57f9da48f1cfe47d500c9a45623d639f9a4dfb2f5cc9b62730ab9eb7dde5eca0 | Triage

Sharing

General

Target

a57618a045dfc6cdeb4b4e145ad96643_JaffaCakes118
Size

4.7MB
Sample

240818-fjc1esyhrm
MD5

a57618a045dfc6cdeb4b4e145ad96643
SHA1

9da6760e1b4470d13ed9ded3689dc153d08869a4
SHA256

57f9da48f1cfe47d500c9a45623d639f9a4dfb2f5cc9b62730ab9eb7dde5eca0
SHA512

2d801f35f6b8828004575622201562d6844731c43a70ca405239eeb0bca3cc7711666f25a81275ade26db9fdf254da40148af326c695000e9e9c9126602583e8
SSDEEP

98304:f7DRxg/2I0ZWXpEkYl2Q3NOy3AacPTd+46EeJkCsgFBCCbmSlTpFS:j1xg/2NEXpEkYl2Q3j3Aas+4OmT0cumF

Score

7^/10

discovery execution upx

Malware Config

Targets

- Target
  
  a57618a045dfc6cdeb4b4e145ad96643_JaffaCakes118
- Size
  
  4.7MB
- MD5
  
  a57618a045dfc6cdeb4b4e145ad96643
- SHA1
  
  9da6760e1b4470d13ed9ded3689dc153d08869a4
- SHA256
  
  57f9da48f1cfe47d500c9a45623d639f9a4dfb2f5cc9b62730ab9eb7dde5eca0
- SHA512
  
  2d801f35f6b8828004575622201562d6844731c43a70ca405239eeb0bca3cc7711666f25a81275ade26db9fdf254da40148af326c695000e9e9c9126602583e8
- SSDEEP
  
  98304:f7DRxg/2I0ZWXpEkYl2Q3NOy3AacPTd+46EeJkCsgFBCCbmSlTpFS:j1xg/2NEXpEkYl2Q3j3Aas+4OmT0cumF
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  31KB
- MD5
  
  83cd62eab980e3d64c131799608c8371
- SHA1
  
  5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA256
  
  a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- SHA512
  
  91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP
  
  384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/KillProc.dll
- Size
  
  24KB
- MD5
  
  f2223ee8d3b5a26d9386dd90fd6326cd
- SHA1
  
  edf24705bba2a459637722af3b7a8b7bac23d2ed
- SHA256
  
  488aa34c7d2da0ab4a6b50463d5bb7fb402493602d3164bd1d56a2e93d97237e
- SHA512
  
  59bdc5368c9dbcee3f7807a653618becac2c36ac4b4c5b3e8906f32e55ddb0620af30e1c771bd9e3145b7caf996c1cc439066e1ce17cbe6f3ed9248c2e6e4428
- SSDEEP
  
  768:p13K3oHsFZLEQOkfb5CtRvBFj3d6dLMk:p43oGgQzotRZFRsH
Score

7^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  9384f4007c492d4fa040924f31c00166
- SHA1
  
  aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA256
  
  60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- SHA512
  
  68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP
  
  48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1
  
  168f3c158913b0367bf79fa413357fbe97018191
- SHA256
  
  dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- SHA512
  
  824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP
  
  192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  17KB
- MD5
  
  09caf01bc8d88eeb733abc161acff659
- SHA1
  
  b8c2126d641f88628c632dd2259686da3776a6da
- SHA256
  
  3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
- SHA512
  
  ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
- SSDEEP
  
  384:w9JzaeWrF8d22hXAGFkr2WqErkuCYMAWS5Ns8AXXki:wLaBrrTXr3qruCYuS5qk
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/ZipDLL.dll
- Size
  
  163KB
- MD5
  
  2dc35ddcabcb2b24919b9afae4ec3091
- SHA1
  
  9eeed33c3abc656353a7ebd1c66af38cccadd939
- SHA256
  
  6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
- SHA512
  
  0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
- SSDEEP
  
  3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  acc2b699edfea5bf5aae45aba3a41e96
- SHA1
  
  d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA256
  
  168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- SHA512
  
  e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP
  
  96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  $TEMP/Toolbar.exe
- Size
  
