dd379d862b1c01c85e0363d20fcaeb13091766469ce63550ef1c57aa1739371c | Triage

Sharing

General

Target

0bfa15e1f9a9f6731b53784f854f3004_JaffaCakes118
Size

715KB
Sample

241002-w3yn8szgqm
MD5

0bfa15e1f9a9f6731b53784f854f3004
SHA1

980a4d77b44b26bddf454cb83f72522395a6269c
SHA256

dd379d862b1c01c85e0363d20fcaeb13091766469ce63550ef1c57aa1739371c
SHA512

ae0626adbadec53db77bd1320b583612d5e7da15542dbd07f0fa331e4cd7be4f5d9e37db0ebcfe61284f71333f72e17d544857fd41f00ca9199d7f67c2a603e0
SSDEEP

12288:kxpJwOiuSNHCNbAy/kABYRd+WGFCkUIsN3i18Ocf4H6r9z5:YpGO0HY8AQIFFC5IC48OcG6rV5

Score

7^/10

discovery evasion execution trojan upx

Malware Config

Targets

- Target
  
  0bfa15e1f9a9f6731b53784f854f3004_JaffaCakes118
- Size
  
  715KB
- MD5
  
  0bfa15e1f9a9f6731b53784f854f3004
- SHA1
  
  980a4d77b44b26bddf454cb83f72522395a6269c
- SHA256
  
  dd379d862b1c01c85e0363d20fcaeb13091766469ce63550ef1c57aa1739371c
- SHA512
  
  ae0626adbadec53db77bd1320b583612d5e7da15542dbd07f0fa331e4cd7be4f5d9e37db0ebcfe61284f71333f72e17d544857fd41f00ca9199d7f67c2a603e0
- SSDEEP
  
  12288:kxpJwOiuSNHCNbAy/kABYRd+WGFCkUIsN3i18Ocf4H6r9z5:YpGO0HY8AQIFFC5IC48OcG6rV5
Score

7^/10

discovery evasion trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/AdvancedTests.lua
- Size
  
  6KB
- MD5
  
  d672576a9cabae613aa65cbb9775fc06
- SHA1
  
  68bc11af82247d75a82c7d06872a9e1414d476f1
- SHA256
  
  cf97ab2cfca174fd813d69db36bdef058d7d17eb09f475b45f2d5f1fb15a0347
- SHA512
  
  a5c3bdd0b727d3356220171d79ef22aec4f7dc06f847be286d1c37a2ff2c5c1de248d1914437c3ebd8d8986c751e6f179d43b721d600b8589ab8c92b3acbec1a
- SSDEEP
  
  96:hhueI18hmhvuBlZJUFDfd5zuz03k0RrnMDYGEGnrJIn0wcYPr4YYtu0THcD:hhuk0vgZmFrd5aEZMDYG1rw0XqX4c
Score

3^/10

execution
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/ButtonEvent.dll
- Size
  
  4KB
- MD5
  
  fad9d09fc0267e8513b8628e767b2604
- SHA1
  
  bea76a7621c07b30ed90bedef4d608a5b9e15300
- SHA256
  
  5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
- SHA512
  
  b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/CustomBrandingURL.dll
- Size
  
  5KB
- MD5
  
  e4c1b74859c17671ffe1c0602fd56b44
- SHA1
  
  15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1
- SHA256
  
  2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
- SHA512
  
  9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925
- SSDEEP
  
  48:SMq1qEwUNRYDeKPTeKp4GN8C8hgIV2f4ag5pmy8WywlhQ7sp9CSC2bH:hq1q/QPKSKp4m80i2QGpvwLXLCtGH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/DownloadList.lua
- Size
  
  11KB
- MD5
  
  42541e73058b0794226e19a5a753d579
- SHA1
  
  cfbe2ec9af2e83c6ca99839b16fbaf873119ef31
- SHA256
  
  3e841a2e51345f2635dad25f452faad110cae87051e8b5b19b0c38c17b725041
- SHA512
  
  a5f3dd42f446bffcd9ddcb10f54ba13deeb3846a75bd877de84e4c3507ca5d7560a4666507420bc13e01b2af72b219dfde65ac795022ea61e223d8ba5bcf81c2
- SSDEEP
  
  192:nEEiapMCIJx4Q6Pdrq814WUJsQO3ylSSorDGz:nuMpkWQodrP4pvOKSlW
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/DownloadThread.lua
- Size
  
  7KB
- MD5
  
  60d2923c1ae582ba9d5c0d4fc5d26bdb
- SHA1
  
  89f9b6c63098f5c0c2180051fb69a8753c3ff063
- SHA256
  
  521fc63d7fb62df36d8764931253688bd3e53eefd694f8450a63f8a40b2ff566
- SHA512
  
  fc6d506571de9b11d1c76ed59faa8700f14d5ec67d9240b1b93b414dbb4625894f012cf1a10d41e73fc17eb07d130a365c749f26b8126c742ea6cd704863d013
- SSDEEP
  
  192:FQXFPLWUOp+1IRsDAgYfYpV0xd89oXuM+x3160mgn:FQtqxEdYfYpaxd89oeM+x315
Score

3^/10

execution
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/FloatingProgress.dll
- Size
  
