654a953494447af59862ce0b22977af7ad039cb5080702633b776fb7c28a4a52 | Triage

Sharing

General

Target

2b2d5a9fe9a80d25c2dd6d278ce25121_JaffaCakes118
Size

778KB
Sample

241009-fhlk6stdnf
MD5

2b2d5a9fe9a80d25c2dd6d278ce25121
SHA1

295da75dad8f2c3de466c5ae5e1e5ec733d4861b
SHA256

654a953494447af59862ce0b22977af7ad039cb5080702633b776fb7c28a4a52
SHA512

5e5121d9ba5ceb177a61de1d09d4ef5d36087978bf8bd9e1e480f00f2b1bbe9f8473a439674a855324eba882d667864ad87d6911537db91cd9368250ccf5ec45
SSDEEP

24576:wZPW2PptRgTGO5A9b7Zz3AD3Vjm9DwnrTXWh2b7kWRXZy:wjOy3z3eBjvXWYbAWXZy

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  2b2d5a9fe9a80d25c2dd6d278ce25121_JaffaCakes118
- Size
  
  778KB
- MD5
  
  2b2d5a9fe9a80d25c2dd6d278ce25121
- SHA1
  
  295da75dad8f2c3de466c5ae5e1e5ec733d4861b
- SHA256
  
  654a953494447af59862ce0b22977af7ad039cb5080702633b776fb7c28a4a52
- SHA512
  
  5e5121d9ba5ceb177a61de1d09d4ef5d36087978bf8bd9e1e480f00f2b1bbe9f8473a439674a855324eba882d667864ad87d6911537db91cd9368250ccf5ec45
- SSDEEP
  
  24576:wZPW2PptRgTGO5A9b7Zz3AD3Vjm9DwnrTXWh2b7kWRXZy:wjOy3z3eBjvXWYbAWXZy
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  271b5d1043c4402f08ddeae383f6979c
- SHA1
  
  2b88c58aa27bfb4979239579cd65d4c6c67a5295
- SHA256
  
  90485cb175686c3e97b32ebf99daa939c1a6f46e7031f71b72b81cd114fd5b51
- SHA512
  
  f8bd4b316726f05647162bb52a2aeb4a6cf5ee976fdb7817a3d25b868b83fb482c38d078f01d3a629afb0d6fa6ce409b2b3404398563137e22010074f529c11b
- SSDEEP
  
  192:i6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxT3K72dwF7dBdcQOz:i6JaVh4I5rpPbT3+BdhO
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  GetMusic.exe
- Size
  
  360KB
- MD5
  
  0eeab2a290bf79ad8f8b672d588f6037
- SHA1
  
  207cd0be607cd03e9a05564a8f7f91188dbf627a
- SHA256
  
  74ec1d85495233cd038435b3b86b1765acfd7299580e3186fe12462d074bbab9
- SHA512
  
  6c64833b88cbd37b2c5d632a8d3c2f6eca81b33910ba2737d92e9999ef0eec079b824977029ef162f9a4c47587f2e3fd45d322408a9d7c9f518970f937388529
- SSDEEP
  
  6144:iwIU3PpalX3O1IjTTpPjZEjaTwyfNQRuHeVHVueTTL8chLf5B/zsfiJtzGKjex:XINlnO1iTlZfbNQRuHeVHVuG7hL5B/Ib
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  RealYQLyrics.rpv
- Size
  
  64KB
- MD5
  
  81b044a6b57ad9cdf2dc2a21ede1a50f
- SHA1
  
  8d366efc77495e24d84e45a424a17f0cc135fe9c
- SHA256
  
  3e1cbc2a3933f35e70be6682e8c86eba46286c7a2af642abd5659e5b111d7eb2
- SHA512
  
  62e07a550e1c5ab76d07c58cc147da7296ba3123617ed58cb8938bf778bf092a6071c1b905c1cbce9a02f48a76eb09c3fabc6eda19a58eddde6303512be33f87
- SSDEEP
  
  768:WIkWGH6hiE8T9R8Q8WmbmD7U2iTYaFrr6F8smk0lqoNkb/:xmT9F8Wmb0Q288VoNkr
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  Uninstall.exe
- Size
  
