General
-
Target
55d8239a75022eb6bc01309dbf409c3c_JaffaCakes118
-
Size
18.0MB
-
Sample
240518-vmtvnsdg6s
-
MD5
55d8239a75022eb6bc01309dbf409c3c
-
SHA1
0198b24d70b8ac6112a9a7d2b134cf1f818c22df
-
SHA256
3d2822329e4db45b44257ed596ab522147dc50f3ce6fd894f9002daec68e631c
-
SHA512
6b8d881b29f948538b04f648f2698c5870373d37d325c8891f7ceb7172cb5625a10b465bc6e30ebf639aae3acd8b89ffed270775aaaa34b04f81821c43c0b4a4
-
SSDEEP
196608:Ta9+6Y7SOEibgR9GBfWz+uhATxinfW/JLGMcblLhe3kGr23:TFgRaW6uhAVifW/Vdr
Behavioral task
behavioral1
Sample
55d8239a75022eb6bc01309dbf409c3c_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
55d8239a75022eb6bc01309dbf409c3c_JaffaCakes118
-
Size
18.0MB
-
MD5
55d8239a75022eb6bc01309dbf409c3c
-
SHA1
0198b24d70b8ac6112a9a7d2b134cf1f818c22df
-
SHA256
3d2822329e4db45b44257ed596ab522147dc50f3ce6fd894f9002daec68e631c
-
SHA512
6b8d881b29f948538b04f648f2698c5870373d37d325c8891f7ceb7172cb5625a10b465bc6e30ebf639aae3acd8b89ffed270775aaaa34b04f81821c43c0b4a4
-
SSDEEP
196608:Ta9+6Y7SOEibgR9GBfWz+uhATxinfW/JLGMcblLhe3kGr23:TFgRaW6uhAVifW/Vdr
-
Detect Blackmoon payload
-
XMRig Miner payload
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2