62b7e4b8f61be797f17e347636f17c010d43778357033e5c70f340fca9d331dc

Sharing

Copy URL Twitter E-mail

General

Target
Document_Information_Jaya_files.zip
Size 532KB
Sample260620-akw7ssct4r
SHA256 62b7e4b8f61be797f17e347636f17c010d43778357033e5c70f340fca9d331dc
MD5 90ba49dd2c5e158c978fb16ef8a891b9
SHA1 242c533eca430cb3a9c5bb1ad744665e63d60f10
SHA512 4c7bcb54893c7b77f05163fd250442cba60d9bac6781f6f80fd9ba7f09e7cba280082ef865dc6a09af8176b4829025118338e763a4d8c90b60288e92a0d4f63a
SSDEEP 12288:O17FAq3IqvBnDTUJa7t6aVnWrp6ibTkc+Z5dHXD9kN:Kf3IqvJwJa7IP2vd5kN
TLSH
T1AAC423F7C4AA4E56FD0770B1236A867597F1EFA837CD00123F8E41ADA644454B620F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Document_Information_Jaya_files/Localepwuhh9.js_hRP6_T5mQ.download
- Size 11KB
- SHA256 3ea3764f781817bd3dcca815b4b11aa115e85d9ed4385119bdb3a7cf05659876
- MD5 efd91f1f3458a06680012d55aef4ecef
- SHA1 5a67f9287e78968c82a013241d7dc43011c6ce31
- SHA512 b8afc552e2a3820f9a3584f802c6b19f9d2e6f427c0081742daea01a2da89fe5d33bccfad737f92689164e340d98883ac5618282749cd8046ec3e7dc35fdc024
- SSDEEP 192:HR6euNxe3v++hrtB6Cnn9n9A/nkS/s8CwNupJLhg0om9vww7G/wlA9tRKKxhGp3r:x6eCxG12kuCwNoH0wlA9tRKKxhGp3Mpu
- TLSH
  T1A742432634962C054B8916BC341F1108BDBD897D8472FE78FCA9C0D139EBAFE1295F59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Document_Information_Jaya_files/blank_hRP6_T5mQ.htm
- Size 307B
- SHA256 8975e70b3584a9b897434834d68fd3d1862f3fe6e39610592d7263b8ba22594e
- MD5 5edaf0fbb54d17e51459a41f350d5c1e
- SHA1 4a25b391f8c94c9508091c121403771c169db8e8
- SHA512 b7b41d586ebd2e36d0b1c11a90732c8400715f2aa72b3c875bf0df0dfcdf143e736d4b7ceda1304e29bbf1b751737c26a5a338af4c26cc704cdc6a0b8aad92bf
- TLSH
  T1FEE07D7E541230239171F7F055D8F2A43982420560C54A8EF88030DE54DA33DE96325F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  Document_Information_Jaya_files/boot-vrvaf7.js_hRP6_T5mQ.download
- Size 344KB
- SHA256 2e7de5a6accb9e36526256e369e916cd5f7e8af80b27e51fb9787b79c73198b0
- MD5 51fae0776594640c83eb702695e4d67a
- SHA1 9ebe70f56715dbd4c97bfe83ca68a5dc71399929
- SHA512 63a66e883f6f4a9821c1e956942de1eb232668add36dd29e84620797300d6e0a33ee62939913ea9694d34a5b770961a25424e69692a0990608e1358c2820f848
- SSDEEP 3072:Z+TrLziz81hfPFiSdD3cRFvzKy9zBwrRospgLU:YLziz8tD3cRwy9z6ruU
- TLSH
  T1DE74094571582876C295306A227B0A0B333F4E9ED41D5D6CB966E8DC3BB9E0D0237BBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Document_Information_Jaya_files/box-u9kf4x.js_hRP6_T5mQ.download
- Size 9KB
- SHA256 242b0595c0d63d20ffa671efa9b4216d23bcfc976f6bd27c8ed4363e1c2b5328
