f10c168bccd7b8cca3238ec9bde980383d3d0adce47894454fe1621ce1de76b7 | Triage

Sharing

General

Target

3c20efe7461978dc95a3f52ffc17fa06_JaffaCakes118
Size

701KB
Sample

240712-f2wkgssere
MD5

3c20efe7461978dc95a3f52ffc17fa06
SHA1

a5f22689871ce35554cb2f32265be50258655366
SHA256

f10c168bccd7b8cca3238ec9bde980383d3d0adce47894454fe1621ce1de76b7
SHA512

591436b4fdc540b523ecbe5114810c833e6be36eb92e585f1ad8ca3d79e8a7ed5b227c5d428b63d3a5049a638e8538b5d64f8e90a187faa7b3ec6da2b5537a3d
SSDEEP

12288:DN43bVKy4K7pL9Ees3a/D/QdtUKIrb/MHVcbDmv:DqVx4gEl3a/bKtUHfEV46v

Score

7^/10

evasion execution trojan upx

Malware Config

Targets

- Target
  
  3c20efe7461978dc95a3f52ffc17fa06_JaffaCakes118
- Size
  
  701KB
- MD5
  
  3c20efe7461978dc95a3f52ffc17fa06
- SHA1
  
  a5f22689871ce35554cb2f32265be50258655366
- SHA256
  
  f10c168bccd7b8cca3238ec9bde980383d3d0adce47894454fe1621ce1de76b7
- SHA512
  
  591436b4fdc540b523ecbe5114810c833e6be36eb92e585f1ad8ca3d79e8a7ed5b227c5d428b63d3a5049a638e8538b5d64f8e90a187faa7b3ec6da2b5537a3d
- SSDEEP
  
  12288:DN43bVKy4K7pL9Ees3a/D/QdtUKIrb/MHVcbDmv:DqVx4gEl3a/bKtUHfEV46v
Score

7^/10

evasion trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ButtonEvent.dll
- Size
  
  4KB
- MD5
  
  fad9d09fc0267e8513b8628e767b2604
- SHA1
  
  bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA256
  
  5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- SHA512
  
  b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/CustomBrandingURL.dll
- Size
  
  5KB
- MD5
  
  e4c1b74859c17671ffe1c0602fd56b44
- SHA1
  
  15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1
- SHA256
  
  2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
- SHA512
  
  9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925
- SSDEEP
  
  48:SMq1qEwUNRYDeKPTeKp4GN8C8hgIV2f4ag5pmy8WywlhQ7sp9CSC2bH:hq1q/QPKSKp4m80i2QGpvwLXLCtGH
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/CustomNSISdl.dll
- Size
  
  23KB
- MD5
  
  20bc732eaacc80c1407bfb21e572d7c3
- SHA1
  
  4fe5c994b917f5f5373d4f14c441dea71bd2bad4
- SHA256
  
  c4758b9fe0c1d13b507557b336e062e15aa625e290fb0ffc46019a3c30ddcbfd
- SHA512
  
  1117b45e508e5b0f839709bcf0f397ff822ba598216c89e2d878542123d18a1ede70916e86725de7377776566552f103d01127d81f9390d6f6098698c2c6e885
- SSDEEP
  
  192:iYAVHpfRUUCZAaG9ewsfyesrowSccHkGtMiCz5UeFuziNnAIoxUCtACIE8AVhfGX:iYMHwRAanwJesrowScNLaOaiVLo1vFI
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/CustomnsWeb.dll
- Size
  
  11KB
- MD5
  
  c79512e9f9772b8b9b9f0053f3e0111c
- SHA1
  
  854b8184ff6065f193dbbb47fe0c9c7e468775f3
- SHA256
  
  bbde41f5e6964ba784adec7eb558c4e01b2a9de3235216643bccd5863a36d8b3
- SHA512
  
  67df5bf7aaac9db8cb45a8c16fa49a1bda5a0c7314dfecd81e225aef5a5e586b89e3a0f1d107fa676a6f3987b811774f9178b7bd06004009c31e517cdf3ec434
- SSDEEP
  
  192:2EuJrqaJeHcL8mkU1RS3GfiMdN/WFWKfOkVHpKjBHuvpFxE8sh85WbCzowY9W8tc:QJGaRL8nUvSHMvWFLfOkKj0vpENhSoIv
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/FloatingProgress.dll
- Size
  
  25KB
- MD5
  
  5f11bfefee27008b9ac247aa401605d5
- SHA1
  
  a7faf8701a2e9675df065eaf2ffdf8acbaf4c0f0
- SHA256
  
  aacd01fddcfd56fbeadcdd83e733778ca45ce38ad8145196f0ac2b4415018762
- SHA512
  
  574c2fc99f342e1bb5e98bda016e63294494eb7bf1e6b080ae7683b0ca359c5a2fe4df222e55cb5343b71134b16c2b5f807ac703e8ec547a99bd74392f880c2c
- SSDEEP
  
  192:+dEyZh2Poi73yFDoUjSFWbY3Lf+25meJVOuN+Sx10mvmWc4b6TY:+z72l7Ifc7fV8C+I2mw4b6T
Score

