General
-
Target
07b60dc343df2ab67d7a586d0a6a5be2_JaffaCakes118
-
Size
271KB
-
Sample
240429-p4y8tsba69
-
MD5
07b60dc343df2ab67d7a586d0a6a5be2
-
SHA1
cbf0ca5122b96ec8680c227b3b65ebb4a5a01c63
-
SHA256
64e167683e619a5c5bb9e13852cd1908ddebc7505f4074f53327b48d14538f1f
-
SHA512
65f28520985972538dea9d6536d64a7e49278f588ff1bc04a0dcacc2be532a291285735a8fdf4749ad16c9234a557cf91114088284b6cd2051e65be18915ed4e
-
SSDEEP
6144:Kn/L+GOmoEQ7m/7QPaNCIWGdsJFccfBvWlMdrauk+EsaI+tckmat9c9CP:0zOmoYQPssccfD9Nk+RaIBat97P
Static task
static1
Behavioral task
behavioral1
Sample
07b60dc343df2ab67d7a586d0a6a5be2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07b60dc343df2ab67d7a586d0a6a5be2_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
IP.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
IP.dll
Resource
win10v2004-20240419-en
Malware Config
Extracted
C:\Users\Admin\Music\README.hta
Extracted
C:\Users\Admin\AppData\Roaming\README.hta
Targets
-
-
Target
07b60dc343df2ab67d7a586d0a6a5be2_JaffaCakes118
-
Size
271KB
-
MD5
07b60dc343df2ab67d7a586d0a6a5be2
-
SHA1
cbf0ca5122b96ec8680c227b3b65ebb4a5a01c63
-
SHA256
64e167683e619a5c5bb9e13852cd1908ddebc7505f4074f53327b48d14538f1f
-
SHA512
65f28520985972538dea9d6536d64a7e49278f588ff1bc04a0dcacc2be532a291285735a8fdf4749ad16c9234a557cf91114088284b6cd2051e65be18915ed4e
-
SSDEEP
6144:Kn/L+GOmoEQ7m/7QPaNCIWGdsJFccfBvWlMdrauk+EsaI+tckmat9c9CP:0zOmoYQPssccfD9Nk+RaIBat97P
Score10/10-
Blocklisted process makes network request
-
Contacts a large (517) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
a436db0c473a087eb61ff5c53c34ba27
-
SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506
-
SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
-
SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
SSDEEP
192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
Score3/10 -
-
-
Target
IP.dll
-
Size
89KB
-
MD5
38ed71d99dd2bb013c4bc8e065d87e3e
-
SHA1
e11be1e6647911705a90ec0f55787d2dba3e6ca0
-
SHA256
286069d12c8f12a00aef558d02426dfdbe3a6337b05dea53b70a3d3cfcf49ff9
-
SHA512
0480789002f9dd3bc52e49eb534471ab1db81be9fd94522373d14a81735aea7e20a995748edc131b0ec6ba49b420c56a030e955cffdb45ba410392dc7a8c0983
-
SSDEEP
1536:N+/uD66eFQO8mxmi3dFDhoKAWZbpHDd6wW/YPHb5rgakGRbiTfWS4t2Ag35DkLg8:N+ao3n2I6wW/YPb1DOTfWS0VgpJ8
Score3/10 -