bc89ef35f15c4ae4268961e8a8bc53a883afe23b3bf8e841a17499e0e9957b96 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4
Size 353KB
Sample250121-vlsafstrgl
SHA256 bc89ef35f15c4ae4268961e8a8bc53a883afe23b3bf8e841a17499e0e9957b96
MD5 0626220c6b36b91ef947bfadb5ffc3b4
SHA1 3d90a5f553480b4e27aecb1529a0f355e1304615
SHA512 fe4ebbe0f4111ed569f64be4c57d6bd2345f853973ec8f1191a5d15de5fae85a43b38bdf53a0369414672c5e8320721605bbc3efb466aba78010837f0bf2ef0e
SSDEEP 6144:WX7eov9mh+35YitVNuwGwKl+/97/x0jG4nO8NZHATQW+F6YYN+onLYcyz:4Ah+35Yit8vUF7/xN4N/Az+4v6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Targets

- Target
  JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4
- Size 353KB
- SHA256 bc89ef35f15c4ae4268961e8a8bc53a883afe23b3bf8e841a17499e0e9957b96
- MD5 0626220c6b36b91ef947bfadb5ffc3b4
- SHA1 3d90a5f553480b4e27aecb1529a0f355e1304615
- SHA512 fe4ebbe0f4111ed569f64be4c57d6bd2345f853973ec8f1191a5d15de5fae85a43b38bdf53a0369414672c5e8320721605bbc3efb466aba78010837f0bf2ef0e
- SSDEEP 6144:WX7eov9mh+35YitVNuwGwKl+/97/x0jG4nO8NZHATQW+F6YYN+onLYcyz:4Ah+35Yit8vUF7/xN4N/Az+4v6
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery stealer
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
- MD5 997ae296af5b7ca9aaa52f6844075439
- SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
- SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
- SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
- MD5 32465a07028b927b22c38e642c2cb836
- SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
- SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
- SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsBrowserOpt.dll
- Size 346KB
- SHA256 3ecdf73e76df53fac77110170d203e4f27f5751a728b85732ee7269d96413162
- MD5 2dd8fcef25c5238b7f03f39fc6288cde
- SHA1 85c4e016f0a0fbb6b94026a5ac92b1ad7730c65d
- SHA512 62ffe3745e16421d22e8e9be6329cb5ecef102012c0fe9bcfdaed5124fe9557700225af35d07381a9dc6e17fcc9b15a25aed6b95f6194bf793ba8a82062a6745
- SSDEEP 6144:RSf8qGJH+sm9HOP3C6RUT8zrn5noK06HwVu2ge7eiTLg8862iZc1TBriH/acZo:0f8qGZ+smR03C6RUT8fn5i6HwVu2get0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $SYSDIR/cont_milehighads-remove.exe
- Size 99KB
- SHA256 a335978dea32d6c9c587c074d74ffe10bc08387d763a8ef85a9995c05097a087
- MD5 b848c9ff117e8a3e664cabbd04a4a6f5
- SHA1 b04ad42b93a05a280378eab33225bfe47af55f77
- SHA512 edd410b981b30d2b19f4cafd3f888540f24ed9e2b7d21756b8357a6a53088ca27a0673e4f3d6010dcbce449779afb889483a57e50aa07a378b8ba4989a883c69
- SSDEEP 3072:Wd/vyWmJ8XKEvixA+D1eb4HzEeM/W10ofRKzd0x:WXrdoA+D1e8yafAzd4
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 117KB
- SHA256 44e729371099650904bcd5db0af7fdad6ffc01e336ae464f0bb151f329175292
- MD5 cd6e705cc6992e869f488ab211ac37cb
- SHA1 c9c71edd929c15bcf5ee286d4a9e9259d1590eb5
- SHA512 460173bbcff640721e54bb403e1f46d274e649a9db7d3b83d009a7f00354d434874dfdc009679e98cfb05548801b9eee78c25fe17b083fac396087ad3327debf
- SSDEEP 1536:G8jeHR5cxDyiJu+Sp3o7lCNj+fgERBNxOtyg5Fu/oZSY0vXuHznnULYU455YQ+5:tZHK4Z2j+fP31gu3eHTnULB455y
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
- MD5 997ae296af5b7ca9aaa52f6844075439
- SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
- SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
- SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
- MD5 32465a07028b927b22c38e642c2cb836
- SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
- SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
- SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $_5_
- Size 356KB
- SHA256 9c365454cdb24ca83cda0667f75ab32dff1b0abf8bb5861f83ad8c73ead7b7d7
- MD5 3b758b989821e5ca2b73033707430ccb
- SHA1 f4563245e38e5c746f9cc0ea7b1f1a38c7113b2b
- SHA512 f113ff7403b7305c6686f3d57d3c9e66262f29593c385de387d5258bcdebda323c8e4eacb79542c0db87952c6dc957754e30f16ee565404144c952fb755fc732
- SSDEEP 6144:p8Z3s9FSZkn2VT7aMKGvOIYnGrR+h+7eeMTTBkkRnRazS0RTgbpJRICa:ps3ak7DfnrR+yYTTekRnR5WgNa
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware discovery stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverystealer

behavioral2

adwarediscoverystealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

adwarediscoverystealer

behavioral18

adwarediscoverystealer