General

  • Target

    a3c059f6e292c34cdb25843d8d476568_JaffaCakes118

  • Size

    512KB

  • Sample

    240613-ehhzlsxbrj

  • MD5

    a3c059f6e292c34cdb25843d8d476568

  • SHA1

    70cdebf5cb35849003faa7b46234ac41d9729d10

  • SHA256

    17fe9527a24327cb25e9d87429e849a87e99f871d1848d71220b59f63e960847

  • SHA512

    be3d976b244aad841a887a0fb5e41737bc77ef75188272eba9c3866f1208dab0b75416e87d9441767684275b5bccfea08bb6d7d5e5cf796d3b4e5f33acefbd16

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t

Malware Config

Targets

    • Target

      a3c059f6e292c34cdb25843d8d476568_JaffaCakes118

    • Size

      512KB

    • MD5

      a3c059f6e292c34cdb25843d8d476568

    • SHA1

      70cdebf5cb35849003faa7b46234ac41d9729d10

    • SHA256

      17fe9527a24327cb25e9d87429e849a87e99f871d1848d71220b59f63e960847

    • SHA512

      be3d976b244aad841a887a0fb5e41737bc77ef75188272eba9c3866f1208dab0b75416e87d9441767684275b5bccfea08bb6d7d5e5cf796d3b4e5f33acefbd16

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Modifies Installed Components in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks