General
-
Target
0ee36e89c4077dfd5648177d9ea80aa8_JaffaCakes118
-
Size
120KB
-
Sample
240625-vr467ssemd
-
MD5
0ee36e89c4077dfd5648177d9ea80aa8
-
SHA1
bd5ce17f6223d12c611fa1e1eb2887abebb9465a
-
SHA256
10cb1006eb86c20f7d78f199516e5422eac6dd7cc38f4d514280802ccf44dfbb
-
SHA512
202b6f0c0810210fbbf722b72b0ea079119f94a52cfea37602767250922ad9664847b85a624f4971977598ba74e71c15f01baaa100c2a190811966067f113824
-
SSDEEP
3072:2G1nTGK1cmE/ur4GGxUohqchNnmNnH2kZTokGq:zcmb4uohBm9HjZToTq
Static task
static1
Behavioral task
behavioral1
Sample
0ee36e89c4077dfd5648177d9ea80aa8_JaffaCakes118.exe
Resource
win7-20240611-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
0ee36e89c4077dfd5648177d9ea80aa8_JaffaCakes118
-
Size
120KB
-
MD5
0ee36e89c4077dfd5648177d9ea80aa8
-
SHA1
bd5ce17f6223d12c611fa1e1eb2887abebb9465a
-
SHA256
10cb1006eb86c20f7d78f199516e5422eac6dd7cc38f4d514280802ccf44dfbb
-
SHA512
202b6f0c0810210fbbf722b72b0ea079119f94a52cfea37602767250922ad9664847b85a624f4971977598ba74e71c15f01baaa100c2a190811966067f113824
-
SSDEEP
3072:2G1nTGK1cmE/ur4GGxUohqchNnmNnH2kZTokGq:zcmb4uohBm9HjZToTq
-
Modifies firewall policy service
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5