General

  • Target

    b2f378b47d90b112e82d8898c6689139_JaffaCakes118

  • Size

    4.1MB

  • Sample

    240616-l61b5atalk

  • MD5

    b2f378b47d90b112e82d8898c6689139

  • SHA1

    03ae70a6252e4ecdf4763d37b72c275428cb3066

  • SHA256

    4f5be7fbce220efa3c4f265d3a1b2af819cf0f27fce448f3adb45d167cc7d90f

  • SHA512

    4911d3944eeb41a6852dd05ea1e1cf9e6c357f6d1a8ee6760e309dd1a1704d73c8e391d3e14b50522f6248eda2d3831704dba8abb09090d24a19afe86d77622e

  • SSDEEP

    98304:QDm3Gd7kmgrpV1BwD/pU9BIiKSNj5zwyp:QDmGkBr314/OHfNPp

Malware Config

Targets

    • Target

      b2f378b47d90b112e82d8898c6689139_JaffaCakes118

    • Size

      4.1MB

    • MD5

      b2f378b47d90b112e82d8898c6689139

    • SHA1

      03ae70a6252e4ecdf4763d37b72c275428cb3066

    • SHA256

      4f5be7fbce220efa3c4f265d3a1b2af819cf0f27fce448f3adb45d167cc7d90f

    • SHA512

      4911d3944eeb41a6852dd05ea1e1cf9e6c357f6d1a8ee6760e309dd1a1704d73c8e391d3e14b50522f6248eda2d3831704dba8abb09090d24a19afe86d77622e

    • SSDEEP

      98304:QDm3Gd7kmgrpV1BwD/pU9BIiKSNj5zwyp:QDmGkBr314/OHfNPp

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks