2ee980191d7bc4c5140209a95bfc80cd90b87b404a3c22ab828ac428b9d50d55 | Triage

Sharing

General

Target

JaffaCakes118_e2bdf48f2c3680bea4b0b150ce6d8cc3
Size

952KB
Sample

250120-k9wmnsskhy
MD5

e2bdf48f2c3680bea4b0b150ce6d8cc3
SHA1

b5630b3b7ee6b9a069ce64038bc88bdadd45d8bd
SHA256

2ee980191d7bc4c5140209a95bfc80cd90b87b404a3c22ab828ac428b9d50d55
SHA512

7787330c0eba8820f27186e1a3157b37cf2ce07978ac7e17d1681147dabf8eabe7ae0fd4833f6df8d36ff0ed2b226447f43a837f24e33724613ef8be970fcf3b
SSDEEP

24576:9jVuhQyxVR8mfhDzqABeAlzmcCVVj0LXgbUWg+:9jVuNXRlfhDzJBeKeNUWg+

Score

4^/10

discovery

Malware Config

Targets

- Target
  
  JaffaCakes118_e2bdf48f2c3680bea4b0b150ce6d8cc3
- Size
  
  952KB
- MD5
  
  e2bdf48f2c3680bea4b0b150ce6d8cc3
- SHA1
  
  b5630b3b7ee6b9a069ce64038bc88bdadd45d8bd
- SHA256
  
  2ee980191d7bc4c5140209a95bfc80cd90b87b404a3c22ab828ac428b9d50d55
- SHA512
  
  7787330c0eba8820f27186e1a3157b37cf2ce07978ac7e17d1681147dabf8eabe7ae0fd4833f6df8d36ff0ed2b226447f43a837f24e33724613ef8be970fcf3b
- SSDEEP
  
  24576:9jVuhQyxVR8mfhDzqABeAlzmcCVVj0LXgbUWg+:9jVuNXRlfhDzJBeKeNUWg+
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1
  
  5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA256
  
  8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- SHA512
  
  814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP
  
  192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  ab73c0c2a23f913eabdc4cb24b75cbad
- SHA1
  
  6569d2863d54c88dcf57c843fc310f6d9571a41e
- SHA256
  
  3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
- SHA512
  
  99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
- SSDEEP
  
  96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PROGRAMFILES/QvodPlayer/QvodInit.exe
- Size
  
  117KB
- MD5
  
  d8ce693166ac2e6134867469a18287bb
- SHA1
  
  7f4a6c341f7b29a8c2a2ff1255e8a6124b09fbae
- SHA256
  
  afcc952523fbc909ccb7853f4bc6875c9738eaedf90c25f84665f2e6a16e64c3
- SHA512
  
  34a5fefd5d645599b869a1da3a1ad5a503a4cbc560a10cdc14db8b97d82bf019ca9a1f7272b041325aefc962122c59dbc42fd21d750f6aa8feca934c1897ce88
- SSDEEP
  
  1536:IELe5SZqtVykxJPLbtTJJlW0ijDORNSpLf2Xh9PRUGVASsu2VAaLCN:hZ5WVntTJJlW0ifORNSBOrRUm2Vxu
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PROGRAMFILES/QvodPlayer/QvodTerminal.exe
- Size
  
  86KB
- MD5
  
  2a2a889992e5d7fa6d72d6f0d0180b4f
- SHA1
  
  ea37ff34b5a2a06663aee78e881495c4cd242abc
- SHA256
  
  39ec3bc195bb661e5c02979e18d8ce061a5d18a91241cb5c3f98ded625f33ac4
- SHA512
  
  716544f5e71a66f3e40246adc688313d722039fa14c75cb74292dc4711eb4631716653b62bc1e2d46f4fcd4e9f90f74d6947ac50e85c8b9c4d070d94b8d1ae1d
- SSDEEP
  
  1536:ENwFeMWIqxanpmqySaFe93CUqFWlVUdLAwUGdawZKBC0GG2YqxjY0LyUXzKz1BGb:3WZMAq4e03GwRowUBCfbpjY+mz1BOKRM
Score

