General
-
Target
71e63e4c8e829976e58cb42c20c963a0_JaffaCakes118
-
Size
496KB
-
Sample
240726-awyj1avdpr
-
MD5
71e63e4c8e829976e58cb42c20c963a0
-
SHA1
c402574def908fb9abbdc5c20c4f8aa63681158e
-
SHA256
1d0a7215506e9e609c235402c2e238cbc927136dfc68028128398ecff017cc2f
-
SHA512
ad30d2bc7969ca0c41bd651e7d9fb822ea02b3bbc01f66cab0360b367340633b1d81b8f67582d9cb2bc334d99f20baf1a16b467b46c16409077c6658eff2f648
-
SSDEEP
12288:8DCPENnBV5jaHBoFvZstQW012B04Ngjw5qu8jxTQlDrLOM:8EEZBV5jCoFvZsSWG2BdN+w2+O
Static task
static1
Behavioral task
behavioral1
Sample
71e63e4c8e829976e58cb42c20c963a0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
71e63e4c8e829976e58cb42c20c963a0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
71e63e4c8e829976e58cb42c20c963a0_JaffaCakes118
-
Size
496KB
-
MD5
71e63e4c8e829976e58cb42c20c963a0
-
SHA1
c402574def908fb9abbdc5c20c4f8aa63681158e
-
SHA256
1d0a7215506e9e609c235402c2e238cbc927136dfc68028128398ecff017cc2f
-
SHA512
ad30d2bc7969ca0c41bd651e7d9fb822ea02b3bbc01f66cab0360b367340633b1d81b8f67582d9cb2bc334d99f20baf1a16b467b46c16409077c6658eff2f648
-
SSDEEP
12288:8DCPENnBV5jaHBoFvZstQW012B04Ngjw5qu8jxTQlDrLOM:8EEZBV5jCoFvZsSWG2BdN+w2+O
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Defense Evasion
Modify Registry
5Hide Artifacts
1Hidden Files and Directories
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3