- MD5 80f9d2e5db15ac77791eec37e7683f75
- SHA1 77a87bf21c5283e286cc1b2946d96b93b71bf81f
- SHA512 63a9ccb85694070c5d134dbe6eb29f6db100d1e35a84d6ae5919d4d2a177bb50d1ca987dbe3c85b5b8a7bf9612174ea1d0a7547429ec6a113ae88d100c345a9e
- SSDEEP 192:FmNHKWbtlhc+idOxmtU5HGdB5sL2e5rDLhSm93GowfuAJQyiyKan9ugBhiP:FSDlhXig2UMdB5sLRDJ93QfuAJQyiyKX
- TLSH
  T1C3227301F15926F6C2D972B802BA1D873F6F198DD60825C6B676F5EF47BCB000228776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Document_Information_Jaya_files/core-d0yor4.js_hRP6_T5mQ.download
- Size 423KB
- SHA256 a08f48eb86cfee56023a1504057680cc4015c6b9dee92de710344e614d1bcd9f
- MD5 24d12994641e32a754ed87ecf06c5a2f
- SHA1 18a2c06c58626bf8eebb8acad07d786296c89e4d
- SHA512 5f9c22762a2acd88f8032dae82ad46041d210e17f5b1aeb693b4f14235534f6baf8afc6286510e89e2e4e8a2c5702c703c5177cdd461269165f44c3995e61a02
- SSDEEP 6144:vhZ/M492dO5hcXIvT/MKrjcwxRC90qSlqTMjowlKYUP4lW5v3rgwu:pYTMjoq
- TLSH
  T14F94181075447837819970BA22BB290B73BE0DDDE40C6C6CFA66E8DD5BE9B850432F79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Document_Information_Jaya_files/detail-tdnb3k.js_hRP6_T5mQ.download
- Size 2KB
- SHA256 83c1a88740ca4d6de091b61562a5c925a9f3c903b3856f342109abe8ec85fb24
- MD5 5ecef9c7723fd65bf51dfffa0af1c4c0
- SHA1 e77f9e96b349c4b6ee9be1bde0049af29b569429
- SHA512 658550254111108ecb526a5a74aa33527edbc8ee81040468a1a62ea86e9e6937c92269cc65c9c7bffdb81081c1c791247d624bdf3d635ae8c39ae269b3d2325f
- TLSH
  T16E511421F5027AEDA6AEA1FC156BC60F5A5C0CDE82245644FBB9FB9901FCF4C3064760
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Document_Information_Jaya_files/form-u4ast5.js_hRP6_T5mQ.download
- Size 11KB
- SHA256 4320215c63c36bad566ee2157baded31a2068912ce372e9595fb0180b17b5d74
- MD5 1181e3b75b7ed79789859e20289c4a57
- SHA1 a5390fd5decaf11619bc2571478f8c9c5cb21f91
- SHA512 fae70f16e1cab415d08d5c246ca6d435c4b4125a9caa3a1266e35449037fcdea2814f276383b2a7cadae812b28797594aae03482a5e7e6e12fc7aec9783d5b2f
- SSDEEP 96:hsk7x4B/kxW1IeMum0G5tgZkqYYJDLYhwR0MTsZkPEnfccb7djz5xLz:hj+B/kZwRGjte1PEnkcbBX5hz
- TLSH
  T17032CD99239826CBC4D7727AD0FB0A063E5E4CE0A027589C7623FA571F78F411A347E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Document_Information_Jaya_files/grid-hnqfsf.js_hRP6_T5mQ.download
- Size 10KB
- SHA256 159b627cfcbc774793cd32d5e35acf8564f43c82e9e3d28cf1a5b9c8e6f8cd42
- MD5 199185c651a544c1060ace465b14a5b0
- SHA1 9edaa1ae7740f2faddf2e237c0851ed89686ebed
- SHA512 f5b3805783871841709933fbbd787802ee25ffd104e0e346c2408e3ffb1fb416921b2cf0a89e0816315e825ce40ad3fc069da36eb053fe74c82599cf12005406
