General
-
Target
05a2e3344a46f1622abbd332a1ef721b_JaffaCakes118
-
Size
240KB
-
Sample
240428-va6npscb75
-
MD5
05a2e3344a46f1622abbd332a1ef721b
-
SHA1
f5c12bd37af5ee19039082ce36826fb4b23bd8df
-
SHA256
a4a78765239beae1bae42d12be768d3f1bfd4b3ea589c1a96f5ceab3cb6ff836
-
SHA512
962eb802d9934fd35006d8760e080079d08b27c161428ccc1839f7d6a58f3e35f186a132d9e3d06a9f56488eaaa72ee2573bf6fc4aa6152746ff640e648a6cf0
-
SSDEEP
6144:qn/L+2u26wSpubJZpu7b+9RKCVQ5M+MB97lZhf1:U1uVwpw7SmqJB9Bf1
Static task
static1
Behavioral task
behavioral1
Sample
05a2e3344a46f1622abbd332a1ef721b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05a2e3344a46f1622abbd332a1ef721b_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
SFhelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
SFhelper.dll
Resource
win10v2004-20240419-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\README.hta
Extracted
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\README.hta
Targets
-
-
Target
05a2e3344a46f1622abbd332a1ef721b_JaffaCakes118
-
Size
240KB
-
MD5
05a2e3344a46f1622abbd332a1ef721b
-
SHA1
f5c12bd37af5ee19039082ce36826fb4b23bd8df
-
SHA256
a4a78765239beae1bae42d12be768d3f1bfd4b3ea589c1a96f5ceab3cb6ff836
-
SHA512
962eb802d9934fd35006d8760e080079d08b27c161428ccc1839f7d6a58f3e35f186a132d9e3d06a9f56488eaaa72ee2573bf6fc4aa6152746ff640e648a6cf0
-
SSDEEP
6144:qn/L+2u26wSpubJZpu7b+9RKCVQ5M+MB97lZhf1:U1uVwpw7SmqJB9Bf1
Score10/10-
Blocklisted process makes network request
-
Contacts a large (517) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
a436db0c473a087eb61ff5c53c34ba27
-
SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506
-
SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
-
SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
SSDEEP
192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
Score3/10 -
-
-
Target
SFhelper.dll
-
Size
28KB
-
MD5
51a7abee56ca990662a30e7366ceb97c
-
SHA1
eb69ff9bed5cc81589db302f86731c263531aabb
-
SHA256
f025b184cda7bc7d61d92818171bf16a3596d962034ff42ed0f38b8054620beb
-
SHA512
66c2879c24a06320c4397ef87efe532ea262483f9271884c76da610321ee7be8ab156c0d7c81dbac37a0ba9a3ef109273edede72efed036819e027697bd6ecf2
-
SSDEEP
192:sRWTjoxrpvyMLVcgvZw37jhB1B/PKyzwOWMtFZ4Lb5:sCjoxlLLaYZizeyaMtb4Lb5
Score3/10 -