0a18ae2f91b9fa393870a06be56c8bb8e5a982252a01246344597eb93d239897 | Triage

Sharing

General

Target

eacb86183fb6f365641018bc9c1e6e17_JaffaCakes118
Size

1.3MB
Sample

240919-hm325awdrk
MD5

eacb86183fb6f365641018bc9c1e6e17
SHA1

7aca7594138779b4359c114d26a778bbd868fb87
SHA256

0a18ae2f91b9fa393870a06be56c8bb8e5a982252a01246344597eb93d239897
SHA512

7c0eec928d2101853dec641adff4f80f2787aab1d9d6fa24aa7d2711c8c1afe749e9996ad379107a35434080fc3963b77916912cf685f0d5664817035b33e787
SSDEEP

24576:zcV+ar20PBR6k+myPnpSWkMg19Jxl/6q9XG9VkU3VspA:zcV+c20QjPn0WkMQxFBiiUX

Score

7^/10

discovery upx

Malware Config

Targets

- Target
  
  eacb86183fb6f365641018bc9c1e6e17_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  eacb86183fb6f365641018bc9c1e6e17
- SHA1
  
  7aca7594138779b4359c114d26a778bbd868fb87
- SHA256
  
  0a18ae2f91b9fa393870a06be56c8bb8e5a982252a01246344597eb93d239897
- SHA512
  
  7c0eec928d2101853dec641adff4f80f2787aab1d9d6fa24aa7d2711c8c1afe749e9996ad379107a35434080fc3963b77916912cf685f0d5664817035b33e787
- SSDEEP
  
  24576:zcV+ar20PBR6k+myPnpSWkMg19Jxl/6q9XG9VkU3VspA:zcV+c20QjPn0WkMQxFBiiUX
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/17561.vbs
- Size
  
  912B
- MD5
  
  2ac26956932b367d8f52cfc9dab33f81
- SHA1
  
  c156cc9273e8309dcc7ee7b32cf61d5e080fef67
- SHA256
  
  609cf60273fadbe4c80f8f49584af34fd9406ce266b827dde9ce968fad5b3f72
- SHA512
  
  e0f26874433e78d3c85186bc8808860dcd751d4bcdc674d9339fd1b4ced792c24d4618e68c7fa22b69200e7079fab18d93f74534fd075f2fbee2662375842f10
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/AdvSplash.dll
- Size
  
  6KB
- MD5
  
  a1bba35c752b36f575350cb7ddf238e4
- SHA1
  
  9603b691ae71d4fbc7a14dbb837bd97cecac8aab
- SHA256
  
  0667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6
- SHA512
  
  eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967
- SSDEEP
  
  96:6ONSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpiwoS:sXIpzTSd1BSk/kJtWpi
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/ButtonLinker.dll
- Size
  
  7KB
- MD5
  
  dd85ac7d85c92dd0e3cc17dfd4890f54
- SHA1
  
  a128fb7a05965c1a9913c6f5e419e6c4c0a7d2fa
- SHA256
  
  27abd2a4fb1bf66add60221b52d061bbe24d2d21e13600725ff7a5c6c777b504
- SHA512
  
  e4ff8216c65110a9d156f37c2062acb53a72daa8af12dfc24278920d9e1a4083a81b1446759df75405b2da34c7bfb1afc33184feedd0aee4ed73f79fcbb1a8a1
- SSDEEP
  
  96:q0GBDU3ADeEZlBLx6sWHCKGKVR3YXqNNtFa4PaaU4x:X53jEd2n3Y6NNtFBaa
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1
  
  5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA256
  
  8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- SHA512
  
  814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP
  
  192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/SkinH.dll
- Size
  
  84KB
- MD5
  
  a00c474dc4ced90b8f5a692108c45dce
- SHA1
  
  e02722d30a6218523e9ddef287817788a4a9b9fc
- SHA256
  
  6504e515cbcf89cb98fd9f1a310125bfdf93e1f6a6bf0c64c0229e5670cac9b1
- SHA512
  
  e81b001379f94fabb71f1d6a019b81202e00da7338048b77d1728b40427689a32801419377d3e86c51c5e418cc3ccc328ee00adc69eaa575267bcaac8f477abd
- SSDEEP
  
  1536:uVNx6WNnPZ369Z3TCy5KcGhVek8Hvv144SNT7qgG7kQSeQmnouy8U:uVNx6WNnPZK9RTkieJw7uWoutU
Score

