adc721182616ca45452d2fc3dea5600c9ca4f8496173753f4e4a033039d4c6db

Sharing

Copy URL Twitter E-mail

General

Target
happybirthday-main.zip
Size 1.7MB
Sample260704-pgd95sa16m
SHA256 adc721182616ca45452d2fc3dea5600c9ca4f8496173753f4e4a033039d4c6db
MD5 c25d1a2b0a7f8ef71f424acf5cfee545
SHA1 2fcf47540a73536794d4f07831e5512b33d1b814
SHA512 6fac3c5923f8a0c8ff70087bd3c3ec9f1fef359858c751c84dec0aeca0337d93b0296680889c01a5ac65cad27633e6b3bc19e24b24719e77f7a905ccb2d35eb4
SSDEEP 24576:shwGz5KSM8Ctp1sYbnGRQfTSxoi5HUIvbnUsAFb7nJvePzX5EPT/tbMulDqwJ3Q:0rFKSM8CuYLGGKzqXbNvYLS7RBJA
TLSH
T13E853302EC351D26C0F8323867120A7F518BDF881AD35A5832E5B25E12751D7FAE6BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  happybirthday-main/README.md
- Size 8KB
- SHA256 e06b21fdf6747ff506e4fd9ad58d34b8a5e99783305f44df8aed21f2eaf6d4b7
- MD5 9bca7a4768f17212a1bf350bd32c6cf0
- SHA1 f84f88705ec4f7d67cf3a469d55b1abcee34ca7b
- SHA512 7f64586a6a3e6dd7e84b596c7a7cfe6e7a312a36cc18fcfce3b1e2f0dfd15569dcea938e05a6eed08a06bfcc3419a96ad951a6b6c6ff229036d43eef25d025e0
- SSDEEP 192:ACxFjKN3vGeSCu5rb+Dfq0TEw8aPZhkT3CnoqTITqe:ASFjKdGR/5Pmy0IaPZmsHITqe
- TLSH
  T13D02E7732C542B6A1F93C09773077F5AE9A170D6FA14C438B0DDE27C279EAA1423A546
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  happybirthday-main/config.js
- Size 4KB
- SHA256 ee65981dc00890e89d60dfaf69fbde5be03a41bc3139c49401f0a2b2268590c7
- MD5 ca913497fcacbe34def4d9b70a2631c4
- SHA1 3126d232f35c34c02646faafa3b92e82eab8c441
- SHA512 b5e364f4cbe657de457463f43444001638b3320a79400a88126b687c7334a2d2a9ffa909a63049f57edbd24d5fe15267df78d04e569a088d14a243b1f7764187
- SSDEEP 48:yukWiKK6+Tcm5gm/vBAqki3plH8aPyFpUYEwO06T/MXKHd8Jj74h:yVWRBm5N2q73rH8JeOwEm+I
- TLSH
  T16D811E3856B81221BA46C0FD778A15045610B14F3F14BC253BDEB2280FED96F41B6EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  happybirthday-main/img/ballon1.svg
- Size 1KB
- SHA256 a97e80831b92cc542ca6eba7ae373af206ee4f108fde5681fbbec74a166efcfb
- MD5 33e0b287318d204ef4b21b19ba3f013d
- SHA1 8ff58748fcd6dc649edace29ad9eaf6592fa2859
- SHA512 b44821d805308aa94bc71c34ee76847df328c1ca46893d422ed7cb49abf3a2456b1bd2ac53cf9ec6b536cb23005db908f18b1cbd9cfb4de0b5209be93ec1023d
- TLSH
  T128210DAD6384616CA20507CDDBF4A823249F64DA70E4E1EDEF44025100316FEC1FA22D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  happybirthday-main/img/ballon2.svg
- Size 1KB
- SHA256 2e103171b6fc95c184ea8b90db1fdcf0f6427bab36ecc0934948426d3f793e8b
- MD5 37228528425c6ff3756264d6ce75bc4b
- SHA1 81fa97d28c4595004904f9085efd701377768cc3
- SHA512 107be027a0330b3c085f803dfa15eb15e006fd2c5b7a548a8efd3bcc274a31bb91d96bebe1962c7062163d0a67993d55e644f81e1b76106d9ed64dea48899f4e
- TLSH
  T19F210FAC2345516846000BC4FFF8602928AF5189A3F5A7EC6A1402BA64316FA95EE96D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  happybirthday-main/img/ballon3.svg
- Size 1KB
- SHA256 34ab1f95fdf0a047fdbf296b8e79df26cce4cf0a1e60309c7f1524d1fb667018
