General

  • Target

    6306c2d651b1bb41a38d7d2ca38baa4d_JaffaCakes118

  • Size

    259KB

  • Sample

    240722-ngdsyavdmc

  • MD5

    6306c2d651b1bb41a38d7d2ca38baa4d

  • SHA1

    bc4bad42f739634a9f8b9903fc7daf8a4fe0d9d9

  • SHA256

    a234f53159e6a04b7e2b45eed5caf9a5415a3b2fa1b11c3510afc7f17acbc90f

  • SHA512

    5d081e2d1c10ddcd731a0a6fe8111cb267c5b4e57cc2df9e9d2250c19c9f4baf08aa93f58c642ac674522094fd3b42081db2213b2fcb0a3935d0a822a8b974cb

  • SSDEEP

    6144:Adju1hra90SJk2pAOqnntPRV1hhpiyMAgU/JygTq4CP8pQ0E8yJdM4Kk:Zra2SJkltJpiyMAPBlTxC+Q0E9XTK

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      6306c2d651b1bb41a38d7d2ca38baa4d_JaffaCakes118

    • Size

      259KB

    • MD5

      6306c2d651b1bb41a38d7d2ca38baa4d

    • SHA1

      bc4bad42f739634a9f8b9903fc7daf8a4fe0d9d9

    • SHA256

      a234f53159e6a04b7e2b45eed5caf9a5415a3b2fa1b11c3510afc7f17acbc90f

    • SHA512

      5d081e2d1c10ddcd731a0a6fe8111cb267c5b4e57cc2df9e9d2250c19c9f4baf08aa93f58c642ac674522094fd3b42081db2213b2fcb0a3935d0a822a8b974cb

    • SSDEEP

      6144:Adju1hra90SJk2pAOqnntPRV1hhpiyMAgU/JygTq4CP8pQ0E8yJdM4Kk:Zra2SJkltJpiyMAPBlTxC+Q0E9XTK

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks