General
-
Target
0dacd82ecd27fa910de5b5f87a013dc0_JaffaCakes118
-
Size
100KB
-
Sample
240625-l7x86atcnf
-
MD5
0dacd82ecd27fa910de5b5f87a013dc0
-
SHA1
8a902bf6c8b4da7851910d42700b877ddd60c6fd
-
SHA256
95cd6605cc8ca11588d6aeec80b796f02fe2ae1dbe8681e28790afa273739c1c
-
SHA512
2cccbeaf0c7a67e57fa9dcb019cff42b9054c3097a3b270cda62b2f767ecef4228ebbbc1d3073ac03f2b5c6cff51d914b47e54ee82f4ee57259bc7a9b3d18f2d
-
SSDEEP
3072:sp089lfJ23MqFBKrjsaHTt3Pd3+4lc2mko7:fWJTnz9PAB2mks
Static task
static1
Behavioral task
behavioral1
Sample
0dacd82ecd27fa910de5b5f87a013dc0_JaffaCakes118.exe
Resource
win7-20240419-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
0dacd82ecd27fa910de5b5f87a013dc0_JaffaCakes118
-
Size
100KB
-
MD5
0dacd82ecd27fa910de5b5f87a013dc0
-
SHA1
8a902bf6c8b4da7851910d42700b877ddd60c6fd
-
SHA256
95cd6605cc8ca11588d6aeec80b796f02fe2ae1dbe8681e28790afa273739c1c
-
SHA512
2cccbeaf0c7a67e57fa9dcb019cff42b9054c3097a3b270cda62b2f767ecef4228ebbbc1d3073ac03f2b5c6cff51d914b47e54ee82f4ee57259bc7a9b3d18f2d
-
SSDEEP
3072:sp089lfJ23MqFBKrjsaHTt3Pd3+4lc2mko7:fWJTnz9PAB2mks
-
Modifies firewall policy service
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5