b07e91e0
- SSDEEP 1536:N5o/mQodXHRjrSoJ817jUnBBxhmT/ORMsowLnegMzrLyi2D4pgQ78xfMs:N5oORVuoJ81Y8OLCy1s2xUs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/IntegratedOffer.lua
- Size 42KB
- SHA256 72b061dfd9621a2479a35fcf63fe3167f855fb56aff451bd15a81b997d94abae
- MD5 da573ccbab6f29e0ae7784acf49bd699
- SHA1 4bab4651f2fedd61d7f454bd3e4c8a081ccdbda5
- SHA512 eb9d837a3ac3507c6836d613875fe7532c4f48c21997259076c47157b16d3d2c372cb28d925f79d50ae42ab945f9baffebc71af34d354a77410033018adc38c1
- SSDEEP 384:52KtdoVClYfeDhqqUKWE+BzVQ16YJDAkOw2LkrtAIK2KDwqy8Z/JQ4q29TDX:52W8ClYfe9UTE+pG6/yrt+vyO/1X
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/LuaBridge.dll
- Size 56KB
- SHA256 43da5c772a9be1b0699c5515261f643bb02348c1da3485ce307a80f703e4bf79
- MD5 37a354de9f7a50c63eb0ced75f32c0c8
- SHA1 2a3a41ff3986486c76ea8cbf24bc8a12562e3c79
- SHA512 0b395ef942aaf57cdd93134f1cdb897bc4b2a543ad7590efeee28d821a73fadc483952de37c3171b0975c66fc2c42b164e4ce3fb7691a02baf69051ab71ad928
- SSDEEP 1536:30Puiz5IiFmrhCdzUEpxSRIpKm4yT1u8Dx/Q0+rZN:EmiFZG2xpbVuUx/Q0EN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/LuaSocket/lua/ltn12.lua
- Size 8KB
- SHA256 b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
- MD5 e440044afe6c761507a996b5b45ab0f9
- SHA1 ef772c758fd5d6098b41375f35ac26f3963cc306
- SHA512 8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
- SSDEEP 192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/LuaSocket/lua/mime.lua
- Size 2KB
- SHA256 e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
- MD5 4bfdaaab9014fe129bc6388fd5687c8f
- SHA1 2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
- SHA512 3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/LuaSocket/lua/socket.lua
- Size 4KB
- SHA256 15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
- MD5 74dbe1060e91112e1c21ef9870b4a587
- SHA1 86afb6aecb0a8387ffa5dead1cc9808332f94310
- SHA512 73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
- SSDEEP 96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/LuaSocket/lua/socket/ftp.lua
- Size 9KB
- SHA256 9ba5df91091c46f0ffe0a93ace577a4833c92cbec1742113d0a2da9e568f9a10
- MD5 7309f4294ae4abb4f6ae657b2a98d488
- SHA1 327d143e9f7a1835a58fdaf569a8f7a937fcf2c0
- SHA512 a44d2603af63828e8a0b1fbc7455305c616e5bae4a351b429e7e94a6aa7e4d6425f69d57d6a44ba87ee5d29accfc01c1f3ff288652120ff8f08a66543d357895
- SSDEEP 192:GsooRaLonJfMxBs6gZO2zMAcTcGZqxOU6iOeBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7U6iOeBRkfYtW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/LuaSocket/lua/socket/http.lua
- Size 12KB
- SHA256 04e6a7526ed1dc51f4d1f9b25b56f0c7826367ae3f2468a8622e359663ee5526
- MD5 0eb1f0ffcb4dd17c22b20a3d7d6654db
- SHA1 bae3d2be867f62c5f8d7e769248f053c50a1ab8d
- SHA512 f9362cb8a84312aa3f12c93fa268f5950ebd575abb54f3778a5f3aa935e1c7685b7bf78e8a6a3eabe67094914ec90143ecdd384a4341f000fda41b686b486d97
- SSDEEP 384:x7/thyc+f7zLajrZhVoaOt2yyVizJvcGwkD:F/thyc+f7zyoaOt2yqizJLvD
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/LuaSocket/lua/socket/tp.lua
- Size 3KB
- SHA256 343afa62f69c7c140fbbf02b4ba2f7b2f711b6201bb6671c67a3744394084269
- MD5 2cad406e591cade482c7f16f39c21481
- SHA1 84a3ab88ff7a9102c2c6d21bdb6eede6862167a4
- SHA512 ecc98991c25036b54f2bb71b3229e4bc8fb401e55db0e5f9c958c2a7b00b40fc9ae2d7e45002d4f2a03cec85535785c42ab6d20476fe095a76444d143493b145
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/LuaSocket/mime/core.dll
- Size 52KB
- SHA256 a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
- MD5 4a4845ba1666907f708c9c10a31ec227
- SHA1 1ebf626adc84147e5114885ce779f92d6eb68f3a
- SHA512 d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
- SSDEEP 768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  $PLUGINSDIR/LuaSocket/socket/core.dll
- Size 80KB
- SHA256 bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
- MD5 4bf7db111acfa7c28ad36606107b3322
- SHA1 6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
- SHA512 0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
- SSDEEP 768:4pOz0XSP1hSt5+5lKfZyDy3TygCk749NRAa1YwqJlfp8iB9jDEu/s5RPOothtlRp:wOws14t5CeTygmNRA0IVh05IoN3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanupx

behavioral2

evasiontrojanupx

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32