1aca618d4855a31c72bce46bd0e424d05102c90dc3cadaab737cd10601672ebe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68176c71822499f9f98d33a7aa9b84f6_JaffaCakes118
Size

1.9MB
Sample

240723-sl6rqswfpn
MD5

68176c71822499f9f98d33a7aa9b84f6
SHA1

9fa7494292dc97c6e90705a9dcb6c6251999b06b
SHA256

1aca618d4855a31c72bce46bd0e424d05102c90dc3cadaab737cd10601672ebe
SHA512

41180b97d3659c4c421ac5caf4ec9464f0fe54e9787baea86a2061db78ffde9d0622862dc0efa903d3669502c624e8decd4c1fda463db5c06fa41261aba30053
SSDEEP

49152:0ylql3U2RY0AehxLEA8BwFFp5D/FkZTmRouSY2oOsaqxuuG9q:02+3RY3T+np5D/AVurpODqV8q

Score

7^/10

discovery evasion upx

Malware Config

Targets

- Target
  
  68176c71822499f9f98d33a7aa9b84f6_JaffaCakes118
- Size
  
  1.9MB
- MD5
  
  68176c71822499f9f98d33a7aa9b84f6
- SHA1
  
  9fa7494292dc97c6e90705a9dcb6c6251999b06b
- SHA256
  
  1aca618d4855a31c72bce46bd0e424d05102c90dc3cadaab737cd10601672ebe
- SHA512
  
  41180b97d3659c4c421ac5caf4ec9464f0fe54e9787baea86a2061db78ffde9d0622862dc0efa903d3669502c624e8decd4c1fda463db5c06fa41261aba30053
- SSDEEP
  
  49152:0ylql3U2RY0AehxLEA8BwFFp5D/FkZTmRouSY2oOsaqxuuG9q:02+3RY3T+np5D/AVurpODqV8q
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $DESKTOP/utorrent/IPlusSetup_pcsweeper.exe
- Size
  
  371KB
- MD5
  
  0285c23c1b71730913b647f3219b299a
- SHA1
  
  934e4f8767dcb5b02d02329162eaf36f76a9b885
- SHA256
  
  3ea93b707ab0173577716471cf82beff16b28e1aa1a7e961fcbad829917512c2
- SHA512
  
  8f95dbe0f5035abbac2c29c0603914d6e977e667b7922ff2a9b0360417fdf42ac2d4392e0c10987492d144cddddb60386318d96baf5b10621e43d3c94258b1a9
- SSDEEP
  
  6144:hRdEwtW3Sl2ip0mPLObgHE/QNLscJa0ODE0Jw3XEcrFoy/BnDpEdS/01:hUip4gHEwk1wsw356y/BDp21
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $DESKTOP/utorrent/OKExtern.exe
- Size
  
  386KB
- MD5
  
  706e8135ad3c5594d85bb06025457bce
- SHA1
  
  ffd78669cde399e1bafa6a10a7c26f806d9b34a4
- SHA256
  
  84e43b9e80919d876bdd186660af55f83a2f924f1394d06b9c23e8bc4ffb9e3c
- SHA512
  
  063a88eac967af680b78d0e1b4327b501cd3ca9d40b0ba8943456394c297e1b1529f8b670b5c31d8831cdea5ae6c0341f392dc9a7212d8c92599d86369ec4207
- SSDEEP
  
  6144:fFJ0hsSQipaXrTtGrs2hHLedit4rmi7pJgIQFKuM25HHMvL6e2r6:S9QTrTtGs2Rnt4ainuxMgMzb
Score

7^/10

discovery
- Loads dropped DLL
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  44KB
- MD5
  
  3599d30554ad65dc29fc689217d2152e
- SHA1
  
  8f5fcc313b667a1de2d56573bcf98d43fd0d4ff9
- SHA256
  
  1af3ac7d3176af42e8594ba0c33821d3318f4eea5cbb799bf8fab58e480efe0e
- SHA512
  
  846776b1d908b5204667715ffdfd3a6c76dface1677e8b1e5156ceac2ef0a739f68b48ccbb919c9e08d6ff359a93174bf0b90def7d48cee54cd3c41d8d8575f2
- SSDEEP
  
  768:oY6+2hD1lu3SFh80Z9pe7nJRJ3QN8DOUVowlo+J:76xhZlM0h/9panJ73CSFl
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  e54eb27fb5048964e8d1ec7a1f72334b
- SHA1
  
  2b76d7aedafd724de96532b00fbc6c7c370e4609
- SHA256
  
  ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824
- SHA512
  
  c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4
- SSDEEP
  
  96:57GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgN532E:VKgfwgcr8zylsB49Ud0qJVgNQ
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/version.dll
- Size
  
  6KB
- MD5
  
  ebc5bb904cdac1c67ada3fa733229966
- SHA1
  
  3c6abfa0ddef7f3289f38326077a5041389b15d2
- SHA256
  
  3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
- SHA512
  
  fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
- SSDEEP
  
  96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
Score

7^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  
  OpenKeywordC.exe
- Size
  
  718KB
- MD5
  
  e7b0bc7c0fa9637fce97eece959aae0a
- SHA1
  
  ba4b7cbb610beec489f646c1b590c6157f4d2411
- SHA256
  
  d7ae5bdbc96fb10afbecdbebf0d341bc86e149794ccb56850960fa622d43333e
- SHA512
  
  8a42083c4f1bf8f269290f70b04bd346ce4b69ed9fb3cb38b50426c7455824731be53890fd1bacb6e6100d654c15d24f4f9e0a1b5f75fcfb1996afeb5b6a75de
- SSDEEP
  
  6144:00EL+NVEzXkl3VuxDAM7MQTeYUqq0MBKxhcak3LClDcm0Bo3U5UMWy9/bsyF/MO9:00NJLoe2hGLClDcm+ok59/bDJRb
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $DESKTOP/utorrent/bogobogo.exe
- Size
  
  1.9MB
- MD5
  
  222e71adddb002dcfe97ef16697c0ef1
- SHA1
  
  436d9818279703e039a6ff965df20110b30cbb51
- SHA256
  
  be85940421ba3abf166f484343c5a11b83506974d52dd22b49f2fe2cc0760208
- SHA512
  
  4b03b50ea24280e1e558f47139da0d170e11aff091d97f3030fe6ffc530a1d3f4e5d71c6c8991f23db03c4d6a9bd939ed28c200747d1c1c5f3cf526bbbe123ab
- SSDEEP
  
  49152:/hEwYKTpMsDptM+LMsGaykNVUG8FEZ/6aBVu85XjLXJ:5n7VdDpt7QDahz58Fg/1BsGXjt
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $DESKTOP/utorrent/utorrent.exe
- Size
  
  625KB
- MD5
  
  11e8a3d1f90a9827f4e6ad484e311eee
- SHA1
  
  d77877ed880c6be0d327c165c86eadf51041ed3f
- SHA256
  
  a8020620f5a5007cde8b026f563785b0f00dade36f928d563a65597ff801f831
- SHA512
  
  fb1108ed1ea35e4d013d18d2a240c9f997fec2db00f631ef7c4915b7bc318a81ce50268e7ee6e67ac47bbf64fb085bcb3e792bd53b548312765ee8dc6ff2242c
- SSDEEP
  
  12288:Dq9yJqAUd4U40ovJg/Z9oeTelGD/leGkr7oSPU:G9yJqavJ6Z9Ul6/leP5U
Score

7^/10

discovery evasion upx
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

discoveryevasionupx

behavioral20

discoveryevasionupx

behavioral21

behavioral22