General
-
Target
99e4b0609d262821fc56071038fca45d_JaffaCakes118
-
Size
783KB
-
Sample
240606-d8m6ksgf88
-
MD5
99e4b0609d262821fc56071038fca45d
-
SHA1
ff842148cce7fcc79465402909f29ea0c0302dd1
-
SHA256
ce6892104053232781e3623583c11fb91e5783ab4a3d341e6ad04686465e6ed3
-
SHA512
9323a87ee83be0e735c9b15c309f6f96353fbee376aec6683e8dbee7a2dc0a37def81cc02771a454250062d25bb281e1d77b06dffa1bb811134b8c9b68ba3c65
-
SSDEEP
12288:T70jqXAlN1gFhKuERtwRefGiVmMfI2eYfWYbC60MRz9SB+wBvDHv4SyxlOHxOD0k:TY5YaYRefxmOI2eYb0MRzA7y
Static task
static1
Behavioral task
behavioral1
Sample
99e4b0609d262821fc56071038fca45d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
99e4b0609d262821fc56071038fca45d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
99e4b0609d262821fc56071038fca45d_JaffaCakes118
-
Size
783KB
-
MD5
99e4b0609d262821fc56071038fca45d
-
SHA1
ff842148cce7fcc79465402909f29ea0c0302dd1
-
SHA256
ce6892104053232781e3623583c11fb91e5783ab4a3d341e6ad04686465e6ed3
-
SHA512
9323a87ee83be0e735c9b15c309f6f96353fbee376aec6683e8dbee7a2dc0a37def81cc02771a454250062d25bb281e1d77b06dffa1bb811134b8c9b68ba3c65
-
SSDEEP
12288:T70jqXAlN1gFhKuERtwRefGiVmMfI2eYfWYbC60MRz9SB+wBvDHv4SyxlOHxOD0k:TY5YaYRefxmOI2eYb0MRzA7y
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies security service
-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1