General
-
Target
63a4f18e268767cca71f41e557b9a1d1_JaffaCakes118
-
Size
23.6MB
-
Sample
240521-rzkwrahe3x
-
MD5
63a4f18e268767cca71f41e557b9a1d1
-
SHA1
64c2fbdac8e510c6554f159eb0e890c7dd92824f
-
SHA256
2754e46e0d545ad8f6b5cbc526045732d964ebdfa18cb077d0fa91e58e659663
-
SHA512
bc0cb39d0f2e0d178ce7dfaeb64002c79b5fddd7b14ef9203b14af3e99a93fd7196d4ab144246963dffd862b344c2c786d3ebf24cd8f31187094515d2f59d804
-
SSDEEP
393216:KBRW6T1WKIo36MfMt3xHgQp7UIs2N8sZmFl6Ct9qH72+8ypHe+Usrd7wZypXIUOW:36T9I9OMV4Id8JF809qiApysrd8ZyuUt
Static task
static1
Behavioral task
behavioral1
Sample
63a4f18e268767cca71f41e557b9a1d1_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
63a4f18e268767cca71f41e557b9a1d1_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
63a4f18e268767cca71f41e557b9a1d1_JaffaCakes118
-
Size
23.6MB
-
MD5
63a4f18e268767cca71f41e557b9a1d1
-
SHA1
64c2fbdac8e510c6554f159eb0e890c7dd92824f
-
SHA256
2754e46e0d545ad8f6b5cbc526045732d964ebdfa18cb077d0fa91e58e659663
-
SHA512
bc0cb39d0f2e0d178ce7dfaeb64002c79b5fddd7b14ef9203b14af3e99a93fd7196d4ab144246963dffd862b344c2c786d3ebf24cd8f31187094515d2f59d804
-
SSDEEP
393216:KBRW6T1WKIo36MfMt3xHgQp7UIs2N8sZmFl6Ct9qH72+8ypHe+Usrd7wZypXIUOW:36T9I9OMV4Id8JF809qiApysrd8ZyuUt
Score10/10-
Modifies boot configuration data using bcdedit
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3