General
-
Target
b2f378b47d90b112e82d8898c6689139_JaffaCakes118
-
Size
4.1MB
-
Sample
240616-l61b5atalk
-
MD5
b2f378b47d90b112e82d8898c6689139
-
SHA1
03ae70a6252e4ecdf4763d37b72c275428cb3066
-
SHA256
4f5be7fbce220efa3c4f265d3a1b2af819cf0f27fce448f3adb45d167cc7d90f
-
SHA512
4911d3944eeb41a6852dd05ea1e1cf9e6c357f6d1a8ee6760e309dd1a1704d73c8e391d3e14b50522f6248eda2d3831704dba8abb09090d24a19afe86d77622e
-
SSDEEP
98304:QDm3Gd7kmgrpV1BwD/pU9BIiKSNj5zwyp:QDmGkBr314/OHfNPp
Static task
static1
Behavioral task
behavioral1
Sample
b2f378b47d90b112e82d8898c6689139_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b2f378b47d90b112e82d8898c6689139_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
b2f378b47d90b112e82d8898c6689139_JaffaCakes118
-
Size
4.1MB
-
MD5
b2f378b47d90b112e82d8898c6689139
-
SHA1
03ae70a6252e4ecdf4763d37b72c275428cb3066
-
SHA256
4f5be7fbce220efa3c4f265d3a1b2af819cf0f27fce448f3adb45d167cc7d90f
-
SHA512
4911d3944eeb41a6852dd05ea1e1cf9e6c357f6d1a8ee6760e309dd1a1704d73c8e391d3e14b50522f6248eda2d3831704dba8abb09090d24a19afe86d77622e
-
SSDEEP
98304:QDm3Gd7kmgrpV1BwD/pU9BIiKSNj5zwyp:QDmGkBr314/OHfNPp
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-