1^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/GuiInit.lua
- Size
  
  78KB
- MD5
  
  8bd6f4049038c34fb8a4850aff48de3f
- SHA1
  
  80445e647c59bf187f11bd342fe149dc7968536d
- SHA256
  
  69b1567f83df18ebd2b9db157b7644bfc5f12b3454093ecabce4cb32697f95a8
- SHA512
  
  6b2ca6fd9de46412c684a617c1738a7a3020834cb57dadf9701d2d1b57514d01cb84c927fcd7bc83624c5a3d60d2b9f2edb775b2540b5c1d6263e2eff00c3eaf
- SSDEEP
  
  768:byEpUxaHpHrqRSV0gu4TIsIsPqPi/JmT/MHkkR/v63b+M+LshrrO3lY5lSSop4WR:7QR1gu1BsbmTD3b+SrIBp4t6Ci1
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/LuaBridge.dll
- Size
  
  14KB
- MD5
  
  9ceadd0487cfc28b4839a4bddc5b325b
- SHA1
  
  08cb3fcac30e34fd6f82d402f89a02d7f847ad9e
- SHA256
  
  f4c9c8848647dfc7997d628694601e279f18d1a8e14f44c64cd5f0ce59d49d4c
- SHA512
  
  85420212c1ff5f65a414d4a5b5b0b7daa825231f527832ca099e212a2bbf19fc86916c21c7dbd45209c7802d615e172f0b845588a4951af9f0b533a96ef1d124
- SSDEEP
  
  192:G+axx4JShTJozDKB3ALBPIGqvJ30Xcht12VwxlebzMChX3:Axx4JETJKKBwL9Ih0XQ1LlendB
Score

3^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/LuaSocket/lua/ltn12.lua
- Size
  
  8KB
- MD5
  
  e440044afe6c761507a996b5b45ab0f9
- SHA1
  
  ef772c758fd5d6098b41375f35ac26f3963cc306
- SHA256
  
  b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
- SHA512
  
  8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
- SSDEEP
  
  192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
Score

3^/10

execution
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/LuaSocket/lua/mime.lua
- Size
  
  2KB
- MD5
  
  4bfdaaab9014fe129bc6388fd5687c8f
- SHA1
  
  2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
- SHA256
  
  e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
- SHA512
  
  3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket.lua
- Size
  
  4KB
- MD5
  
  74dbe1060e91112e1c21ef9870b4a587
- SHA1
  
  86afb6aecb0a8387ffa5dead1cc9808332f94310
- SHA256
  
  15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
- SHA512
  
  73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
- SSDEEP
  
  96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/ftp.lua
- Size
  
  9KB
- MD5
  
  4f83a72dc82a78cad6eb7edbe7d2f152
- SHA1
  
  486dd564c3b2ac467e3eabfad806308f14fabb5f
- SHA256
  
  26167d7c0f511cca7691ca5ad6ebf85b4427b94ef12e110ba1da75f023db8acd
- SHA512
  
  a5ca1c8955a450a727950d91b720895db55f425f2531bc2d2d17034363961ed52b6cc086289f966ac3c27b056452ab5126ec7d9bb34cf5a92fdf0f725f40781d
- SSDEEP
  
  192:GsooRaLonJfMxBs6gZO2zMAcTcGZqx6iOaBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7iOaBRkfYtppO
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/http.lua
- Size
  
  12KB
- MD5
  
  7bd12178adca19b584ed1320fdae1e81
- SHA1
  
  839753d73984bda68047585bbc36f9344f51c34d
- SHA256
  
  d10fbef2fe8aa983fc6950772c6bec4dc4f909f24ab64732c14b3e5f3318700c
- SHA512
  
  634428c0e7dc62e7c44f60586c0ab0cedb8b55d9e7f2432f7f681aa58e0a8a444168d104d25c51b7839c06817f83f52a7baa4a0e45df6db283d6d5aa0d5e424e
- SSDEEP
  
  384:x7/thyc+f7zLajrZhVoaOt2yyViz/vcvwkD:F/thyc+f7zyoaOt2yqiz/avD
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/tp.lua
- Size
  
  3KB
- MD5
  
  2cad406e591cade482c7f16f39c21481
- SHA1
  
  84a3ab88ff7a9102c2c6d21bdb6eede6862167a4
- SHA256
  
  343afa62f69c7c140fbbf02b4ba2f7b2f711b6201bb6671c67a3744394084269
- SHA512
  
  ecc98991c25036b54f2bb71b3229e4bc8fb401e55db0e5f9c958c2a7b00b40fc9ae2d7e45002d4f2a03cec85535785c42ab6d20476fe095a76444d143493b145
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/LuaSocket/mime/core.dll
- Size
  
  52KB
- MD5
  
  4a4845ba1666907f708c9c10a31ec227
- SHA1
  
  1ebf626adc84147e5114885ce779f92d6eb68f3a
- SHA256
  
  a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
- SHA512
  
  d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
- SSDEEP
  
  768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
Score

1^/10
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/LuaSocket/socket/core.dll
- Size
  
  80KB
- MD5
  
  4bf7db111acfa7c28ad36606107b3322
- SHA1
  
  6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
- SHA256
  
  bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
- SHA512
  
  0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
- SSDEEP
  
  768:4pOz0XSP1hSt5+5lKfZyDy3TygCk749NRAa1YwqJlfp8iB9jDEu/s5RPOothtlRp:wOws14t5CeTygmNRA0IVh05IoN3
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanupx

behavioral2

evasiontrojanupx

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32