- SSDEEP 192:J/CxU+H9sxCfwCCfGVX+zuJe3gXH041I/uI+8dnd814vo4HQqtm44MK9V:J/Cxjyx6VuzuJe3sPIvE9V
- TLSH
  T1FE22C51A716830B940B1713BA0B51A0B0B759E0DA203191CBF5B94DF8BFCB95317AFB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Document_Information_Jaya_files/header-jugqp5.js_hRP6_T5mQ.download
- Size 9KB
- SHA256 1a65868c7fe0597e0a9749af12df23d09643626060315f43772fc8e019ae68ed
- MD5 1f32217ca47b954384cb14af1cc2d0ee
- SHA1 b0109c303b83f078a4612a69aec4cb21f5f1db90
- SHA512 fe6fd4428a626e181f7605c803063541ea7a5d4d70a709a7b5e2bb5cbbad4fce9ae433cdb0cf28d32f66ce76b00180ce82a4c5f6d1a54dbd568cb7a8227b44f0
- SSDEEP 192:9q+Wv7Je4J+zxn/EJNaT8MHKSuRmccK52cnONrbU0:9q+W7JfJ+tMJNaT8MduRmcZ52zNrbU0
- TLSH
  T12D127618B04C78E942BDA179EAB55E0B6FA90C8CC129A544BFB5E1DF47F8F844091F35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Document_Information_Jaya_files/iedit-icqoy1.js_hRP6_T5mQ.download
- Size 7KB
- SHA256 9f8ad6c67c3e616fad3c4a4a06b692142029bb2e09735e8d65a4b485b5d697d7
- MD5 e34cd961e2ce5c4333de4e3a6b8ae39c
- SHA1 370b1ecb3481427536e80a22f3ef20b7a4e23cf5
- SHA512 157d888a36439565e17bbfbc0f44db13f7270206d84f3f02972bbb00fb990e563b8ce2f9af5b575d6ca867af3377554bc367916395f781280af8eccf4fdec19d
- SSDEEP 48:odav+BNFB+j86Dkenye21zRTKPq+PiyREoYwLtIio33DmlJOUjbPCrog+OrjILZL:eS+N+8mkzoqOiKq9jfHYXD/yTWDfhqo
- TLSH
  T12FE1EED7B402B535836E21DD22F6950A2B59D408ED3DEAB476F2E4C041E3ADB1712B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Document_Information_Jaya_files/input-sr6c9i.js_hRP6_T5mQ.download
- Size 20KB
- SHA256 71933bf8f96c9f64353f63bb7be987f7ccaa97de38afd7aed1ef8d9605f172b9
- MD5 5c0fe4ffcda0f413596539ce2af4a545
- SHA1 2b8a029d0bf71a9a2026a848efa583ab8c97b25e
- SHA512 2b441a1ab2fec2b6d8222082fe1449f5a8acfa27c970a51cc9be07207af22bca210b3044051aff13ce88ed85e99c0103982b50558dff1a07f6ce75e90f6515e1
- SSDEEP 384:NOaalruD0R+gTt5UlKL72r6uOchY7HRgiIBnk3MB0++H:NHiHHMAchQgiIBnk3MB0++H
- TLSH
  T19392965171151C7982A5ACF501F70C42BAB5D96DF80E5CA8FBA4BDC87AB52020223FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Document_Information_Jaya_files/jquery-3.3.1.slim.min.js_hRP6_T5mQ.download
- Size 68KB
- SHA256 dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
- MD5 99b0a83cf1b0b1e2cb16041520e87641
- SHA1 bc5836992c0b260496ba520fe1336d499bf06eb7
- SHA512 33ea8c2353c745c61c3a927378995a59b555c76249c8f23065ab3ca2bedd73decb64ea248ef6e97d1c729a156d9492f28e2177c06cabd0524e0380cb38d2d52f
- SSDEEP 1536:hLiMgk2gULYoXUmZx6+VWNL0kC8W90qU9JR7hDqEDqWSNB1gZFy/HG+FP:I8w0qU9JTtH3aP
