General
-
Target
745f9843f77c8ebe2a0624bc855c6a8d_JaffaCakes118
-
Size
920KB
-
Sample
240726-rd7hmascrp
-
MD5
745f9843f77c8ebe2a0624bc855c6a8d
-
SHA1
723e1c6ae044a24ba9fdd6805e8a72a260078100
-
SHA256
cb5667c750d1cf1f5b6daf90566a4cfb58c931f9d933ad17f0273f40b02228ba
-
SHA512
06e85aff692547990c9d5d10b1ad4d267ddd1f33a95398b6ab33a4dc7c531b6a5e83880f95ebbb8744371086d1b36ff347c5a86ec4495eb48aca50dd2279c8d9
-
SSDEEP
24576:iJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:jTzuaxjnsywKMnY
Static task
static1
Behavioral task
behavioral1
Sample
745f9843f77c8ebe2a0624bc855c6a8d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
745f9843f77c8ebe2a0624bc855c6a8d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
745f9843f77c8ebe2a0624bc855c6a8d_JaffaCakes118
-
Size
920KB
-
MD5
745f9843f77c8ebe2a0624bc855c6a8d
-
SHA1
723e1c6ae044a24ba9fdd6805e8a72a260078100
-
SHA256
cb5667c750d1cf1f5b6daf90566a4cfb58c931f9d933ad17f0273f40b02228ba
-
SHA512
06e85aff692547990c9d5d10b1ad4d267ddd1f33a95398b6ab33a4dc7c531b6a5e83880f95ebbb8744371086d1b36ff347c5a86ec4495eb48aca50dd2279c8d9
-
SSDEEP
24576:iJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:jTzuaxjnsywKMnY
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Drops file in Drivers directory
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Active Setup
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Active Setup
1Defense Evasion
Modify Registry
5Hide Artifacts
1Hidden Files and Directories
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3