General
-
Target
4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118
-
Size
659KB
-
Sample
240715-r51t6aydnh
-
MD5
4a202a97a94b7aaac097fd7c8b38523d
-
SHA1
a3d97ce6b448abdf1ea6e5c0107b7722a4dec7be
-
SHA256
60f5607fa56e160eeb38486242d7bfed4b41546a82cc720a422e29eeb1dc10f0
-
SHA512
b173d69dfce23493fff9927107295a3ea013897911dd214ae1060f32016cb319c51bf1c26538576fe801eff20216a853e6488b314b5ae2129cb866b0f00dc9c0
-
SSDEEP
12288:8HbeOUe5UMJI8kx2mgUwoz5bubi02VViLksY2ixG9MFPk0FhMg:8HbBUMRs8Uwoz5bM2VVEOzxCMFPkoL
Behavioral task
behavioral1
Sample
4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118
-
Size
659KB
-
MD5
4a202a97a94b7aaac097fd7c8b38523d
-
SHA1
a3d97ce6b448abdf1ea6e5c0107b7722a4dec7be
-
SHA256
60f5607fa56e160eeb38486242d7bfed4b41546a82cc720a422e29eeb1dc10f0
-
SHA512
b173d69dfce23493fff9927107295a3ea013897911dd214ae1060f32016cb319c51bf1c26538576fe801eff20216a853e6488b314b5ae2129cb866b0f00dc9c0
-
SSDEEP
12288:8HbeOUe5UMJI8kx2mgUwoz5bubi02VViLksY2ixG9MFPk0FhMg:8HbBUMRs8Uwoz5bM2VVEOzxCMFPkoL
Score10/10-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Active Setup
1