General
-
Target
1bb0e36a487c3ae5f9507ea0285d6416_JaffaCakes118
-
Size
2.0MB
-
Sample
240701-r2z4fsxara
-
MD5
1bb0e36a487c3ae5f9507ea0285d6416
-
SHA1
0255931a7006c73090d98d7e1ed0e296a55454d1
-
SHA256
e41162a023fe7e4e3a764c2e8595f9b3c1a019a87e84410b6104b9971d45c565
-
SHA512
c433389874b17002fd60f03da0b9f91d3ca421f091f8139d045bc04c01e46be387542798bdb79045b762f87d252c82333d0c5b739c98898d39d7f7b32997c07b
-
SSDEEP
24576:fv5rzBjpZ9STx44vIXnd7s6WSu0H8O57HJ:ZQIXnx/cO
Static task
static1
Behavioral task
behavioral1
Sample
1bb0e36a487c3ae5f9507ea0285d6416_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1bb0e36a487c3ae5f9507ea0285d6416_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
1bb0e36a487c3ae5f9507ea0285d6416_JaffaCakes118
-
Size
2.0MB
-
MD5
1bb0e36a487c3ae5f9507ea0285d6416
-
SHA1
0255931a7006c73090d98d7e1ed0e296a55454d1
-
SHA256
e41162a023fe7e4e3a764c2e8595f9b3c1a019a87e84410b6104b9971d45c565
-
SHA512
c433389874b17002fd60f03da0b9f91d3ca421f091f8139d045bc04c01e46be387542798bdb79045b762f87d252c82333d0c5b739c98898d39d7f7b32997c07b
-
SSDEEP
24576:fv5rzBjpZ9STx44vIXnd7s6WSu0H8O57HJ:ZQIXnx/cO
Score10/10-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2