b835c419f87916b0b43fce1c371930c707aaa04a7e5296b92c0acd55b3e3d056 | Triage

Sharing

General

Target

06d6d71081cd0a111e62274a7832b7d6_JaffaCakes118
Size

740KB
Sample

241001-wnxtdstbjj
MD5

06d6d71081cd0a111e62274a7832b7d6
SHA1

b7161f8ded8e659f0e9a55cbb3332f88a35ea463
SHA256

b835c419f87916b0b43fce1c371930c707aaa04a7e5296b92c0acd55b3e3d056
SHA512

eb0b8a8462e989c4b536a3d16d8652574512138e259d97babbbe34c58c40c2ad21d94c06e81879512f927abe40f77298b8f242f59f2e0d71267f98bf5ea54fe1
SSDEEP

12288:6xpJ8w51xLA7jyEnDFQQJGFX2DWhK8fhbmPYLrB5VkRwm4:GpiwBc9nkFXiWhKKF3lPF

Score

7^/10

discovery evasion execution trojan upx

Malware Config

Targets

- Target
  
  06d6d71081cd0a111e62274a7832b7d6_JaffaCakes118
- Size
  
  740KB
- MD5
  
  06d6d71081cd0a111e62274a7832b7d6
- SHA1
  
  b7161f8ded8e659f0e9a55cbb3332f88a35ea463
- SHA256
  
  b835c419f87916b0b43fce1c371930c707aaa04a7e5296b92c0acd55b3e3d056
- SHA512
  
  eb0b8a8462e989c4b536a3d16d8652574512138e259d97babbbe34c58c40c2ad21d94c06e81879512f927abe40f77298b8f242f59f2e0d71267f98bf5ea54fe1
- SSDEEP
  
  12288:6xpJ8w51xLA7jyEnDFQQJGFX2DWhK8fhbmPYLrB5VkRwm4:GpiwBc9nkFXiWhKKF3lPF
Score

7^/10

discovery evasion trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BrowserControl.lua
- Size
  
  4KB
- MD5
  
  0758c4987fa7e4b0418059b764e8852f
- SHA1
  
  090bc19f211655796b1e7153cf60862fa382e87e
- SHA256
  
  4b28476a7984d6057dec94f19f63a678ea24dae9772d9b371177a6834782dbaf
- SHA512
  
  985e37d47932d9b4c576db3108d893a9a0b04475d026731251bb76e83a28485f9079371a2a79851713e639ad1192e098a503589872c9e5226067c157f41d2a7a
- SSDEEP
  
  96:YcPFcSnAqMP6HAjidEJNMIwLzm1BRjNsWhPEEPNeCmhLCzgtP:YcNcSA7PNMjzYtblV3mc0tP
Score

3^/10

execution
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/BundleInstall.lua
- Size
  
  10KB
- MD5
  
  9ee5c77f84034100bbe49fd933d27ed1
- SHA1
  
  fdb931a006f8a466ca60cd451e2cd91a93eda430
- SHA256
  
  bc823831af0b57d4cd9736c12beff594eb6b1ee5ef24a96f43b215a111d5ec3a
- SHA512
  
  5f178ddd9a413aab2c365aa1401e8a7ce94733ed5292c6bbf644c9be0870f5ae6b306e60292443695fad1f6a778dcab0ef5c06128a682439e3be3493e372ae80
- SSDEEP
  
  192:wPRXwtq5QCSvwJrhOCYI8LIdz0zSV2Gmvz6p51QC:ayZCMwRhxYI+IdQJGmYgC
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/ButtonEvent.dll
- Size
  
  4KB
- MD5
  
  fad9d09fc0267e8513b8628e767b2604
- SHA1
  
  bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA256
  
  5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- SHA512
  
  b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/CallbackProxy.lua
- Size
  
  5KB
- MD5
  
  412e9a95b337edd51aa3ab78f55d1c2d
- SHA1
  
  abe08ab1394eca8fea5b9b80543aed81b4ae52f9
- SHA256
  
  cf8d7d1866b230881f8b70b992c24fdd4dc3f52c7a761be1211e3d5371a48a9e
- SHA512
  
  f393433319a86d976f7607d4b2f4d65f6753a9b854b9e1a60d7c327e5911bff8ed2ad7224e29b4e245ab2646141fd528bedeba97a57c7753eb2a53cf46f52454
- SSDEEP
  
  96:JqO1UsvH0vChw1x6PtVz4MAlK9Ru/Jq1QGstqiMSJMq89L9RAJR16/gC:JqObvH0vChDPDJ9RP2GsDFJH89ZRAJQ
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/CustomBrandingURL.dll
- Size
  
  5KB
- MD5
  
  e4c1b74859c17671ffe1c0602fd56b44
- SHA1
  
  15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1
- SHA256
  
  2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
- SHA512
  
  9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925
- SSDEEP
  
  48:SMq1qEwUNRYDeKPTeKp4GN8C8hgIV2f4ag5pmy8WywlhQ7sp9CSC2bH:hq1q/QPKSKp4m80i2QGpvwLXLCtGH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/DownloadList.lua
- Size
  
  11KB
- MD5
  
  2346a37153681e56093aed5f7b033314
- SHA1
  
  f93250b18c02d8fcced3c8eec8c22bb61a93eb11
- SHA256
  
  23c0f82e93132f7e79f5c08575257e68560a4ce0289c5d48fee3a4508b73df3d
- SHA512
  
  6b313839f08411ffd33af1f01aebd6756dbb99080c380a21b480d0e5dda643460c7d03f4b33ad44226fa677de2c56a92c3b744a010d400b30a63b5ba0f1a25e7
- SSDEEP
  
