General
-
Target
6a7b0fb8fb4ab8913f95b7e3ebcfd9e4_JaffaCakes118
-
Size
268KB
-
Sample
240523-ldql8abh6z
-
MD5
6a7b0fb8fb4ab8913f95b7e3ebcfd9e4
-
SHA1
8c6bd32b9c9af493ea514e2f2e3ebb32b2ecdf72
-
SHA256
3fb1cb1530b46c77b60d3225bebcbe33bafba69eb67ee659f1107a68c9c9da5c
-
SHA512
691c6eba1c550fffe81c5d10b9d3e68f12b0ca99fd3dbd22ff47054b6d96594303da61ecb707d14fe36bac6587e41880962e4c2fa9dc2b9f4fd58a9d569085bc
-
SSDEEP
6144:oLVjRNsLtRhsH2BvF2suk98x5Xpq/oI88utO:oLvNsVs2b1u9x55q/oI8ft
Static task
static1
Behavioral task
behavioral1
Sample
6a7b0fb8fb4ab8913f95b7e3ebcfd9e4_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6a7b0fb8fb4ab8913f95b7e3ebcfd9e4_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
6a7b0fb8fb4ab8913f95b7e3ebcfd9e4_JaffaCakes118
-
Size
268KB
-
MD5
6a7b0fb8fb4ab8913f95b7e3ebcfd9e4
-
SHA1
8c6bd32b9c9af493ea514e2f2e3ebb32b2ecdf72
-
SHA256
3fb1cb1530b46c77b60d3225bebcbe33bafba69eb67ee659f1107a68c9c9da5c
-
SHA512
691c6eba1c550fffe81c5d10b9d3e68f12b0ca99fd3dbd22ff47054b6d96594303da61ecb707d14fe36bac6587e41880962e4c2fa9dc2b9f4fd58a9d569085bc
-
SSDEEP
6144:oLVjRNsLtRhsH2BvF2suk98x5Xpq/oI88utO:oLvNsVs2b1u9x55q/oI8ft
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-