- TLSH
  T19B6309DD72C6B06257AB71B900BF510BF23608997C4D8410F129E8E9BC75A4A827BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Document_Information_Jaya_files/js_hRP6_T5mQ
- Size 466KB
- SHA256 d731966b82bec68935635c2c4a6b54a66b97a5a0ad35565cac9621b504c4d381
- MD5 1e86ba01a677fcf6280896ec363eaf5f
- SHA1 30b92364fb42707b20488cc9cfbf320794ae64d7
- SHA512 6b69e863fca23d3946512d11a7415e4eec08c96d72ca0209eed6489ae7230e8666ce42d552ac4e744188ed69cb10ba72c5530ffa09c7a609f1ba1fc904723f06
- SSDEEP 6144:Q0yogDAFmvq/uYJycf7paX9Z08hr7+OyuI9yBLJXmoK:DNz/uY8/6Y4
- TLSH
  T176A4F9CDB3DA74625396F478903F018BA57B28A2B44CC899F189CCE42E7465A8177F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Document_Information_Jaya_files/message-2623m9.js_hRP6_T5mQ.download
- Size 4KB
- SHA256 2c9a405ccfb639508ad32d40032d7e8e43be336ba892e7a35b0a190394fa9837
- MD5 163849f92a59081af140551570381517
- SHA1 fb3af2cb73851a5309cc775b39f92ac812210782
- SHA512 1119655b2ef9c23f155d81a739a6419d632d23aca9eadd6a994fd19e8b58dbc0a58fb8c2b9dc27d212ad527af9abd096de847bd7221e158dfb498ded75e3e49d
- SSDEEP 48:EadwGbs5Ho+H4H3PadZ6rRWU1gGbj4MKS+tw+EBekLzYTImHUiqwirDAtsytS:Z/smkiDgwPekYId/LyM
- TLSH
  T184A1FE20AC782D0E956A167B35B13C03D9AC0C9AE45E7811FF6FB1E70381BD910A5F99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Document_Information_Jaya_files/popper.min.js_hRP6_T5mQ.download
- Size 19KB
- SHA256 f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
- MD5 83fb8c4d9199dce0224da0206423106f
- SHA1 d8503645c17f9856868a7def3dc0505e19a95ec7
- SHA512 95d735b0fbb5159f2c9a0920a7e1f09d8c956f57919f6c0498aac383526a3c46f4dbe122e243730c843453087400954b4058c9a16c06fbbeb8c7bd33cb94efe0
- SSDEEP 384:fYn0vf4wzTC9nNbR1PTM4CrBEQxkxpOxvYLmD75zfC5vIfg3rzGp/TidOgHhXjE9:w0vAwzTC/nM4BxpOxv/D7pC5vfzy/TiE
- TLSH
  T18C92A3DC3294B06647AB91A7A07F960EB1335875610E9410F19DF2E97C30EF9613BC79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Document_Information_Jaya_files/region-j93kzz.js_hRP6_T5mQ.download
- Size 5KB
- SHA256 b7285ba5e9ad158058ed9272b7bd3111f4f0a3d0dbde84020761e0bc2597e1a8
- MD5 e035720330607215933aaa502987c842
- SHA1 a58c4872bc4dfec752c5953ec23ed02a433b289e
- SHA512 67a01c325dda21e7123613961382cc34959816b8c56aaabfcb193956063945f8e1a02b49cd995f5f666d206a635b62da26170dd47b67b732547de80ab867dcfb
- SSDEEP 96:ps3swN7W57/6mpHOw3zWM5T5Q4yhOjiJygLaWiO42tis/EKtWlS+9:pqn7W8mtOw3zWQ5nAWiJXLbid2Ikx9+9
- TLSH
  T10CC16512B19426FB927622BE10B7CC0A3E7C0C9DD82A98D5F676F1BE05B8F440521F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32