General
-
Target
5ffd9a07e6772f06f99c33a494516b72_JaffaCakes118
-
Size
743KB
-
Sample
240720-ls9zeazglh
-
MD5
5ffd9a07e6772f06f99c33a494516b72
-
SHA1
3532207557e4bd4f45c650fa5c4f775cbb0aaa23
-
SHA256
ad0564e6b35b608a3618b4396dae84586a36b6e512ae343564beb48860176454
-
SHA512
3b5ef83de0831df45d31c49982710df87d9945f4b6baa25f17d35a6448c518db5edf113a5a00a8062ff445706038bf0baaa85e2a5af3bb2bc625a5d675c50bba
-
SSDEEP
12288:Y3nZMhJ+ubNJCOwdZbBCNhU4sh9o6sYQtfkzC7OwdxaCKUE6sPUtfkWCs:Y3nZqfbvClXYUD9o6Dgfk27lxahUE68M
Static task
static1
Behavioral task
behavioral1
Sample
5ffd9a07e6772f06f99c33a494516b72_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Extracted
darkcomet
Guest16
rorororo.no-ip.info:82
DC_MUTEX-SU9EA0U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
4RC2X3f1JoPq
-
install
true
-
offline_keylogger
true
-
password
1
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
5ffd9a07e6772f06f99c33a494516b72_JaffaCakes118
-
Size
743KB
-
MD5
5ffd9a07e6772f06f99c33a494516b72
-
SHA1
3532207557e4bd4f45c650fa5c4f775cbb0aaa23
-
SHA256
ad0564e6b35b608a3618b4396dae84586a36b6e512ae343564beb48860176454
-
SHA512
3b5ef83de0831df45d31c49982710df87d9945f4b6baa25f17d35a6448c518db5edf113a5a00a8062ff445706038bf0baaa85e2a5af3bb2bc625a5d675c50bba
-
SSDEEP
12288:Y3nZMhJ+ubNJCOwdZbBCNhU4sh9o6sYQtfkzC7OwdxaCKUE6sPUtfkWCs:Y3nZqfbvClXYUD9o6Dgfk27lxahUE68M
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7