7^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/pcpc.vbs
- Size
  
  910B
- MD5
  
  03e3b03acfb4900c61ec54c07e9a6834
- SHA1
  
  f6d1cb731fb3bc69ad2fad90874ab73895915aee
- SHA256
  
  a3d17e06945cd044a9b2a13dab8f4ca7d2f309bb564fbfcea5c1e570f82aff89
- SHA512
  
  19d59a1df2d6222dd685b2c5912d09b280fdcf134494f77d61923b233be5c5a7892262a514a4e38955ba2f8af1715be1340f7544e56668b0681014409ee64239
Score

3^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/Ϸ.exe
- Size
  
  70KB
- MD5
  
  339ea025e089399386696d1c3941e250
- SHA1
  
  606b345cdc0b9587b0603cca9e62737ae0a3eb9c
- SHA256
  
  070ff0d88fd01d7ddb9e2163c93120d75645c0f43ffd4e661d2cab9cd1ecd348
- SHA512
  
  11e2a1fbbcfab6a58351865bb0fb50e6e8891d428522450e39a4bc03e701bc1abf65eddfa1ea3e044467279e2b41dc7da03503308177bed682c8c5d3fc882605
- SSDEEP
  
  1536:Nf4exGDkeZ4mOoSgJEAJJh4Romu/BLohf6tk6NO1uWFO:F4eYZ4+1JXJJh45SBOZFO
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/BrandingURL.dll
- Size
  
  4KB
- MD5
  
  71c46b663baa92ad941388d082af97e7
- SHA1
  
  5a9fcce065366a526d75cc5ded9aade7cadd6421
- SHA256
  
  bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
- SHA512
  
  5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/Inetc.dll
- Size
  
  20KB
- MD5
  
  50fdadda3e993688401f6f1108fabdb4
- SHA1
  
  04a9ae55d0fb726be49809582cea41d75bf22a9a
- SHA256
  
  6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
- SHA512
  
  e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
- SSDEEP
  
  384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1
  
  5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA256
  
  8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- SHA512
  
  814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP
  
  192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  Shell/NormalColor/shellstyle.dll
- Size
  
  560KB
- MD5
  
  c02e4f52a3e08fdd01bc6a8f188f4141
- SHA1
  
  956bc3bbf984b381de10cb8673a359a94b613bf1
- SHA256
  
  1bfbaf78f61a8b8030d7aba8faeb4adc06d99aa59d764efb764983f839dc3ac0
- SHA512
  
  8c18f68bf30eb599f4fafbba02555edd4aa0b02837fb8bb4ebd2bde1531de9d82b46de15da06df7085e8a6f048cee11300ae64f9d4b0aabfe9c28da9c4187d33
- SSDEEP
  
  1536:UimMBdkSO2ad786888888888888888888888888888888888888888888888888O:tkSJaB8ELJgjbozO
Score

1^/10
behavioral25 behavioral26
- Target
  
  uninst.exe
- Size
  
  376KB
- MD5
  
  24c0e7f67edf9bd416b39983b459d2a3
- SHA1
  
  8ba081f93353548a673a34074ee9b8a9dc90b07b
- SHA256
  
  156130b662935c1086336e0e0f35df7f3231af3dbdb199a37e2c6d0d1cbcd477
- SHA512
  
  12ec35f00480d49edb0c4d961759a4801179067658a26bfafd962dc5d23c99f6ea7ae284ba22dd0be0ea2d02de90c10d598f03d6d7014f036abb097bf68716df
- SSDEEP
  
  3072:k3c1fP4AJJT2WrSfqW4C3ZtmltDcFtlEesdTOUN6QfOcp:mOPjH6qY3lEesdTnN6Qdp
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  మ.msstyles
- Size
  
  1.8MB
- MD5
  
  0ccc0557550c32f6ea5e447aa90f7812
- SHA1
  
  3880b189fdeb228e6bec29f65bf5507c2a6bdb1e
- SHA256
  
  258de714acd3a8fccc768774825df234b697af5588ffbc48d27b5e20d2342dfd
- SHA512
  
  14e6eb8ec24dc180fbb74994bcb036d55d34f8b1742f813d57528a77db1e274f177e714d24576470b6c3e98a53feefa3af6b7458a22c7e0f95ecfc73a5be0a84
- SSDEEP
  
  12288:AbD8PLn2DSD8srX0kGD857f9AuF07xv+b2k5gS0BXuGuwkScn28p68bRJc7L:Rr+S0BuGuwkScn2G68b3c7L
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32