20d10e741e4e96e2598b104740f7a71875e67a64fe5f3be2fcb54a518ab4fab2 | Triage

Sharing

General

Target

6d56f478df932204bcf02bf454aea839_JaffaCakes118
Size

916KB
Sample

240524-e5z7eadd43
MD5

6d56f478df932204bcf02bf454aea839
SHA1

9ca213836edea24fc305afab08f1f903ec6347ec
SHA256

20d10e741e4e96e2598b104740f7a71875e67a64fe5f3be2fcb54a518ab4fab2
SHA512

1bc69777a9b5220e1c26a1a2b529a103434c532d26f76f19ea8e80ae015ffc9bd6dc4c98ab5ec9d16001dd7769e91921df55ada39c2833745b33ae960e7f8ecc
SSDEEP

12288:OxpJMyVWJ0q4kfS6wKhmcRf6vEh7+KAFgtp51idtDWEqOWtVr2/NoPH48:6panJ0ZkKIh7mFgfidtDWEn20/No

Score

7^/10

evasion execution trojan upx

Malware Config

Targets

- Target
  
  6d56f478df932204bcf02bf454aea839_JaffaCakes118
- Size
  
  916KB
- MD5
  
  6d56f478df932204bcf02bf454aea839
- SHA1
  
  9ca213836edea24fc305afab08f1f903ec6347ec
- SHA256
  
  20d10e741e4e96e2598b104740f7a71875e67a64fe5f3be2fcb54a518ab4fab2
- SHA512
  
  1bc69777a9b5220e1c26a1a2b529a103434c532d26f76f19ea8e80ae015ffc9bd6dc4c98ab5ec9d16001dd7769e91921df55ada39c2833745b33ae960e7f8ecc
- SSDEEP
  
  12288:OxpJMyVWJ0q4kfS6wKhmcRf6vEh7+KAFgtp51idtDWEqOWtVr2/NoPH48:6panJ0ZkKIh7mFgfidtDWEn20/No
Score

7^/10

evasion trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BrowserControl.lua
- Size
  
  4KB
- MD5
  
  3e3f492cc3a33b452bd8c6a1c611856b
- SHA1
  
  3b24b28852dc2cd26fc0586ce7d3f0f91bb2d0c6
- SHA256
  
  40458af79f4fe53dba5f526e5442df47454ee8ebd21be1063d6706f87ac40e15
- SHA512
  
  3a190e92be927a3393713b5a40a049ad8e4fc493225d3536a1b3ad26693202622f88d5ce2b3b24f23bb61c754e8ca2682a7f884c7bbccac6f96fa9b56a0ed1a1
- SSDEEP
  
  96:YcPFcSnAqMP6HAjidEJNMLwLzm1Bh25NsWhPEEPNeCmhLCzgtKE:YcNcSA7PNMAzm6blV3mc0tKE
Score

3^/10

execution
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/ButtonEvent.dll
- Size
  
  4KB
- MD5
  
  fad9d09fc0267e8513b8628e767b2604
- SHA1
  
  bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA256
  
  5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- SHA512
  
  b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/DownloadList.lua
- Size
  
  15KB
- MD5
  
  6cb4ac3d391aeae3f690e7429d152967
- SHA1
  
  fbe6a34dc51c0c3054ab5da96eb361a9580c3ef2
- SHA256
  
  e7acd216e01c0fb299c5d42d85ccd90d579a7adf8f3eaf3da5acf447bbac80e2
- SHA512
  
  1a08c6f3e948846a9b5e89b47573cb97f9cf6d00c61bee6a53f9cfe49b7e8b19a7df0ed1ae5d693629b42528e3d23ee3e92b561408fd14743ff837d51c0bec81
- SSDEEP
  
  192:sz4OaYdx2oaQiviapMCImuxijxU6PdrqoV4d4WUJsQO3M3SSorDGr:sGY6AMppu0xUodr6d4pvO83SlO
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/FloatingProgress.dll
- Size
  
  25KB
- MD5
  
  0f26c6d34d3841e93145dd00d0175651
- SHA1
  
  57b068569d0eb2336503beed87589629ab2a6f1f
- SHA256
  
  0cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741
- SHA512
  
  72785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5
- SSDEEP
  
  192:1cpwREp+D1UTyFDoUjSFWbY3Lf+25meJVOuN+Sx10mvmWc4b61n:1fU8fc7fV8C+I2mw4b61n
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/GuiInit.lua
- Size
  
  161KB
- MD5
  
  d277a99093503c0cbc86f1e29389fd7b
- SHA1
  
  139f5e61f5b063627eb6858ae8d9e078bc06ee34
- SHA256
  
  ab08d2313c05f9f58a3c6b6d5338e236313bdacdde469c9c7b98de7d230f31d4
- SHA512
  
  42c81601378f4029bd61eba735b3b772d4167afb4f5e129e5da5c7e15f694da2050f097bd9d98ea73ae146faebca70deb2b37ff6766f8ad2a74b2fa4b07e91e0
- SSDEEP
  
  1536:N5o/mQodXHRjrSoJ817jUnBBxhmT/ORMsowLnegMzrLyi2D4pgQ78xfMs:N5oORVuoJ81Y8OLCy1s2xUs
Score

3^/10

execution
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/IntegratedOffer.lua
- Size
  