  25KB
- MD5
  
  1dcfa038b79b3df456a3c584d96b639c
- SHA1
  
  27b9e4cfc15ebe9ff69d65b9c46a2448c4fdbb17
- SHA256
  
  9278f0566af5574a4ba02e6a6a4752182070119f28247e1248a7ff6d9e1526b3
- SHA512
  
  0b6a06f4ee89a59fadd1714dc7bacdc77319d10c62f4d3b2aa33c6e163b0f35f75ec15f7d16bb944a3ff4167f387a61978923491151ea6ed55d167f47e9f03ce
- SSDEEP
  
  192:2h7WPcep+D7ifqTyFDoUjSFWbY3Lf+25meJVOuN+Sx10mvmWc4b6A:2INq8fc7fV8C+I2mw4b6A
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/GuiInit.lua
- Size
  
  101KB
- MD5
  
  46aebbdca78ed8344b9ee3714df791e0
- SHA1
  
  a82afad30088054ac1bfa063173b0d6223e32a9e
- SHA256
  
  d959f71a3fb17fa6247703df6d56076faa117f2a5f513f1db1980139a2d77bcb
- SHA512
  
  3dcc3b7f503a39c0cd377dd54498e7f3f4ce5aafde2f73b7d8f69f46b38699d249b457120f3686d3d9e3f08a91fcb164036456845f68c7aec3b0ba1887759498
- SSDEEP
  
  1536:W7fGRZZfb85/V7lKBsQmTh3b+2Iz2DBP5ULyi2DiJQN:qMVb8DNky1+QN
Score

3^/10

execution
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/LuaBridge.dll
- Size
  
  21KB
- MD5
  
  87b32480731b807ad81458425bf7f72c
- SHA1
  
  bfa02f2849b7404fbaa8ee43571b6792b61966a8
- SHA256
  
  7337f9ecf47b528e62d63a360e53502dba87e9d1f6f2c99620d2bab83a86dfa7
- SHA512
  
  c5011e2a2d2f1b98d7068d9b1aa7294ef2bde2dfe3bbcdb9cea3f57355b627e2743889a9cf6061c6471e1c0022d8aae5fb6c473a69edeae4e8b3768915d99c4a
- SSDEEP
  
  384:GHjNKKUuBe94xHtFWuxe+tWaUpA04LXulqft9HHaM:mNKKUuBeaxHtw+e+tWaUGXuEV9H/
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/LuaSocket/lua/ltn12.lua
- Size
  
  8KB
- MD5
  
  e440044afe6c761507a996b5b45ab0f9
- SHA1
  
  ef772c758fd5d6098b41375f35ac26f3963cc306
- SHA256
  
  b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
- SHA512
  
  8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
- SSDEEP
  
  192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/LuaSocket/lua/mime.lua
- Size
  
  2KB
- MD5
  
  4bfdaaab9014fe129bc6388fd5687c8f
- SHA1
  
  2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
- SHA256
  
  e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
- SHA512
  
  3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket.lua
- Size
  
  4KB
- MD5
  
  74dbe1060e91112e1c21ef9870b4a587
- SHA1
  
  86afb6aecb0a8387ffa5dead1cc9808332f94310
- SHA256
  
  15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
- SHA512
  
  73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
- SSDEEP
  
  96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/ftp.lua
- Size
  
  9KB
- MD5
  
  7309f4294ae4abb4f6ae657b2a98d488
- SHA1
  
  327d143e9f7a1835a58fdaf569a8f7a937fcf2c0
- SHA256
  
  9ba5df91091c46f0ffe0a93ace577a4833c92cbec1742113d0a2da9e568f9a10
- SHA512
  
  a44d2603af63828e8a0b1fbc7455305c616e5bae4a351b429e7e94a6aa7e4d6425f69d57d6a44ba87ee5d29accfc01c1f3ff288652120ff8f08a66543d357895
- SSDEEP
  
  192:GsooRaLonJfMxBs6gZO2zMAcTcGZqxOU6iOeBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7U6iOeBRkfYtW
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/http.lua
- Size
  
  12KB
- MD5
  
  61a2a779da46e835338f1ad1efad1717
- SHA1
  
  091d49262b7c1d1f4a89655673710f6d8a37baf0
- SHA256
  
  68fd4bc835da98dd1d5509333f8cc8861133c9439d3de879bf29a96de462940a
- SHA512
  
  657594b8ea1a2584c45d85df6c57c5ed43bfae2ece2db534e52ad66a8c7f8c1f85f99bc9329fd8d88a06b6fd2b9121b8e359dbdfd532da0e26d94352a055ec14
- SSDEEP
  
  384:x7/thyc+f7zLajrZhVoaOt2yyViz/vcGwkD:F/thyc+f7zyoaOt2yqiz/LvD
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/LuaSocket/lua/socket/tp.lua
- Size
  
  3KB
- MD5
  
  2cad406e591cade482c7f16f39c21481
- SHA1
  
  84a3ab88ff7a9102c2c6d21bdb6eede6862167a4
- SHA256
  
  343afa62f69c7c140fbbf02b4ba2f7b2f711b6201bb6671c67a3744394084269
- SHA512
  
  ecc98991c25036b54f2bb71b3229e4bc8fb401e55db0e5f9c958c2a7b00b40fc9ae2d7e45002d4f2a03cec85535785c42ab6d20476fe095a76444d143493b145
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/LuaSocket/mime/core.dll
- Size
  
  52KB
- MD5
  
  4a4845ba1666907f708c9c10a31ec227
- SHA1
  
  1ebf626adc84147e5114885ce779f92d6eb68f3a
- SHA256
  
  a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
- SHA512
  
  d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
- SSDEEP
  
  768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojanupx

behavioral2

discoveryevasiontrojanupx

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32