General
-
Target
4da43d3f28b40c3db5478c692ff4c773_JaffaCakes118
-
Size
934KB
-
Sample
240716-k2cjtsxepf
-
MD5
4da43d3f28b40c3db5478c692ff4c773
-
SHA1
595dfafec69b60d7a8f4d976b7ebe3d9e99730bb
-
SHA256
e449d63581173da5231c0b9c467140a98a4953865fc85468a4ae1cc07522a647
-
SHA512
e89fcfe27525025e42cb504ffaaabee773d8909da650f7f10f529f1d4971fc538363c2d26c7d0ac67c2781256dc0085e2ceb3bc588a48820aadf45973e4a9754
-
SSDEEP
24576:e4Z/TzBDwdltwdltwdltwdltwdltwdltwdltwdltwdltwdltwdllwdT:e4Qeeeeeeeeee2
Behavioral task
behavioral1
Sample
4da43d3f28b40c3db5478c692ff4c773_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4da43d3f28b40c3db5478c692ff4c773_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
4da43d3f28b40c3db5478c692ff4c773_JaffaCakes118
-
Size
934KB
-
MD5
4da43d3f28b40c3db5478c692ff4c773
-
SHA1
595dfafec69b60d7a8f4d976b7ebe3d9e99730bb
-
SHA256
e449d63581173da5231c0b9c467140a98a4953865fc85468a4ae1cc07522a647
-
SHA512
e89fcfe27525025e42cb504ffaaabee773d8909da650f7f10f529f1d4971fc538363c2d26c7d0ac67c2781256dc0085e2ceb3bc588a48820aadf45973e4a9754
-
SSDEEP
24576:e4Z/TzBDwdltwdltwdltwdltwdltwdltwdltwdltwdltwdltwdllwdT:e4Qeeeeeeeeee2
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1