General
-
Target
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118
-
Size
111KB
-
Sample
240702-hdlfqazhre
-
MD5
1e54f5f969cc19fde67ba03e92694105
-
SHA1
2a3840d9cfa01738846247b51c38e40dd67adf3d
-
SHA256
09020a8d64e1bfa4e061c63c3250fc4cd563e96a625e0d2a6cf0f1a658c33547
-
SHA512
233e1b7bb3cc10cc8bc309640b135dec28754c5f5dade0c2219422d3de128be054b38c5c50c68211c6de9030584cbbeef99af6fbe8b1a31c2ce228732134faff
-
SSDEEP
3072:7kYvLxQxIa+DvY+1j2qOix4J2vNbGfvGnd3gW5ZM4/uci4+D:7Hx0AQ+40NdndPZMTch
Static task
static1
Behavioral task
behavioral1
Sample
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118
-
Size
111KB
-
MD5
1e54f5f969cc19fde67ba03e92694105
-
SHA1
2a3840d9cfa01738846247b51c38e40dd67adf3d
-
SHA256
09020a8d64e1bfa4e061c63c3250fc4cd563e96a625e0d2a6cf0f1a658c33547
-
SHA512
233e1b7bb3cc10cc8bc309640b135dec28754c5f5dade0c2219422d3de128be054b38c5c50c68211c6de9030584cbbeef99af6fbe8b1a31c2ce228732134faff
-
SSDEEP
3072:7kYvLxQxIa+DvY+1j2qOix4J2vNbGfvGnd3gW5ZM4/uci4+D:7Hx0AQ+40NdndPZMTch
-
Modifies WinLogon for persistence
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1