General
-
Target
0e2f3838021b288eced5a881d1b32e2e_JaffaCakes118
-
Size
265KB
-
Sample
240625-qb3wzsvbkr
-
MD5
0e2f3838021b288eced5a881d1b32e2e
-
SHA1
36cb94cd445fdf1d27c899e8376bb8fa98dfc7d2
-
SHA256
a3aca5bf8431270cb5a4597301863777090e3635d20191477e2801ae6df83328
-
SHA512
f16c58959e80272f38b5f65387d5d70bf2fb0c5ab3caa7143f82da36867568e246e62a8f9181d52e09b9a8ed35eedc06c6b44b3b548f823c9325811adf4a1e4e
-
SSDEEP
6144:OPwfgPsuj+SoK23331vFyFKhRAf4D63qTEE:OIfIsujToK2n31NywAfjR
Static task
static1
Behavioral task
behavioral1
Sample
0e2f3838021b288eced5a881d1b32e2e_JaffaCakes118.exe
Resource
win7-20231129-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
0e2f3838021b288eced5a881d1b32e2e_JaffaCakes118
-
Size
265KB
-
MD5
0e2f3838021b288eced5a881d1b32e2e
-
SHA1
36cb94cd445fdf1d27c899e8376bb8fa98dfc7d2
-
SHA256
a3aca5bf8431270cb5a4597301863777090e3635d20191477e2801ae6df83328
-
SHA512
f16c58959e80272f38b5f65387d5d70bf2fb0c5ab3caa7143f82da36867568e246e62a8f9181d52e09b9a8ed35eedc06c6b44b3b548f823c9325811adf4a1e4e
-
SSDEEP
6144:OPwfgPsuj+SoK23331vFyFKhRAf4D63qTEE:OIfIsujToK2n31NywAfjR
-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1