General

  • Target

    02614d3cb652db51d0811e8a6b98adcc_JaffaCakes118

  • Size

    7.5MB

  • Sample

    240622-qrtm9atgkm

  • MD5

    02614d3cb652db51d0811e8a6b98adcc

  • SHA1

    e0141b2fa9661f4e756963208ff393799c126cf7

  • SHA256

    f8c97dd9ecc8e4b5fc6d95a67a43026687b7bac68e2ed9fbf247663d66e93a1b

  • SHA512

    68ec5f34fc514b36154361f8265ead4050d85ddacd931f59c6a414f0b9c1477cf3de88f8e8f521ad13ae674f6968a771d47df7fc30b6b461a4bf3b9e5ee7266d

  • SSDEEP

    196608:i7effIPEsy58doQaTxLhQyZbIly38doQavqU/yE/QTly38doQa6wk89+hXTdeyY6:i7effIPEsy58doQaTxLhQyZbIly38doE

Malware Config

Targets

    • Target

      02614d3cb652db51d0811e8a6b98adcc_JaffaCakes118

    • Size

      7.5MB

    • MD5

      02614d3cb652db51d0811e8a6b98adcc

    • SHA1

      e0141b2fa9661f4e756963208ff393799c126cf7

    • SHA256

      f8c97dd9ecc8e4b5fc6d95a67a43026687b7bac68e2ed9fbf247663d66e93a1b

    • SHA512

      68ec5f34fc514b36154361f8265ead4050d85ddacd931f59c6a414f0b9c1477cf3de88f8e8f521ad13ae674f6968a771d47df7fc30b6b461a4bf3b9e5ee7266d

    • SSDEEP

      196608:i7effIPEsy58doQaTxLhQyZbIly38doQavqU/yE/QTly38doQa6wk89+hXTdeyY6:i7effIPEsy58doQaTxLhQyZbIly38doE

    • Modifies WinLogon for persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks