591aebf6e2ef1633c1b52367e43baf4e394ed9677fdec43fd24098c84a7b9481 | Triage

Sharing

General

Target

ad47dfcc31eec328fca02c9ab2619658_JaffaCakes118
Size

4.7MB
Sample

240820-a98xwsyhpq
MD5

ad47dfcc31eec328fca02c9ab2619658
SHA1

17c306ad16607cc883f65e060531eba4bfd23e01
SHA256

591aebf6e2ef1633c1b52367e43baf4e394ed9677fdec43fd24098c84a7b9481
SHA512

6a742cde25f23924d6a06ec53d1248f9ea0dd43d23da56ffd4f574247ff763629bef9fc6afe4dbe71ca2b8ad4e9a66d606b22a5c8b64cb900ead89370414ea98
SSDEEP

98304:r7Wu0BLAl+n2KMrVPFUT1sudCOCwizwDdokys4ly0o4WBJ7z8ZEu4zrn:r7WuprKOPFUTdIwiaokoY01WBJ7IEhn

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  
  ad47dfcc31eec328fca02c9ab2619658_JaffaCakes118
- Size
  
  4.7MB
- MD5
  
  ad47dfcc31eec328fca02c9ab2619658
- SHA1
  
  17c306ad16607cc883f65e060531eba4bfd23e01
- SHA256
  
  591aebf6e2ef1633c1b52367e43baf4e394ed9677fdec43fd24098c84a7b9481
- SHA512
  
  6a742cde25f23924d6a06ec53d1248f9ea0dd43d23da56ffd4f574247ff763629bef9fc6afe4dbe71ca2b8ad4e9a66d606b22a5c8b64cb900ead89370414ea98
- SSDEEP
  
  98304:r7Wu0BLAl+n2KMrVPFUT1sudCOCwizwDdokys4ly0o4WBJ7z8ZEu4zrn:r7WuprKOPFUTdIwiaokoY01WBJ7IEhn
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  31KB
- MD5
  
  83cd62eab980e3d64c131799608c8371
- SHA1
  
  5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA256
  
  a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- SHA512
  
  91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP
  
  384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  9384f4007c492d4fa040924f31c00166
- SHA1
  
  aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA256
  
  60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- SHA512
  
  68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP
  
  48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  14KB
- MD5
  
  a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1
  
  168f3c158913b0367bf79fa413357fbe97018191
- SHA256
  
  dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- SHA512
  
  824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP
  
  192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  17KB
- MD5
  
  09caf01bc8d88eeb733abc161acff659
- SHA1
  
  b8c2126d641f88628c632dd2259686da3776a6da
- SHA256
  
  3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
- SHA512
  
  ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
- SSDEEP
  
  384:w9JzaeWrF8d22hXAGFkr2WqErkuCYMAWS5Ns8AXXki:wLaBrrTXr3qruCYuS5qk
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/ZipDLL.dll
- Size
  
  163KB
- MD5
  
  2dc35ddcabcb2b24919b9afae4ec3091
- SHA1
  
  9eeed33c3abc656353a7ebd1c66af38cccadd939
- SHA256
  
  6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
- SHA512
  
  0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
- SSDEEP
  
  3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  acc2b699edfea5bf5aae45aba3a41e96
- SHA1
  
  d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA256
  
  168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- SHA512
  
  e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP
  
  96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $TEMP/Toolbar.exe
- Size
  
  2.6MB
- MD5
  
  ee8e6ae582caf9b04992524f8ea283d7
- SHA1
  
  1403c571530ba34b8c69652e377a5a7f45ccf4f4
- SHA256
  
  bd39511e709e2d292674d1ef45f0601a28072f67253c965012d9ec109c2028b5
- SHA512
  
  6fc9ee6c8af41ac232271a57c7ec7a0bbf2a34699a629479066291bcbc1f1f7a6d0af820420d65ef83b62b96b23012d7a40aa287ff835bf4bafbfb99ab7cb702
- SSDEEP
  
  49152:okLuXYAlcqGzJmG92f7GDEpPThSWbJOozk9GCTgCim7P7Jb4RqesH:TLuXYAluzf92CDEpPAWbMr9GCTguli3e
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  
  content/aboutTabs.htm
- Size
  
