General
-
Target
edaa6e59550cee2fbd5d9bff13fc275f_JaffaCakes118
-
Size
2.6MB
-
Sample
240411-r4b5eagg6v
-
MD5
edaa6e59550cee2fbd5d9bff13fc275f
-
SHA1
a25647ed65bec66fbfe498adba57122978a7a220
-
SHA256
a36985ccc46e402fec760f74b5479ea1ff84736f0855b9be754f8513c9358096
-
SHA512
3519d05325085649cdc781447dabda543d377d533334d6c62d3660319902ba7a73563dcfc7af50773ac3488376994af5c512de6b978340f655aae8dc71a0ff09
-
SSDEEP
49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99G3:tKq4oEa9RQs+Cn4/UK3
Behavioral task
behavioral1
Sample
edaa6e59550cee2fbd5d9bff13fc275f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edaa6e59550cee2fbd5d9bff13fc275f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
edaa6e59550cee2fbd5d9bff13fc275f_JaffaCakes118
-
Size
2.6MB
-
MD5
edaa6e59550cee2fbd5d9bff13fc275f
-
SHA1
a25647ed65bec66fbfe498adba57122978a7a220
-
SHA256
a36985ccc46e402fec760f74b5479ea1ff84736f0855b9be754f8513c9358096
-
SHA512
3519d05325085649cdc781447dabda543d377d533334d6c62d3660319902ba7a73563dcfc7af50773ac3488376994af5c512de6b978340f655aae8dc71a0ff09
-
SSDEEP
49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99G3:tKq4oEa9RQs+Cn4/UK3
Score10/10-
Modifies visiblity of hidden/system files in Explorer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1