General
-
Target
752be8ad0f69d1aedea3627b4a1b3d39_JaffaCakes118
-
Size
114KB
-
Sample
240726-wwmy6awckk
-
MD5
752be8ad0f69d1aedea3627b4a1b3d39
-
SHA1
1921e2ba7fe9d708c20a811f5ee900d976ac052b
-
SHA256
49069ee5210efe443fd21f614740a04b4f35db3793574363391d32d76387bd38
-
SHA512
43dc628f557f9240b9251d87e9e36d692b7e3e6b453e5b5e0219478a3c0540c9c026f3604cc2069a39085b57305551c1523f7b267218b3a9141fa00a963121c0
-
SSDEEP
3072:vqp6jG3kcDbVKMlbBYqOC0x4J2vNbGfvGnd3gW5ZM4/u:vqPkcDbVbsjNdndPZMT
Static task
static1
Behavioral task
behavioral1
Sample
752be8ad0f69d1aedea3627b4a1b3d39_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Targets
-
-
Target
752be8ad0f69d1aedea3627b4a1b3d39_JaffaCakes118
-
Size
114KB
-
MD5
752be8ad0f69d1aedea3627b4a1b3d39
-
SHA1
1921e2ba7fe9d708c20a811f5ee900d976ac052b
-
SHA256
49069ee5210efe443fd21f614740a04b4f35db3793574363391d32d76387bd38
-
SHA512
43dc628f557f9240b9251d87e9e36d692b7e3e6b453e5b5e0219478a3c0540c9c026f3604cc2069a39085b57305551c1523f7b267218b3a9141fa00a963121c0
-
SSDEEP
3072:vqp6jG3kcDbVKMlbBYqOC0x4J2vNbGfvGnd3gW5ZM4/u:vqPkcDbVbsjNdndPZMT
-
Modifies WinLogon for persistence
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
4Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1