General
-
Target
15ce1dbd6c7017ac8795d155f7727629_JaffaCakes118
-
Size
729KB
-
Sample
240505-d6k87sdg2t
-
MD5
15ce1dbd6c7017ac8795d155f7727629
-
SHA1
53c03a69f40b471e40f6575527360c0ca35fb91e
-
SHA256
aac2ba3da594ae887440b4ff5ca9cab5efc3411ce5d7c72f9a8f2c93b41f384e
-
SHA512
3ccb78e6e66351d231fb9809a6f70f032bc0e14985399cedb1c0cced2076de21c9038fb8de0fd2da14a74b6d2cbd4c933910748491f5b99acfc20ed542f54320
-
SSDEEP
12288:B5DbP62jaMuUym1WbEOefroS2/MbUr3oaPFRRJENTfiPYanp6EfN0YCotZT6iVZn:bS2jaoyETro6bUB2TfiPYaTfFFY2
Static task
static1
Behavioral task
behavioral1
Sample
15ce1dbd6c7017ac8795d155f7727629_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
formbook
4.1
cx0
avtnywveba.club
championmanifesto.com
fuehren.net
smallbusinesshelps.com
langshun168.com
maxonone.com
2commasummit.com
feat.gallery
rgsbc.com
gamefa88vn.pro
dandeliondesignart.com
mksso-real.com
shroomsconnect.com
boscoandthebees.com
payday-loans.space
maryaab-lpc.com
vaaccidentdoctorsnearme.info
ensley1961.com
viilaa.com
paraboliclight.com
koyagiblog.com
reclaimthemap.com
cottonflux.com
tsunamispas.com
yolilroom.com
fragrance-place.com
ajbmxb4jc1.club
xsen5124.com
best20travelinsurance.com
wefeelforall.com
bidenblackagenda.com
angleofattackarmament.com
orangedishinc.com
libpoker.com
facetologyrn.com
alborotogt.com
threedrinkmin.com
doctorklotz.com
campaign-zalando.com
tallahasseerockgym.com
insurancefortotal.com
visualist.online
paleolibrarian.info
comeseemenaked.com
ricosch.com
tombrackenmotors.com
activu.xyz
justborncandysettelment.com
letittea.com
britishvapecompany.com
365cashbacks.com
purificadoresuy.com
blue2bees.com
speaknativechinese.com
mbsvirtualstudio.com
doozydeal.com
thehealthyimmunereset.com
onlyincest.com
summerplaceseniorliving.com
brianhannahphotography.com
sugar-fi.com
owlmedia.agency
playtvall365.xyz
norinorinoriblog.com
mscast03.info
Targets
-
-
Target
15ce1dbd6c7017ac8795d155f7727629_JaffaCakes118
-
Size
729KB
-
MD5
15ce1dbd6c7017ac8795d155f7727629
-
SHA1
53c03a69f40b471e40f6575527360c0ca35fb91e
-
SHA256
aac2ba3da594ae887440b4ff5ca9cab5efc3411ce5d7c72f9a8f2c93b41f384e
-
SHA512
3ccb78e6e66351d231fb9809a6f70f032bc0e14985399cedb1c0cced2076de21c9038fb8de0fd2da14a74b6d2cbd4c933910748491f5b99acfc20ed542f54320
-
SSDEEP
12288:B5DbP62jaMuUym1WbEOefroS2/MbUr3oaPFRRJENTfiPYanp6EfN0YCotZT6iVZn:bS2jaoyETro6bUB2TfiPYaTfFFY2
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Formbook payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
2Virtualization/Sandbox Evasion
2