1^/10
behavioral11 behavioral12
- Target
  
  AniGIF.ocx
- Size
  
  109KB
- MD5
  
  596a028e34bde9e6ce5aafe5692a8767
- SHA1
  
  07996a5139a1e798ceede09cabe1f91c0a5965fa
- SHA256
  
  3dc18b4e38e3a2ebc6b5e01fdbf418811f5b1bce9003e44d8cc10e5814d95de9
- SHA512
  
  aee0ec633c2d5777380c78878436a5a5f4ca845e1ec09bca48f4f5113512f8be0fa16963108f32fe1d33dfe6af7a42daf506d835e53581c8b060ea5e47edfd2c
- SSDEEP
  
  1536:W/oD7F6m2ox7sbUIW5FRyKcPo0ZNX5CKj2lTnU90q2GR+:soD7F6m2ol9cPtNX5nyTnqDT8
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  Communicate.dll
- Size
  
  49KB
- MD5
  
  33358253ff0905840a666d20f0382940
- SHA1
  
  d9856919afd082e14594c95fdb061e446b4c559c
- SHA256
  
  92382bc4ea1cfb2e6cfdb6e3a85c9c1c214ee3674286fb4cd7b4e8afb42a925b
- SHA512
  
  ca613fb0f23230c5cb78dfebb94f991c658909457bf4771fe869be301530f317eca083e486b4e1ca9e6ecd05a588cd643b99895353703613e15414547e2e6be6
- SSDEEP
  
  768:nJdg8lNDwz/kCTjCDidNJxvaBo95DHoUWA68EL7sW:nJdg8AkCTjYidXZdloXIEt
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  FSkill.exe
- Size
  
  137KB
- MD5
  
  5ecfd03e9e4fa495ec96af79a2f3c8b6
- SHA1
  
  b86f93faac2d3630498e2c0df1bd730c7a7cb76b
- SHA256
  
  11cc564a15a6b7088441e756a8c86d69e37fd83cf462a0357e778580130d039f
- SHA512
  
  73184950aac793876b87ebd46c8fa50e4882851c81ba552f16d5afb7317178bf59d079353cca1e7ab10ed2ecea54757b5ae903a60d0c18989a7b6af9334d89dc
- SSDEEP
  
  1536:6FSwaJyfmnCJNFSwaJyfmnCJJ9qpqh6aQbP3IrkCJjaJyfmqS9Yle:+PfmnYXPfmnYJ9qA6bP3ikYFfmqHle
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  VnetClinfo.ocx
- Size
  
  77KB
- MD5
  
  b8fdd277eb7fa93f98c3ada83020a9a3
- SHA1
  
  5bf85344ad3c5451d3e2b3d0f62783a2bd19301a
- SHA256
  
  c6d20217ba118165d6f97067493f663d11b122501384898fe899b0018daa710c
- SHA512
  
  2c6afcbb6b73cd87d99078a366973a6c58d3478948c5a20dd42d133f94dfaaad3f6b7b0d92aef75c98a051411a0bce3ff293d331900b3941ed4b0ff1377aa362
- SSDEEP
  
  768:Xv3wc77UtCcjS+8mcKgqCm36PcQ9rhRv19ClA1dJ9mQzAjsQ01jUGDQMDL7sQO:X4c77a/8mcZH0o9RjClWnAkaGEMDI
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  YBNTSrv.exe
- Size
  
  109KB
- MD5
  
  823fc2eed5ad911695d848ef6e621b32
- SHA1
  
  9945f86471b819fc33d23b254a30e76593d44270
- SHA256
  
  8e1658a24c1b135764257cf59ac3a8d07b6fa1594adf9a161648acd3181ffc2e
- SHA512
  
  8845dac46ce480bdb18dea0d7021d5007e7a2eb2150ba93a020b55eb9d80466aab9cac1496a702636ca8f4c77bab7b9381bc0881107d2f91d79e96f75bf016fc
- SSDEEP
  
