General
-
Target
38842bfc2ef9e1a4734a3ac4d4fa0b0d_JaffaCakes118
-
Size
600KB
-
Sample
240512-gajbhsba5z
-
MD5
38842bfc2ef9e1a4734a3ac4d4fa0b0d
-
SHA1
d7702f8f8b6d8baa46c066948b8278bfe868cff5
-
SHA256
995661538199d5b1f816b33bf4a5b0dc50840e054a14dc54189aa63db3b6b824
-
SHA512
067a32950f8800f2ab64d80c6910abf20e0204457abca4156a5a93624c230720b7904fe48ef26ab2ea15958abdb8a53306513c4db74ca69f02de679c5c360346
-
SSDEEP
12288:bBU27je2sGbV7LsAlhgLTj9BBnWobokcoyhUvqA2:bBUYje21R0b9BBnWooXhQqA
Static task
static1
Behavioral task
behavioral1
Sample
38842bfc2ef9e1a4734a3ac4d4fa0b0d_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
38842bfc2ef9e1a4734a3ac4d4fa0b0d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
quasar
2.1.0.0
windows security
vilvaraj-32652.portmap.io:32652
VNM_MUTEX_XaCO2YtLAsadylDHBP
-
encryption_key
eKgGUbCubcSIafuOAN5V
-
install_name
windows security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
windows security
-
subdirectory
SubDir
Targets
-
-
Target
38842bfc2ef9e1a4734a3ac4d4fa0b0d_JaffaCakes118
-
Size
600KB
-
MD5
38842bfc2ef9e1a4734a3ac4d4fa0b0d
-
SHA1
d7702f8f8b6d8baa46c066948b8278bfe868cff5
-
SHA256
995661538199d5b1f816b33bf4a5b0dc50840e054a14dc54189aa63db3b6b824
-
SHA512
067a32950f8800f2ab64d80c6910abf20e0204457abca4156a5a93624c230720b7904fe48ef26ab2ea15958abdb8a53306513c4db74ca69f02de679c5c360346
-
SSDEEP
12288:bBU27je2sGbV7LsAlhgLTj9BBnWobokcoyhUvqA2:bBUYje21R0b9BBnWooXhQqA
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1