General
-
Target
7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118
-
Size
272KB
-
Sample
240726-xjhz4s1dpf
-
MD5
7549fe42cffb0adeb13cc91b2540d6b1
-
SHA1
1b73c5253ff1a49ac78d60858df5d1c749b650df
-
SHA256
2b81ed549fbe39010b355378886480a3481fdda28ab4807e63ccffe0395434f1
-
SHA512
732a65e6b8854309e0ad56b9be61887905467f5be3a26736fd9bb60710da25e6eb27cc8400c156fa893c48f25bd5834d705b9a08d0847fb4c41569add7769d91
-
SSDEEP
6144:s8U2YYy2qPNNOJLNPsfJW/Q4DL+G13+0gyuyifHZizZbBhgDDAXSyjOZ:FX5yHNNOJLNURWlSG1u0tuyyipDgDkdo
Static task
static1
Behavioral task
behavioral1
Sample
7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
7549fe42cffb0adeb13cc91b2540d6b1_JaffaCakes118
-
Size
272KB
-
MD5
7549fe42cffb0adeb13cc91b2540d6b1
-
SHA1
1b73c5253ff1a49ac78d60858df5d1c749b650df
-
SHA256
2b81ed549fbe39010b355378886480a3481fdda28ab4807e63ccffe0395434f1
-
SHA512
732a65e6b8854309e0ad56b9be61887905467f5be3a26736fd9bb60710da25e6eb27cc8400c156fa893c48f25bd5834d705b9a08d0847fb4c41569add7769d91
-
SSDEEP
6144:s8U2YYy2qPNNOJLNPsfJW/Q4DL+G13+0gyuyifHZizZbBhgDDAXSyjOZ:FX5yHNNOJLNURWlSG1u0tuyyipDgDkdo
-
Modifies security service
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3