General
-
Target
74d2cb8e58f5ff6ac8f37ec2f1c2c3c9_JaffaCakes118
-
Size
282KB
-
Sample
240726-tybb2ayhqk
-
MD5
74d2cb8e58f5ff6ac8f37ec2f1c2c3c9
-
SHA1
d3acd09d3b7db4f72fa86e355c1f43e14903a85c
-
SHA256
7814809b1ae473fabb72c84fc4e2f8ee35faf62d9d267618959a97deddf4ab73
-
SHA512
4236883f9a50242e7c989f8aa47cb578a06bb645006d708737cf54ade603c9701d4517fe2370ab57ea3f72f7aa7754c7b7c7fa7f9029587457ddb4862cca1b26
-
SSDEEP
6144:dQPsBZysx560JOdEvLslBkjCXaoG8G/9gGjaVOIgG3XajW:dMSzJUEG3G8G/9gWSOIgo
Static task
static1
Behavioral task
behavioral1
Sample
74d2cb8e58f5ff6ac8f37ec2f1c2c3c9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
74d2cb8e58f5ff6ac8f37ec2f1c2c3c9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
74d2cb8e58f5ff6ac8f37ec2f1c2c3c9_JaffaCakes118
-
Size
282KB
-
MD5
74d2cb8e58f5ff6ac8f37ec2f1c2c3c9
-
SHA1
d3acd09d3b7db4f72fa86e355c1f43e14903a85c
-
SHA256
7814809b1ae473fabb72c84fc4e2f8ee35faf62d9d267618959a97deddf4ab73
-
SHA512
4236883f9a50242e7c989f8aa47cb578a06bb645006d708737cf54ade603c9701d4517fe2370ab57ea3f72f7aa7754c7b7c7fa7f9029587457ddb4862cca1b26
-
SSDEEP
6144:dQPsBZysx560JOdEvLslBkjCXaoG8G/9gGjaVOIgG3XajW:dMSzJUEG3G8G/9gWSOIgo
-
Modifies security service
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3