General
-
Target
1ccc116fb3a2581a67361d6801454cf9_JaffaCakes118
-
Size
4.0MB
-
Sample
240701-2ry4hsycnk
-
MD5
1ccc116fb3a2581a67361d6801454cf9
-
SHA1
89c9ec99b2e726280549108acc1d535522515b0b
-
SHA256
58e115b8416dbe6ff420e025335c242c75e9b050f155b4c13ec32ebd12bffba4
-
SHA512
2444a3bb4f0c607ff636ec3afc03a8ce7e837079743dae7fe3b973dfac1a5354878323c69cad6b8b3f002ebca656dccd21a43741e72aa41f7883d49fa5e802c4
-
SSDEEP
98304:mJEcWNza2lBVUu7hlwv8Swia4IeFoRT0OBTialRARa2fxP:mJELp7jS8Swia48BBTDat5
Behavioral task
behavioral1
Sample
1ccc116fb3a2581a67361d6801454cf9_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1ccc116fb3a2581a67361d6801454cf9_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
1ccc116fb3a2581a67361d6801454cf9_JaffaCakes118
-
Size
4.0MB
-
MD5
1ccc116fb3a2581a67361d6801454cf9
-
SHA1
89c9ec99b2e726280549108acc1d535522515b0b
-
SHA256
58e115b8416dbe6ff420e025335c242c75e9b050f155b4c13ec32ebd12bffba4
-
SHA512
2444a3bb4f0c607ff636ec3afc03a8ce7e837079743dae7fe3b973dfac1a5354878323c69cad6b8b3f002ebca656dccd21a43741e72aa41f7883d49fa5e802c4
-
SSDEEP
98304:mJEcWNza2lBVUu7hlwv8Swia4IeFoRT0OBTialRARa2fxP:mJELp7jS8Swia48BBTDat5
Score8/10-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
System Services
1Service Execution
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1