  46KB
- MD5
  
  b51e596c57f6d919c3c5df362c651e96
- SHA1
  
  c396b68d6862e8e82fdd6cbf2ac06777e707b60b
- SHA256
  
  3523d26040cf6c96b5642f64ed273fed129e80114b5c17aa98b647f088ad24c7
- SHA512
  
  58173c86dc1469015569a2fb49b0e77e625e454f28d7bd50a03f2cf8160b3052bedcbdc1f9ffcbb90220bdd5da4797be798b8b82ce929bb89d6609dd5f95ca08
- SSDEEP
  
  768:HSup23EQCjlQRB8/ewZ1iU6nyYFxbssT/F/O71mJ5VtD3z9S6Qa/g0kDi7Woln:yu4EQalMK/ewGnh0mJ1D3Fxau7Zln
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  10KB
- MD5
  
  82f7926fd7d12e3eb8ed7b5232bcf956
- SHA1
  
  6065fc921b742cc86c77ce2533fc1d17359eb45e
- SHA256
  
  604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984
- SHA512
  
  b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7
- SSDEEP
  
  192:BGO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1a8SgMO:pKAFERdlxhTYUzqZaV
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  8KB
- MD5
  
  f42b19bd20c82eabcfe14273499e7664
- SHA1
  
  99310fe91a2e2fbe720761b5625e1f83afeee0db
- SHA256
  
  c99f30f5e2dfd948b7da2219bc5a0a73836a70e2486272b42c3ca45710b0316a
- SHA512
  
  c6867ee68b3099a9b03aba7367ed6e55576f874eccab71fbebbc9c3cb01f20e616615e8080c2a379b7e7da1abe6cd776f862f8c9ad4dce38d2fa79b48fa38e49
- SSDEEP
  
  192:Jc5gZmsbMx8dA4I5DpEPznEg0rh392d01:JigZHMxSA4kGzEzrp9
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  YQL_Lyrics_Common.dll
- Size
  
  505KB
- MD5
  
  28c7e6aa8096778587a99c143f9713e2
- SHA1
  
  4a19e18a8cacdfef307c162b3def6b59f828d6d8
- SHA256
  
  2f0f519a78de37677985635f98fe082c650f65c2b54df068cee1425bf5376f19
- SHA512
  
  787e86f3df94272fcdb1cc23e6e30f85cb7eb14b2f063ffdb865b4e718dab9c7657fbf0364648deeaba82194b09cbdbaa5e281d0d4a104cd6c77e32adb7bae35
- SSDEEP
  
  6144:jkSzET9tRoUc0xrDuwKSqNMIkKFVJgawzpRWlh1U7gXE0S/OlFAN:jCxtyUHJDiSqNgKLyaERWlh16tVYAN
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  YiqilaiLyrics.dll
- Size
  
  136KB
- MD5
  
  1173568d20839a0c40bd0d64309dda11
- SHA1
  
  f61e060c4ad8ea149253bebf1292f61384181acb
- SHA256
  
  d1a4269f7eca0c7552f9b6b9633973c6c31c19447ef552788816d8f4b358d5cb
- SHA512
  
  cf3c242def6010d18a7739989d2c17c130deb182e84df734ede75f446fe9ba8b57604112c0fe8b205ecb442d0a854b631a88190d2141cc3df331d8233880e0ea
- SSDEEP
  
  3072:8NroPnyMEfcv3V4/mL2ZznN4tKeXn+Mra:uoPQfYWOqZLNnG
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  YiqilaiLyrics.exe
- Size
  
  223KB
- MD5
  
  d70e9f379019af87a040c71a2fa44200
- SHA1
  
  2e84adff2584383e0d3ca321ea4831e03566b318
- SHA256
  
  8848e5d60794792848664360e1f107258f36b8463b90c80e29cc2543f7ce643c
- SHA512
  
  98986510904cfb91771866b68a0981655c021319ae582d6e2e83833d3004fa77b13f764e5b668fa33cb09fb197451c7c7a979d91dc5e6ecc8d8ca946b429a754
- SSDEEP
  
  3072:MBIdhQMo1hSVy3/CFxedv05XLSU97+OOJgtgjEH9tty2duoq+4ljoQ:to1OedvUXLSUmxKtnAoq+4p
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  foo_ui_columns.dll
- Size
  
  578KB
- MD5
  
  d6a04b9a48c21ace47d50a4681238ee2
- SHA1
  
  ffb07177077b5be4258adfbff8d7972f589036f4
- SHA256
  
  e2ef3556450075840768fa44e71070246cca670348e4b379d10c4bba1152b4be
- SHA512
  
  3049e950996587c64a1ad89d23e0018065cb38c5bc44ae0e38297e6120c148f3a3c01a09829af3c5d95e062148c2c55e8adf31dd7e89723732e2ddeef8f733bc
- SSDEEP
  