  2.6MB
- MD5
  
  bed7d057903131569907ce3b4e1bffdb
- SHA1
  
  745879801884d48b9ee9f92cde9a4f270a5ba0bd
- SHA256
  
  53484c59e5fcf1c22328cad79a54ca84c6503f17c4b6e5edc8ff53c12228b7e3
- SHA512
  
  ecf29408783b93b3405bac661327915503e862ad6b88b9669b31ab5963427da4b41da5b612e22c261671dc272a5930708e3f30b893974d297eaa8959bab2911f
- SSDEEP
  
  49152:z3kpJV4IcHWgV3Kvul+0eQxYGzkJLQsq0EpKDA8VbjSYt2JdDkeCN0cYw7Jb4RqA:YsWg4vX0ZuJpTbDFJt2JdDkeCF/li3x
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  
  content/aboutTabs.htm
- Size
  
  143B
- MD5
  
  30b063c23ccd0e573f7956a49e6ad2da
- SHA1
  
  b43ddff041bd7e3fdec541b0b3004ecd661db8d0
- SHA256
  
  dde0330a494598aee2dec1ed467b0ce99400b860a9eec03e59a963090736cf9a
- SHA512
  
  5af5794bc10afd6692ef9eccfb860248fbf656361fd6cbbe399e497bf0f8c9e9e603eb0dc3781344a53ae84578e1618e60a9a1096cc3a0b149e2e4c82c8c43c4
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  content/ctoolbar.js
- Size
  
  2.0MB
- MD5
  
  55dccad7f2e47df34af87fd1cf389d1b
- SHA1
  
  438e94b0d82966689e2389b0d7f2b7e1752d00bf
- SHA256
  
  7a2116def4deafc16bfbe1ce8da1eb6070850b9bd07921eeba46de4bdbe3f184
- SHA512
  
  f7816dd90043b58841f65c54503765a6e4a523a6347ac48d4c07805d0bde4f592d9f4d033bfb9599c28b2336906e3f5a6b96909521fab318696b894a4f8cebde
- SSDEEP
  
  49152:zCXPFE1XeKHjokOFmmgZKlRxGn9ByT7s3IdMUyKihtbYTUb0:zC5
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  components/ConduitAutoCompleteSearch.js
- Size
  
  16KB
- MD5
  
  fa0d9e1396c227b8697e41996a95912b
- SHA1
  
  5065dc6fdc3c74692aceeb190d0aa90fef679e97
- SHA256
  
  56df06308f7446894f8984d763b27d02832f1c926026ecb658701595878c1014
- SHA512
  
  9d0dfa14986268622bed3dba1d1faec6062eb72634ffb87b17eef8e11c5883a76e1d8c1f8eec5d958f8d8178ebb4448563395dba8d251043f1596ebb510d2865
- SSDEEP
  
  192:7j1DVelhxsk/M++iFdoOQBSEb3IIpZ5HAwxYbSrmc:7j1DVelhxskEFiLoOJMV5HAcLKc
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  components/ConduitToolbar.js
- Size
  
  2KB
- MD5
  
  6a2c72df1348f39c0ce44e1b8c10f5ce
- SHA1
  
  e0f33af9ae6626fe7e0ce804672773f11cdca34e
- SHA256
  
  b1668a25f6982c4137831b3036a1f0401a8a8f25e39004c857757d47fee7b58e
- SHA512
  
  221c4f00d7f0eac26355a463644bb8a9f36ed479e3f1dfae994eae1dc0314f971621c9a177795a7d1a7a4b2a0f3ed8a673274adf338b299fceb83b46db8df1e5
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  components/RadioWMPCore.dll
- Size
  
  95KB
- MD5
  
  34c084b321ea0308c58eed1cf6b5fb02
- SHA1
  
  b1b9343e7980342a08ff3ba2686ab40a8d532b3b
- SHA256
  
  29b496d4912c8fef540837c4cf8b83bd40926b63b805c43d5ee5b3f92487a3ad
- SHA512
  
  260a75d882aba2fcce0f875debe7b0f97ea72fcb37aa4fd1612116923769119de6add98e3365a608706b714c96e4dbdcaf30080bbcb0a833b5ddcadfb2d09db4
- SSDEEP
  
  1536:0EHZGF6fHR+hOWZt/UBO8FpE4B6ifrTPz5EcV:z5WWxKTX8FZZfrzz5EcV
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32