General
-
Target
e6a45ca3b8f14fcf06a4d8f5b9885075_JaffaCakes118
-
Size
286KB
-
Sample
240408-e6tq1sgg3s
-
MD5
e6a45ca3b8f14fcf06a4d8f5b9885075
-
SHA1
387aad8298ecc23cd3c49237ca8098280b828da8
-
SHA256
096a9c507dab2aaab0025a7922015a6c4f6e551cab4f348b0180a6b7b2e2694d
-
SHA512
381b01a73108017923723714587358b35f8aa320d2f9ecd41f572245a5935da63827c18dea57dbc98a6ddb3dfd634f144637b322a15758101bfdae4e0d076434
-
SSDEEP
6144:319tPFmx+RLcd7FpigfViBXsVoLBnMq0mPuBK7co4rKX1jz:3ftPFmx+RLCFptuYYnPGBrhK
Static task
static1
Behavioral task
behavioral1
Sample
e6a45ca3b8f14fcf06a4d8f5b9885075_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
e6a45ca3b8f14fcf06a4d8f5b9885075_JaffaCakes118
-
Size
286KB
-
MD5
e6a45ca3b8f14fcf06a4d8f5b9885075
-
SHA1
387aad8298ecc23cd3c49237ca8098280b828da8
-
SHA256
096a9c507dab2aaab0025a7922015a6c4f6e551cab4f348b0180a6b7b2e2694d
-
SHA512
381b01a73108017923723714587358b35f8aa320d2f9ecd41f572245a5935da63827c18dea57dbc98a6ddb3dfd634f144637b322a15758101bfdae4e0d076434
-
SSDEEP
6144:319tPFmx+RLcd7FpigfViBXsVoLBnMq0mPuBK7co4rKX1jz:3ftPFmx+RLCFptuYYnPGBrhK
-
Modifies security service
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2