General
-
Target
e28ef345a79740d76e2a1cee292e4c75_JaffaCakes118
-
Size
2.0MB
-
Sample
240406-pt3s9sba52
-
MD5
e28ef345a79740d76e2a1cee292e4c75
-
SHA1
e4aac6062af45f5b03c0642bbd5f31d7cebac6a5
-
SHA256
10de7fcb912db00e42000522e1ce05c54d6e8df01874125314b4b6bf68ce4cb5
-
SHA512
c8c2ffc51d4392c1d7b81be9af045cd72ef40bab2bb3e343ad38cf0ad4dfe576075f13b3c9404ec887e4ecc46f2dc30e8387eadc5ec317a8af7a7e86ada33b0b
-
SSDEEP
49152:rG9cVgsLdtm9Ul9k9VnUmuzs9m4r3Mz2VvYbeEoKXXfPPlWE5:rwMgtUl9UAOhEoYXfnlWE5
Static task
static1
Behavioral task
behavioral1
Sample
e28ef345a79740d76e2a1cee292e4c75_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e28ef345a79740d76e2a1cee292e4c75_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
http://galaint.onlinesecstats.info/?0=115&1=1&2=1&3=57&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=dkqtnbycfl&14=1
Targets
-
-
Target
e28ef345a79740d76e2a1cee292e4c75_JaffaCakes118
-
Size
2.0MB
-
MD5
e28ef345a79740d76e2a1cee292e4c75
-
SHA1
e4aac6062af45f5b03c0642bbd5f31d7cebac6a5
-
SHA256
10de7fcb912db00e42000522e1ce05c54d6e8df01874125314b4b6bf68ce4cb5
-
SHA512
c8c2ffc51d4392c1d7b81be9af045cd72ef40bab2bb3e343ad38cf0ad4dfe576075f13b3c9404ec887e4ecc46f2dc30e8387eadc5ec317a8af7a7e86ada33b0b
-
SSDEEP
49152:rG9cVgsLdtm9Ul9k9VnUmuzs9m4r3Mz2VvYbeEoKXXfPPlWE5:rwMgtUl9UAOhEoYXfnlWE5
Score10/10-
Disables taskbar notifications via registry modification
-
Sets file execution options in registry
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1