  192:nxzEiapMCIJxGlQ6Pdrq84V4WUJsQO3ylSSorDGz:nxJMpkUlQodr+V4pvOKSlW
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/Downloads.lua
- Size
  
  9KB
- MD5
  
  bee50c2b6fabf871e6ead84c7de301c6
- SHA1
  
  8ff26e4fe1497fa3631d3e3bc09dc699cae3df60
- SHA256
  
  65ce826370bdd1b2d150d2a3d669f1f6c57be375f7d58c19c8b610d33c4d02df
- SHA512
  
  08c55537cc172c644e7d6214907b2bccbfaea482237d8b57f9f06f74ef39c9d6ec089790616f915ac05f0f81a1911035cb7b0c6030270a0700b969b825182c49
- SSDEEP
  
  192:ZZTESfvMF2y5qWxrpzrclIRjQEAeekUrAgYf9pV0xU89bKuL+x37lX02gE3VJ4ov:ZZTEGkEOq4rVIWlQEne7rdYf9paxU89M
Score

3^/10

execution
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/FloatingProgress.dll
- Size
  
  25KB
- MD5
  
  1dcfa038b79b3df456a3c584d96b639c
- SHA1
  
  27b9e4cfc15ebe9ff69d65b9c46a2448c4fdbb17
- SHA256
  
  9278f0566af5574a4ba02e6a6a4752182070119f28247e1248a7ff6d9e1526b3
- SHA512
  
  0b6a06f4ee89a59fadd1714dc7bacdc77319d10c62f4d3b2aa33c6e163b0f35f75ec15f7d16bb944a3ff4167f387a61978923491151ea6ed55d167f47e9f03ce
- SSDEEP
  
  192:2h7WPcep+D7ifqTyFDoUjSFWbY3Lf+25meJVOuN+Sx10mvmWc4b6A:2INq8fc7fV8C+I2mw4b6A
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/GuiInit.lua
- Size
  
  115KB
- MD5
  
  0ff1902e00841548bed5d7242f5e3ec3
- SHA1
  
  052540aeec2427b4dc574f512e573378c1211cf1
- SHA256
  
  8ba8608672568c9640c21b9be0b5005aee1834a244d445cbb6479b4901785358
- SHA512
  
  7704ceda646a501a15ad5a35e417e09b7ff36e349a90e20cb32ddf6235e721909d2502e9360dfaeb527311cf17a226ca1b104172e4285d97aeaa264302cb6b21
- SSDEEP
  
  1536:W7oRRZjeoO85/077Q2BAHmTh3b+xLT2XANr1Lyi2D7ixoa:JpKoO8WbYy1ra
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/LuaBridge.dll
- Size
  
  39KB
- MD5
  
  1351244af9ca179c9081eda09662e904
- SHA1
  
  ca6667dd78b0435638dc00c7cc2a5667705b1905
- SHA256
  
  f70662193cf298b798a6c6535ef8f04779c1a2a7c9e26bd0db9c0659081b561b
- SHA512
  
  9cbddafee5c6db33cd3405ae26af063271db1022dc8923aa94d486c89fc666c0487a65a4ddce18688a5e6a08a1743accbe1302229edbc809cd88470afa6e3074
- SSDEEP
  
  768:/CBohqsJ6O1WAhBLQjtR5QYDibH2/ZZDsrj2qeQ4pXDHWPX:6oA46O1Zt2r5xmH2/ZVsT
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/LuaSocket/lua/ltn12.lua
- Size
  
  8KB
- MD5
  
  e440044afe6c761507a996b5b45ab0f9
- SHA1
  
  ef772c758fd5d6098b41375f35ac26f3963cc306
- SHA256
  
  b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
- SHA512
  
  8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
- SSDEEP
  
  192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/LuaSocket/lua/mime.lua
- Size
  
  2KB
- MD5
  
  4bfdaaab9014fe129bc6388fd5687c8f
- SHA1
  
  2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
- SHA256
  
  e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
- SHA512
  
  3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket.lua
- Size
  
  4KB
- MD5
  
  74dbe1060e91112e1c21ef9870b4a587
- SHA1
  
  86afb6aecb0a8387ffa5dead1cc9808332f94310
- SHA256
  
  15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
- SHA512
  
  73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
- SSDEEP
  
  96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/ftp.lua
- Size
  
  9KB
- MD5
  
  7309f4294ae4abb4f6ae657b2a98d488
- SHA1
  
  327d143e9f7a1835a58fdaf569a8f7a937fcf2c0
- SHA256
  
  9ba5df91091c46f0ffe0a93ace577a4833c92cbec1742113d0a2da9e568f9a10
- SHA512
  
  a44d2603af63828e8a0b1fbc7455305c616e5bae4a351b429e7e94a6aa7e4d6425f69d57d6a44ba87ee5d29accfc01c1f3ff288652120ff8f08a66543d357895
- SSDEEP
  
  192:GsooRaLonJfMxBs6gZO2zMAcTcGZqxOU6iOeBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7U6iOeBRkfYtW
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/http.lua
- Size
  
  12KB
- MD5
  
  61a2a779da46e835338f1ad1efad1717
- SHA1
  
  091d49262b7c1d1f4a89655673710f6d8a37baf0
- SHA256
  
  68fd4bc835da98dd1d5509333f8cc8861133c9439d3de879bf29a96de462940a
- SHA512
  
  657594b8ea1a2584c45d85df6c57c5ed43bfae2ece2db534e52ad66a8c7f8c1f85f99bc9329fd8d88a06b6fd2b9121b8e359dbdfd532da0e26d94352a055ec14
- SSDEEP
  
  384:x7/thyc+f7zLajrZhVoaOt2yyViz/vcGwkD:F/thyc+f7zyoaOt2yqiz/LvD
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojanupx

behavioral2

discoveryevasiontrojanupx

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32