General
-
Target
048725634c77ed7223cd9b91d90b172b_JaffaCakes118
-
Size
142KB
-
Sample
240428-gr4nsahh2t
-
MD5
048725634c77ed7223cd9b91d90b172b
-
SHA1
40628d5ffe1bbd7915a628938a8acac0d9c77ba3
-
SHA256
568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51
-
SHA512
ad87648a4003832c7ec6129b2745c119c693f99628295cb318d285b8c5ca23d8ec0a4682fdbe3e8a880de0f6e9b84ed78ae3279c457477d5d6a2b27f1284446c
-
SSDEEP
3072:Urmeq2+/v4ZyY6yZHeLZVDZrHEzgGQNZ2uZlanCt:U6hy5cXZrHRlNou/anC
Static task
static1
Behavioral task
behavioral1
Sample
048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
048725634c77ed7223cd9b91d90b172b_JaffaCakes118
-
Size
142KB
-
MD5
048725634c77ed7223cd9b91d90b172b
-
SHA1
40628d5ffe1bbd7915a628938a8acac0d9c77ba3
-
SHA256
568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51
-
SHA512
ad87648a4003832c7ec6129b2745c119c693f99628295cb318d285b8c5ca23d8ec0a4682fdbe3e8a880de0f6e9b84ed78ae3279c457477d5d6a2b27f1284446c
-
SSDEEP
3072:Urmeq2+/v4ZyY6yZHeLZVDZrHEzgGQNZ2uZlanCt:U6hy5cXZrHRlNou/anC
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1