- MD5 38f7841e33bbb2138f4429ee53fc01de
- SHA1 c1f724875cec65bb49a54aa7cfe8bafbab450e60
- SHA512 9d23864bbb8d09010428c262b1cf569be2150929dc81c6564a75a79dacf88f21048d8d2b6bb967d1a8268fb6c569652b3e43a535564020dcb636d5ffe834ae26
- TLSH
  T1D91135C5331C943591240392EBF8B567346FC0D853E192DCBD4603E508216BEE17AD2E
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  happybirthday-main/img/hat.svg
- Size 13KB
- SHA256 06c1d9a8c99f81cb7080dc080b7744c4c4f70f52a9f7730631efde7e7dde5f11
- MD5 e265315f0bcbcf8b4efb047ec80a5c84
- SHA1 9d58a68744281563de00fcea6027db9aafbaa774
- SHA512 a4ad66767622edd6a363cbf23389f44dc5075ca7b3235fe964073b486ae53d35e6be08b352bec48b5a36c8d5d561e7c4647a3cdc18bad15ae192b603f6b5eb40
- SSDEEP 192:/kAYG4QLG03a3Lq3TaILgdxgYcUaCL/l+a8LwIMg:sAQcRT
- TLSH
  T111523100D7B128DD429C959989FABC11D20D70ABC57D0A67BFBC06D5EFC31886369BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  happybirthday-main/index.html
- Size 1KB
- SHA256 3c3879a05687b3ae080d36525e47f63e7f2890f9315772e72ac8b63de90fae95
- MD5 63a52395109925cee1a7fcc75227c634
- SHA1 bd8f3a2005e3d1dd62cba8d43170d09a646cb449
- SHA512 0dbfc9b779a066f43d0d11c4abeb044b6d58e7c0d0d1ec6370d7a17346592a20fc4dd9f1ff7fdaab3a2cfaaf0374740cc12e122c7086cfc5eea93862ffe0618c
- TLSH
  T11F212E63EC4CC0EBA10043F67891704EE9A7C94E63E88868A0F3503EB9913D88567848
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  happybirthday-main/script/components/announcement.js
- Size 594B
- SHA256 a1e0813693a1c4fc55dcfef34ff0c90b4421c5a6097ebfee99366e99006ca6b2
- MD5 ecbf3329b10e12f9940a5716f35888d2
- SHA1 f2b4470070482b2e0994b1a6f15872b015ea27db
- SHA512 48843ff011a7b2818a037f869ab6bee9cf77f3494d34ea9010c76f3e905e268e5a7b0cc77aed462a20025fa4cdb72543ed41c86d41d1af7fd53460e52b83c505
- TLSH
  T1D0F0469939F1302055A7516B276F98033AB5109BACAE7D04F8BD839C6F3643B92926DC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  happybirthday-main/script/components/balloons.js
- Size 846B
- SHA256 0e29e2639ef5132736f59e0e1be818de9044c6a380fa4aa76889823670d34e3c
- MD5 fb303fc20b159a5329d1c8f4c44f260d
- SHA1 1e51f8a6be1b0e1a433d2d58077d12af6b915ae5
- SHA512 4236046d53aff327b0a0d3cf938f9f457bba0839ef4a3aa5ee81a814cb878525f493cb391d7b0dc2efb13e208df2dec93384981c7e89e182e292cde685324236
- TLSH
  T11501FD1821F33050815700AE33DB1612B5F51053BCA2ACA4BEEEC31C5F75E2381632CC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  happybirthday-main/script/components/chatbox.js
- Size 1KB
- SHA256 8b4b71a92ddf6d2cf59ee9c99657bfe0ce102b344fe601054f2f75491d8313ff
- MD5 683f254b423088d880b68e6a5d3aabd8
- SHA1 9ea80285d3c5c6a817d99df33a7cb86987020d04
- SHA512 34da4c9cebc305e3010f3a0739ab2d483fc065a82b3d538a54142944d2f5203030b486853f23aa248c65fb1c8b3592437853eca1d4057814ae7c1e5280dfb857
- TLSH
  T17721E15621F63030057711E7135F1B036AF450ABEC1B9E64B97D43981F9787B92A279C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  happybirthday-main/script/components/closing.js
- Size 1KB
