General

  • Target

    90e338f0bc31061523161a210e5057b9_JaffaCakes118

  • Size

    512KB

  • Sample

    240603-hmw9ksfd3s

  • MD5

    90e338f0bc31061523161a210e5057b9

  • SHA1

    8b6eb17974e1045fc952a1ad9758b80fb24b99cf

  • SHA256

    dcd5e13f7e378dc14934d139b7b2171604b65ef6116df8e310d73b1a353ec7d6

  • SHA512

    3fcfb79c88be7cb9ab9c307d07656f244c7dbf63d65cec4ea52212a75ffab56648d8a91076f16cdae126ae87f00f389dc209addb5c4f06ae4be7e7bd626dc5a1

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Malware Config

Targets

    • Target

      90e338f0bc31061523161a210e5057b9_JaffaCakes118

    • Size

      512KB

    • MD5

      90e338f0bc31061523161a210e5057b9

    • SHA1

      8b6eb17974e1045fc952a1ad9758b80fb24b99cf

    • SHA256

      dcd5e13f7e378dc14934d139b7b2171604b65ef6116df8e310d73b1a353ec7d6

    • SHA512

      3fcfb79c88be7cb9ab9c307d07656f244c7dbf63d65cec4ea52212a75ffab56648d8a91076f16cdae126ae87f00f389dc209addb5c4f06ae4be7e7bd626dc5a1

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks