General
-
Target
10b57032328f19f8eaf52aa2a90dc04d_JaffaCakes118
-
Size
920KB
-
Sample
240626-e1kk6avdkf
-
MD5
10b57032328f19f8eaf52aa2a90dc04d
-
SHA1
8ff5676000b873a8be5cbc5df7ad444adbe89d1e
-
SHA256
6d1d641827bb86a48656863bca3df99d1f1ecc809bc1df9162fcbcf160c644a5
-
SHA512
f72f9d72c79de2493d8eacc4ccc9a857bc113be75171067c0f0a991c9866e884ba4a7b3c1a1a7eabc9f225173a04764489cc987ab09a901795d25d2b4e4a821c
-
SSDEEP
24576:HcmUsJLCrn5Ozdv0zZ556fZ8jqETN+85q:5U/rn5cvqD5+8TN++q
Static task
static1
Behavioral task
behavioral1
Sample
10b57032328f19f8eaf52aa2a90dc04d_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
10b57032328f19f8eaf52aa2a90dc04d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
10b57032328f19f8eaf52aa2a90dc04d_JaffaCakes118
-
Size
920KB
-
MD5
10b57032328f19f8eaf52aa2a90dc04d
-
SHA1
8ff5676000b873a8be5cbc5df7ad444adbe89d1e
-
SHA256
6d1d641827bb86a48656863bca3df99d1f1ecc809bc1df9162fcbcf160c644a5
-
SHA512
f72f9d72c79de2493d8eacc4ccc9a857bc113be75171067c0f0a991c9866e884ba4a7b3c1a1a7eabc9f225173a04764489cc987ab09a901795d25d2b4e4a821c
-
SSDEEP
24576:HcmUsJLCrn5Ozdv0zZ556fZ8jqETN+85q:5U/rn5cvqD5+8TN++q
Score10/10-
Modifies WinLogon for persistence
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-