General
-
Target
1098778def702808547f55566b093ea3_JaffaCakes118
-
Size
400KB
-
Sample
240626-d63s9avhpm
-
MD5
1098778def702808547f55566b093ea3
-
SHA1
6875123d8a240261ca3ef0fd0280ee86497cdb1c
-
SHA256
6a391d2093dbb8bfeb1251821e7e42d67956be9c35dbac3f6b5534373c10bec3
-
SHA512
1a15185e9854ffa061ae1e12a44be9d02ddc5728536a8312e42d2fd932625c65dbd95970fb83bc82d1106f1a5005fbaf5af945efbb165633cf6f1ab748a391b5
-
SSDEEP
6144:MZzSM7NnTO7wozOUl50lB80qb+EtKB4DB01PEhRU49GhH6pn4T9xA2e:kM7DzOUl50k0qtYuDicaQ4T9uN
Static task
static1
Behavioral task
behavioral1
Sample
1098778def702808547f55566b093ea3_JaffaCakes118.exe
Resource
win7-20240611-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
1098778def702808547f55566b093ea3_JaffaCakes118
-
Size
400KB
-
MD5
1098778def702808547f55566b093ea3
-
SHA1
6875123d8a240261ca3ef0fd0280ee86497cdb1c
-
SHA256
6a391d2093dbb8bfeb1251821e7e42d67956be9c35dbac3f6b5534373c10bec3
-
SHA512
1a15185e9854ffa061ae1e12a44be9d02ddc5728536a8312e42d2fd932625c65dbd95970fb83bc82d1106f1a5005fbaf5af945efbb165633cf6f1ab748a391b5
-
SSDEEP
6144:MZzSM7NnTO7wozOUl50lB80qb+EtKB4DB01PEhRU49GhH6pn4T9xA2e:kM7DzOUl50k0qtYuDicaQ4T9uN
-
Modifies firewall policy service
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5