General

  • Target

    647468fe982d6659d20f3b5b5124cdd7_JaffaCakes118

  • Size

    905KB

  • Sample

    240521-xzc4ssff5v

  • MD5

    647468fe982d6659d20f3b5b5124cdd7

  • SHA1

    6c51a048011364d06e52d7912389e9394ac06547

  • SHA256

    c1ef591b68cbceb3967c9a44d6d053ebe444eaa19651d9a9475438495df26fbe

  • SHA512

    20aa1194af7157fa7cb77e681be2caae2a487a9315b515991fd0da42536d1567d9b95d48407281865e852048dc6589ff663fd739774e58c6a6f9a9e49c1ef807

  • SSDEEP

    24576:nXifyIZzp53wHMAXwpa1P+1kkui6uKVOlzQ:XifyIZzvwHngp2P+1kWU4U

Malware Config

Targets

    • Target

      647468fe982d6659d20f3b5b5124cdd7_JaffaCakes118

    • Size

      905KB

    • MD5

      647468fe982d6659d20f3b5b5124cdd7

    • SHA1

      6c51a048011364d06e52d7912389e9394ac06547

    • SHA256

      c1ef591b68cbceb3967c9a44d6d053ebe444eaa19651d9a9475438495df26fbe

    • SHA512

      20aa1194af7157fa7cb77e681be2caae2a487a9315b515991fd0da42536d1567d9b95d48407281865e852048dc6589ff663fd739774e58c6a6f9a9e49c1ef807

    • SSDEEP

      24576:nXifyIZzp53wHMAXwpa1P+1kkui6uKVOlzQ:XifyIZzvwHngp2P+1kWU4U

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks