General

  • Target

    e5d289eea63583f375a3cab38f80c54d_JaffaCakes118

  • Size

    512KB

  • Sample

    240407-zkkansea8x

  • MD5

    e5d289eea63583f375a3cab38f80c54d

  • SHA1

    a49d23ea2b5b983f0633fa3874dc2d881c5e88b6

  • SHA256

    540cb30b3aeb11ced83393c47ae9f9b2e94442a3aa900f13a42e41309eaeab11

  • SHA512

    44738e0c69e1e78f1ca4421e5ca65e39c82a7d701974ba865f04588518f502fee1ec509e56540049cbfb9aa2efb4bb2b20eeebc443d8c88e578aa080e2a8747a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y

Malware Config

Targets

    • Target

      e5d289eea63583f375a3cab38f80c54d_JaffaCakes118

    • Size

      512KB

    • MD5

      e5d289eea63583f375a3cab38f80c54d

    • SHA1

      a49d23ea2b5b983f0633fa3874dc2d881c5e88b6

    • SHA256

      540cb30b3aeb11ced83393c47ae9f9b2e94442a3aa900f13a42e41309eaeab11

    • SHA512

      44738e0c69e1e78f1ca4421e5ca65e39c82a7d701974ba865f04588518f502fee1ec509e56540049cbfb9aa2efb4bb2b20eeebc443d8c88e578aa080e2a8747a

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks