General
-
Target
1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118
-
Size
777KB
-
Sample
240627-dmcgyssckq
-
MD5
1473f45c4c6b87fd879f61fcec4f5b79
-
SHA1
02d99ad8b9c1c43ad7c908763d4dc70bb1317f78
-
SHA256
e028bb6a42ed8c3d0eae78dd91b2d90c3aadc7eb4bd7a899136cd8f5618f8dea
-
SHA512
a337c4bcc1bc48ee418faabbb30b6396781dadda990dcb618e49c3dfce8670cd4b96acc6da63bb042e689711bafd8cf4477b8917600fb91da6525b9d27bf22d6
-
SSDEEP
12288:dbI6TvLwVrZjSdlAk1++5kfkWdnA9JHjPNdCCv4C5PndYOaH2cqgw64e:lTDelSbA05kcenA9NPPCCHqD2cqin
Static task
static1
Behavioral task
behavioral1
Sample
1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118
-
Size
777KB
-
MD5
1473f45c4c6b87fd879f61fcec4f5b79
-
SHA1
02d99ad8b9c1c43ad7c908763d4dc70bb1317f78
-
SHA256
e028bb6a42ed8c3d0eae78dd91b2d90c3aadc7eb4bd7a899136cd8f5618f8dea
-
SHA512
a337c4bcc1bc48ee418faabbb30b6396781dadda990dcb618e49c3dfce8670cd4b96acc6da63bb042e689711bafd8cf4477b8917600fb91da6525b9d27bf22d6
-
SSDEEP
12288:dbI6TvLwVrZjSdlAk1++5kfkWdnA9JHjPNdCCv4C5PndYOaH2cqgw64e:lTDelSbA05kcenA9NPPCCHqD2cqin
Score10/10-
Modifies WinLogon for persistence
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-