  1536:drrkjsFSwaJyfmnCJZe9V7EIg6OMHApfMYy1RCJjaJyfmqS95Gw:drrHPfmnYZe9Ng6OMHApzORYFfmqqGw
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  
  YBProces.exe
- Size
  
  117KB
- MD5
  
  4c01abd1b046721c40d824d1e4c64f9c
- SHA1
  
  55e168ac9c8930c34317a7e02e23e640a6e92544
- SHA256
  
  43e88cf920be9b9117fc713f8a586701a5f5da50c3c40a2f7bcedd53a71b15d2
- SHA512
  
  ec93569071231bf2b616ec7ee2356a7271b2366943fa4ad21a4e6d2a24ac754a3f5eea91bb3884dd0c7a94225c67372be6d999a9d5799e0591278ae974bd2683
- SSDEEP
  
  3072:FPfmnYj/cOjvka2lKKUCIVE1IYFfmqe9J:5mkkYvka2lKZCvbm9
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  YBProces.exe.new
- Size
  
  117KB
- MD5
  
  4c01abd1b046721c40d824d1e4c64f9c
- SHA1
  
  55e168ac9c8930c34317a7e02e23e640a6e92544
- SHA256
  
  43e88cf920be9b9117fc713f8a586701a5f5da50c3c40a2f7bcedd53a71b15d2
- SHA512
  
  ec93569071231bf2b616ec7ee2356a7271b2366943fa4ad21a4e6d2a24ac754a3f5eea91bb3884dd0c7a94225c67372be6d999a9d5799e0591278ae974bd2683
- SSDEEP
  
  3072:FPfmnYj/cOjvka2lKKUCIVE1IYFfmqe9J:5mkkYvka2lKZCvbm9
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  YBStart.exe
- Size
  
  16KB
- MD5
  
  d21cc18de05fdf7b80425d087180f5cf
- SHA1
  
  294aee354bef1b00b57db7d9f4cea60e4e04a45c
- SHA256
  
  d6e35b4dfd3608c346b9df2ef6c5aa34456033bc25e1bd896e09579d4f3a0578
- SHA512
  
  5d721c2622e38caebbeb0c36adb9c2a86ebf89ad3359c690ab13f8d248d7fa0bea25d56b9b44830b897a6c715b8647b7548ac7cf65443beef904764cbf6b1982
- SSDEEP
  
  384:F27wdSK/8F1kI0wcSg2E3uR1W57g3MOpQX8ccQgOLLvYiDsSVd:E7wdMcMmuKjO+iQNL7s2d
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  YiBopal.exe
- Size
  
  303KB
- MD5
  
  b36102a35fab38a128b00a4f99f25df4
- SHA1
  
  86ab4c24e880c297f8de5120478cdc00e8a92eb9
- SHA256
  
  b4732a475935d5e0611e7633dc8e913058a552230f89a559fefd02b9d07eddfa
- SHA512
  
  45035ac23d8bf754919e9a742a35c5e9bc2825505aa1641ed59116069b6191dbadf2f26ce13eb1a517862ce548a43acd3d057d26961fee7fede105a13e901493
- SSDEEP
  
  6144:qjMPtFsm8+T+Hh2Nk66DCLoZrJgBM+pm+y6lXy:Dt2meHh6RWCLoZrJeM0lXy
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  play.exe
- Size
  
  573KB
- MD5
  
  397708652078f31aefeeda0b0fed18bf
- SHA1
  
  9e68789d7c0f16c0723101d9c643460567adbbcc
- SHA256
  
  0abc2db0f75fcbdcdb7004cc08ad9e999326a18fb2bd5d33f724e738933b00b3
- SHA512
  
  d7ad90fd4ad04bdf183015b4f1be4040cb905cbcfdc2ec2eb47f914b5dedcc17871078c07fbe48b2b4ef48d24c06abc499d9a516e3b04769bf45725537922ec3
- SSDEEP
  
  12288:v4asSmNRGkugfTHMPWoomXCjraVFquq3X18YZAGm9:1WNRGkugbHMPWooYIrh8YZAl9
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32