  6144:spKof+r1nt9hpFV95JUVtQ/DoD7RTL8QihGj/pbvAO/M5mvBES2C:sit9j9c9D7RTIQihGLpbvW5s2C
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  foo_ui_yqllyrics.dll
- Size
  
  139KB
- MD5
  
  15713fc717c391916ff8c9c0062483ff
- SHA1
  
  2c68984a8b150a6ddbb0e65f37875984d1125980
- SHA256
  
  863723f75d8d95c43f8b1448a8135365e55bf60b26f939cb19eed36eb7fbf360
- SHA512
  
  4dcc437752a7dc972a4a05724daee2c2e4183fc75b5c92ce8fb0854a57d1470c80bd87978e6df2481f9ad050032e9e9152b87bb5f8b8275f01d908a134d61d5a
- SSDEEP
  
  1536:RFhS4dKE+/sl/q8dqq3GqcUGI8yv/Xx3M6eNn2ohQV0vtmgMbFu5Pt0aU2O7D:zhtX1/q8Z3rpSt2VeAg0Fu5Pt0aU2O7
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  gen_yqllyrics.dll
- Size
  
  52KB
- MD5
  
  5a2de3b0a621044fa9fa183306c03d7c
- SHA1
  
  13866a5434f7ce37798105ef7fde392d81af7f9b
- SHA256
  
  1082367458e59b8aab15ba0847eb976fedb2439a39d90c6f309614e7a2b4f96d
- SHA512
  
  09d440d732bb7301cc0d986c56a2a23d4933ee8357afc1661b138530d35b65708b83ce2d98e314b2d30f900f9056ee86dcc680d0350c6b7b066aab59f3a3afdc
- SSDEEP
  
  768:vjzanFsHu9d+PN/qgR6UA8Omzaa9JZtltVt/YUqw9:vj6FLaz287zamzt/YUqw
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  iTunesYQLyrics.dll
- Size
  
  112KB
- MD5
  
  990265b730aa3fd053173cef5725bfe0
- SHA1
  
  4b2d27aa8afb0df20e20f23c0be9db02c5f48b24
- SHA256
  
  cc35d693ed7d7fdb2abebe3f083484582d139143715edb47776f8673a3800f33
- SHA512
  
  a4ea8a066d2bcea231153452181a003cad3d6e604e2f420097e665998bb9b801d12dd5438205d6ae89d2116b7aa87d0daa879daca83853bca396518bae1b93c7
- SSDEEP
  
  1536:UMN7ouwyQVAImnuDXeOt8jGq7s1JvfgKZtF/6irZ6JtFDYOaJ:UMc1/8C1JgKZjdrZ6JtFDYOaJ
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  music.dll
- Size
  
  59KB
- MD5
  
  abaffca5a367f350f13bff241aad6e98
- SHA1
  
  6404d135ccc8879ede1fd76aeb69e34cbdbdcb25
- SHA256
  
  ca6a3a7cf46504fe67eefdacb7acf6efe0337033f02fef5ad5a2f4bf844c197d
- SHA512
  
  0861f3f5a7415b9e931643764e19607db98f3c7e267d8f61b99933e04716f1f429b9a356dc4d555fe9733d537ea3e4b81880bbe5199d0265a0ce3728a74162df
- SSDEEP
  
  768:CY+KJTu+B9N3IEFTSILzi20aaYUWoIsVU90LI:CY+KJTu+SeFiZaBoIeX
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  vis_yqllyrics.dll
- Size
  
  70KB
- MD5
  
  7c0f30388e0033df9fca7b2a2a0f9d56
- SHA1
  
  66e25c379b09a4134963acb1c87696b60e94f444
- SHA256
  
  043cf2eee9f177dae38b2c6de59a9836276d049937f12c34c47c47be0fdef935
- SHA512
  
  53a5494d4b091e540cf163f14480d9977bf242e9d565d7922cad159034d76eced451698f361488e507552f78aafde6ff454c11ad39b0a96e06df1f7649f170ca
- SSDEEP
  
  1536:ncpTdga0ik0jKJMK5IXqIEfdB/QBw78N:cpRg/m0xfdB/YNN
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32