- SHA256 ca948cbec349803e3aad0bf29019c39874f09d917afd6b6472bc1658990dc1bc
- MD5 2c5c46e4e833ef647e17aebf54d76f18
- SHA1 55f09563fb0df5a7d5dd41b5a699799c92f602d8
- SHA512 9b2c855ba58d8398dc7c49a852ab146949c7c156572ab6674b3ca225651e65426a65e440485dc95b9d2bb727a6cb22033a1d625318c9d2b7a33995e4706b10f5
- TLSH
  T15011CE5A31B12432856B9067730F2A0336F1008BDE8D6E08BAFCC2893F2582BC1673DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  happybirthday-main/script/components/confetti.js
- Size 1KB
- SHA256 0e8d4559a290958a43cc1f48c0cc88faa8287c0fba0c17fb1e143c8f46d7bd81
- MD5 b0211dc8a47f540e687ff70f20b0dd84
- SHA1 d16aeba8fd59daca042b9491820a0d6a89c093ef
- SHA512 5c75bf8575429d450ff25cf79071990e2d3b70fe4ae38063d36d3e1be9a2c7f0262523423163e2372cdef5e86c28ce80765b656923ee80df8d57d8ea14c2635c
- TLSH
  T1EC4123789C37302115A780AA2B975A91767A80CB3CA28C11B75DCF45BF1CC7860636AC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  happybirthday-main/script/components/countdown.js
- Size 1KB
- SHA256 3ddba937f2668636321dfbd4945046582d2bf9e15156234b4ea18c992ab85954
- MD5 31527d23e12b3a33e15557256cde4f5d
- SHA1 d7821adc74b77e82d9c7ddba8ffa3dbc5c6af877
- SHA512 0f90425e44d790c84ce881c7f6b71d197aca3efd26453f8e8a5ef2f5641dd807d4571825ea96e8e606b358a426cd15cda6eb9dec11bcc75bcd7e7cf1841235b7
- TLSH
  T12D21919490B330300DA3C0A62757570635FA1353FCAA5D18BABDC3585FBA42792D7198
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  happybirthday-main/script/components/fireworks.js
- Size 1KB
- SHA256 2ef5e1c32b9285c5d3b25d687d3ce1a1e471a2641592d8b9c77ba29bbc6d51a4
- MD5 b7a0dda6250bd4661353cd10bb3dd48f
- SHA1 f8422c0bcecfe95bcbff97e273738e8bb6707076
- SHA512 fc4b3592390a4bcd89724b2c58a2910adf3bf0bd93316a4e5df842704c01bc2190804f92f3dcd4a264da9c52bda137557e0245b7713b7d2e50a1745cc1640b03
- TLSH
  T1A2312214B2F1302254B79057279F190131B7114B6D9BAC0874BDD2649F7DC5BA1A2EBC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  happybirthday-main/script/components/greeting.js
- Size 1010B
- SHA256 9ca7265fdc52622b2b608f0e80ed3847a490d07ebe236de06414abf48a662c9e
- MD5 f472ae3bf3a10f9b0b8d09f253e6533b
- SHA1 a17030e34cd345b3dfdc437bc61b4f3bc28d7d89
- SHA512 49755c0c6d2a6ce2ae811196fe2c6bdacf43e1f4acbf04d968b4e730bdf78994fdbbd25862fbb7ca40dc0b803ed1477abdb4166b534fd3a86d82194c47e8da4d
- TLSH
  T16F119B6618F12130041359E3539B1A4BB1B0456BDCEB1D8578BCCB8C5F2A95BC3522E9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  happybirthday-main/script/components/ideas.js
- Size 2KB
- SHA256 aa751c77856caa58d61a56ec8ae2e01bd2da5b790484c69dada8ec439583e893
- MD5 5c132a0e01550db2852c83c9998e14ee
- SHA1 a9dac860f710ce19fca50bd81628d32dfeb2f6fe
- SHA512 0aa34015176cfa64161350ed7df908dbbb775ac3eb81c279d042a08f3dc9512e70377d5833e02e43debf1a2e525384e15c87e3ebcbd1f163b5faee1822982ec1
- TLSH
  T1BC513D8693F6201488635167376F164231B4019FBC32ADA0FEDD47489F9E13A5BAA3EC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32