General
-
Target
62fb5ceddaa560692fe0c749d15235d7_JaffaCakes118
-
Size
1.3MB
-
Sample
240722-m69q8svell
-
MD5
62fb5ceddaa560692fe0c749d15235d7
-
SHA1
26ff1774a8ec10ce0d6fc4c604bfaa0c59e49e23
-
SHA256
2ed58f2307032d0dcf369e40bbba78d3f5da1f3bddf501628619efcaf24236f3
-
SHA512
bf0cba9fbb4a5512ffbe61c497d37e195166fb345de3b43630f7a54b82f0c9d2690da4285edfdf92fce11d29cfbabf6807f474e66f88ec701cd9e75777bedc7e
-
SSDEEP
24576:x3QkTf46it5zwcSUr4ASjoM9KfXjLMtn/igf:6kTgxt5McbrNS8MaXjLMtV
Static task
static1
Behavioral task
behavioral1
Sample
62fb5ceddaa560692fe0c749d15235d7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62fb5ceddaa560692fe0c749d15235d7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
62fb5ceddaa560692fe0c749d15235d7_JaffaCakes118
-
Size
1.3MB
-
MD5
62fb5ceddaa560692fe0c749d15235d7
-
SHA1
26ff1774a8ec10ce0d6fc4c604bfaa0c59e49e23
-
SHA256
2ed58f2307032d0dcf369e40bbba78d3f5da1f3bddf501628619efcaf24236f3
-
SHA512
bf0cba9fbb4a5512ffbe61c497d37e195166fb345de3b43630f7a54b82f0c9d2690da4285edfdf92fce11d29cfbabf6807f474e66f88ec701cd9e75777bedc7e
-
SSDEEP
24576:x3QkTf46it5zwcSUr4ASjoM9KfXjLMtn/igf:6kTgxt5McbrNS8MaXjLMtV
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1