  143B
- MD5
  
  30b063c23ccd0e573f7956a49e6ad2da
- SHA1
  
  b43ddff041bd7e3fdec541b0b3004ecd661db8d0
- SHA256
  
  dde0330a494598aee2dec1ed467b0ce99400b860a9eec03e59a963090736cf9a
- SHA512
  
  5af5794bc10afd6692ef9eccfb860248fbf656361fd6cbbe399e497bf0f8c9e9e603eb0dc3781344a53ae84578e1618e60a9a1096cc3a0b149e2e4c82c8c43c4
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  content/ctoolbar.js
- Size
  
  2.0MB
- MD5
  
  55dccad7f2e47df34af87fd1cf389d1b
- SHA1
  
  438e94b0d82966689e2389b0d7f2b7e1752d00bf
- SHA256
  
  7a2116def4deafc16bfbe1ce8da1eb6070850b9bd07921eeba46de4bdbe3f184
- SHA512
  
  f7816dd90043b58841f65c54503765a6e4a523a6347ac48d4c07805d0bde4f592d9f4d033bfb9599c28b2336906e3f5a6b96909521fab318696b894a4f8cebde
- SSDEEP
  
  49152:zCXPFE1XeKHjokOFmmgZKlRxGn9ByT7s3IdMUyKihtbYTUb0:zC5
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  components/ConduitAutoCompleteSearch.js
- Size
  
  16KB
- MD5
  
  fa0d9e1396c227b8697e41996a95912b
- SHA1
  
  5065dc6fdc3c74692aceeb190d0aa90fef679e97
- SHA256
  
  56df06308f7446894f8984d763b27d02832f1c926026ecb658701595878c1014
- SHA512
  
  9d0dfa14986268622bed3dba1d1faec6062eb72634ffb87b17eef8e11c5883a76e1d8c1f8eec5d958f8d8178ebb4448563395dba8d251043f1596ebb510d2865
- SSDEEP
  
  192:7j1DVelhxsk/M++iFdoOQBSEb3IIpZ5HAwxYbSrmc:7j1DVelhxskEFiLoOJMV5HAcLKc
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  components/ConduitToolbar.js
- Size
  
  2KB
- MD5
  
  6a2c72df1348f39c0ce44e1b8c10f5ce
- SHA1
  
  e0f33af9ae6626fe7e0ce804672773f11cdca34e
- SHA256
  
  b1668a25f6982c4137831b3036a1f0401a8a8f25e39004c857757d47fee7b58e
- SHA512
  
  221c4f00d7f0eac26355a463644bb8a9f36ed479e3f1dfae994eae1dc0314f971621c9a177795a7d1a7a4b2a0f3ed8a673274adf338b299fceb83b46db8df1e5
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  components/RadioWMPCore.dll
- Size
  
  95KB
- MD5
  
  34c084b321ea0308c58eed1cf6b5fb02
- SHA1
  
  b1b9343e7980342a08ff3ba2686ab40a8d532b3b
- SHA256
  
  29b496d4912c8fef540837c4cf8b83bd40926b63b805c43d5ee5b3f92487a3ad
- SHA512
  
  260a75d882aba2fcce0f875debe7b0f97ea72fcb37aa4fd1612116923769119de6add98e3365a608706b714c96e4dbdcaf30080bbcb0a833b5ddcadfb2d09db4
- SSDEEP
  
  1536:0EHZGF6fHR+hOWZt/UBO8FpE4B6ifrTPz5EcV:z5WWxKTX8FZZfrzz5EcV
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  components/RadioWMPCoreGecko19.dll
- Size
  
  99KB
- MD5
  
  696f6787818300362f15485d654f6887
- SHA1
  
  1ed56308df4da59efaa1ffddab00f6fa08783d0d
- SHA256
  
  e4002c31fba34f976b135d07b2b03f6ca352863907ce521b1c1d7b6215947eb3
- SHA512
  
  eb6d7f3feef54ddfb3f0fbfa876480f8c75902774cc529fffa8e33fd6c689134fb824033a55e7ab0c4e428cebe9f3220038addd99df74fe562f7692da8502531
- SSDEEP
  
  1536:ji63tfvHRjEw1L0d0tGBOpWNJjxyHLHnS5GIHi:Td3HxD1LGopsjxyHrS5GI
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32