General

  • Target

    12bfc8fd2cdf016c656381acd96f33c3_JaffaCakes118

  • Size

    172KB

  • Sample

    240626-vm8c3awgrl

  • MD5

    12bfc8fd2cdf016c656381acd96f33c3

  • SHA1

    53d377dc3daaab0c38b0848e21705e0b38333456

  • SHA256

    7d5b9cde28d45b410e200321ea5526d28e21b5703e2c8e3360296921b8f70ce3

  • SHA512

    de4f5bf85dc54f42870e9182b9719dbcfb0f8663da2eaebc65e4c3c4cb55fc0f5b4b0cc4389e317aafed63ea9b846214f7935872d6d13b8816ae7faa6a5beedc

  • SSDEEP

    3072:spHL+sQTek+DotsoWxezHS52PPXU3G6+aZ0W8V38lKEhIFbo8:sivSk+dibPXQG6+IP86Kfbf

Malware Config

Targets

    • Target

      12bfc8fd2cdf016c656381acd96f33c3_JaffaCakes118

    • Size

      172KB

    • MD5

      12bfc8fd2cdf016c656381acd96f33c3

    • SHA1

      53d377dc3daaab0c38b0848e21705e0b38333456

    • SHA256

      7d5b9cde28d45b410e200321ea5526d28e21b5703e2c8e3360296921b8f70ce3

    • SHA512

      de4f5bf85dc54f42870e9182b9719dbcfb0f8663da2eaebc65e4c3c4cb55fc0f5b4b0cc4389e317aafed63ea9b846214f7935872d6d13b8816ae7faa6a5beedc

    • SSDEEP

      3072:spHL+sQTek+DotsoWxezHS52PPXU3G6+aZ0W8V38lKEhIFbo8:sivSk+dibPXQG6+IP86Kfbf

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • UAC bypass

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks