General

  • Target

    ffd56a73a21ee8fcb915c4c2e024b804_JaffaCakes118

  • Size

    276KB

  • Sample

    240421-wgen8sgf9s

  • MD5

    ffd56a73a21ee8fcb915c4c2e024b804

  • SHA1

    432f9c2480ff5a990f010853d572240d21805033

  • SHA256

    2b556680c9a98b9616ae63704fe254fcff83792e09ca43effcff9437b597ac2b

  • SHA512

    8377314712fdea3cbd83a12ec40c928d4143b65872e47aa7b81f0c026f2d09793c69846e9076450566ecbf13f18cfc82129eca892d7f6c8aedbc52d9b535313f

  • SSDEEP

    6144:z+wViIDg+zXzvJvgm6yoBdl7W/3hk25fqh3H800e8fOqLcE4TdVUsrZ2:JiIE+zjCFhBdlC/a2IhKBOqLczlZ2

Malware Config

Targets

    • Target

      ffd56a73a21ee8fcb915c4c2e024b804_JaffaCakes118

    • Size

      276KB

    • MD5

      ffd56a73a21ee8fcb915c4c2e024b804

    • SHA1

      432f9c2480ff5a990f010853d572240d21805033

    • SHA256

      2b556680c9a98b9616ae63704fe254fcff83792e09ca43effcff9437b597ac2b

    • SHA512

      8377314712fdea3cbd83a12ec40c928d4143b65872e47aa7b81f0c026f2d09793c69846e9076450566ecbf13f18cfc82129eca892d7f6c8aedbc52d9b535313f

    • SSDEEP

      6144:z+wViIDg+zXzvJvgm6yoBdl7W/3hk25fqh3H800e8fOqLcE4TdVUsrZ2:JiIE+zjCFhBdlC/a2IhKBOqLczlZ2

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Tasks