  42KB
- MD5
  
  da573ccbab6f29e0ae7784acf49bd699
- SHA1
  
  4bab4651f2fedd61d7f454bd3e4c8a081ccdbda5
- SHA256
  
  72b061dfd9621a2479a35fcf63fe3167f855fb56aff451bd15a81b997d94abae
- SHA512
  
  eb9d837a3ac3507c6836d613875fe7532c4f48c21997259076c47157b16d3d2c372cb28d925f79d50ae42ab945f9baffebc71af34d354a77410033018adc38c1
- SSDEEP
  
  384:52KtdoVClYfeDhqqUKWE+BzVQ16YJDAkOw2LkrtAIK2KDwqy8Z/JQ4q29TDX:52W8ClYfe9UTE+pG6/yrt+vyO/1X
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/LuaBridge.dll
- Size
  
  56KB
- MD5
  
  37a354de9f7a50c63eb0ced75f32c0c8
- SHA1
  
  2a3a41ff3986486c76ea8cbf24bc8a12562e3c79
- SHA256
  
  43da5c772a9be1b0699c5515261f643bb02348c1da3485ce307a80f703e4bf79
- SHA512
  
  0b395ef942aaf57cdd93134f1cdb897bc4b2a543ad7590efeee28d821a73fadc483952de37c3171b0975c66fc2c42b164e4ce3fb7691a02baf69051ab71ad928
- SSDEEP
  
  1536:30Puiz5IiFmrhCdzUEpxSRIpKm4yT1u8Dx/Q0+rZN:EmiFZG2xpbVuUx/Q0EN
Score

3^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/LuaSocket/lua/ltn12.lua
- Size
  
  8KB
- MD5
  
  e440044afe6c761507a996b5b45ab0f9
- SHA1
  
  ef772c758fd5d6098b41375f35ac26f3963cc306
- SHA256
  
  b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
- SHA512
  
  8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
- SSDEEP
  
  192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
Score

3^/10

execution
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/LuaSocket/lua/mime.lua
- Size
  
  2KB
- MD5
  
  4bfdaaab9014fe129bc6388fd5687c8f
- SHA1
  
  2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
- SHA256
  
  e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
- SHA512
  
  3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket.lua
- Size
  
  4KB
- MD5
  
  74dbe1060e91112e1c21ef9870b4a587
- SHA1
  
  86afb6aecb0a8387ffa5dead1cc9808332f94310
- SHA256
  
  15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
- SHA512
  
  73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
- SSDEEP
  
  96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/ftp.lua
- Size
  
  9KB
- MD5
  
  7309f4294ae4abb4f6ae657b2a98d488
- SHA1
  
  327d143e9f7a1835a58fdaf569a8f7a937fcf2c0
- SHA256
  
  9ba5df91091c46f0ffe0a93ace577a4833c92cbec1742113d0a2da9e568f9a10
- SHA512
  
  a44d2603af63828e8a0b1fbc7455305c616e5bae4a351b429e7e94a6aa7e4d6425f69d57d6a44ba87ee5d29accfc01c1f3ff288652120ff8f08a66543d357895
- SSDEEP
  
  192:GsooRaLonJfMxBs6gZO2zMAcTcGZqxOU6iOeBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7U6iOeBRkfYtW
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/http.lua
- Size
  
  12KB
- MD5
  
  0eb1f0ffcb4dd17c22b20a3d7d6654db
- SHA1
  
  bae3d2be867f62c5f8d7e769248f053c50a1ab8d
- SHA256
  
  04e6a7526ed1dc51f4d1f9b25b56f0c7826367ae3f2468a8622e359663ee5526
- SHA512
  
  f9362cb8a84312aa3f12c93fa268f5950ebd575abb54f3778a5f3aa935e1c7685b7bf78e8a6a3eabe67094914ec90143ecdd384a4341f000fda41b686b486d97
- SSDEEP
  
  384:x7/thyc+f7zLajrZhVoaOt2yyVizJvcGwkD:F/thyc+f7zyoaOt2yqizJLvD
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/tp.lua
- Size
  
  3KB
- MD5
  
  2cad406e591cade482c7f16f39c21481
- SHA1
  
  84a3ab88ff7a9102c2c6d21bdb6eede6862167a4
- SHA256
  
  343afa62f69c7c140fbbf02b4ba2f7b2f711b6201bb6671c67a3744394084269
- SHA512
  
  ecc98991c25036b54f2bb71b3229e4bc8fb401e55db0e5f9c958c2a7b00b40fc9ae2d7e45002d4f2a03cec85535785c42ab6d20476fe095a76444d143493b145
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/LuaSocket/mime/core.dll
- Size
  
  52KB
- MD5
  
  4a4845ba1666907f708c9c10a31ec227
- SHA1
  
  1ebf626adc84147e5114885ce779f92d6eb68f3a
- SHA256
  
  a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
- SHA512
  
  d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
- SSDEEP
  
  768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
Score

1^/10
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/LuaSocket/socket/core.dll
- Size
  
  80KB
- MD5
  
  4bf7db111acfa7c28ad36606107b3322
- SHA1
  
  6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
- SHA256
  
  bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
- SHA512
  
  0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
- SSDEEP
  
  768:4pOz0XSP1hSt5+5lKfZyDy3TygCk749NRAa1YwqJlfp8iB9jDEu/s5RPOothtlRp:wOws14t5CeTygmNRA0IVh05IoN3
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

evasiontrojanupx

behavioral2

evasiontrojanupx

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32