General

  • Target

    a3542a5f3bef98cd26629d36e033b5a1_JaffaCakes118

  • Size

    332KB

  • Sample

    240817-t9kd3swbka

  • MD5

    a3542a5f3bef98cd26629d36e033b5a1

  • SHA1

    fa71c40b75bb15106f243da8652af2f076e03439

  • SHA256

    8e868aef83f92383a9085ddc62aa78600206a919b193dccd2989e5a7bfab1aa1

  • SHA512

    8ca23eee85af65f32151bfcda044666930cc95f1b09848d7025e27e37b0777494df6ce01252b7854413258be68de59e85362a13408886516c6fe5ecbbf4fabe1

  • SSDEEP

    6144:jnbSUzO/zlrDqNKfbw/dHk3SVevMfRryihYhLr7:DbE/zVwKjWHk4e5ihYt7

Malware Config

Targets

    • Target

      a3542a5f3bef98cd26629d36e033b5a1_JaffaCakes118

    • Size

      332KB

    • MD5

      a3542a5f3bef98cd26629d36e033b5a1

    • SHA1

      fa71c40b75bb15106f243da8652af2f076e03439

    • SHA256

      8e868aef83f92383a9085ddc62aa78600206a919b193dccd2989e5a7bfab1aa1

    • SHA512

      8ca23eee85af65f32151bfcda044666930cc95f1b09848d7025e27e37b0777494df6ce01252b7854413258be68de59e85362a13408886516c6fe5ecbbf4fabe1

    • SSDEEP

      6144:jnbSUzO/zlrDqNKfbw/dHk3SVevMfRryihYhLr7:DbE/zVwKjWHk4e5ihYt7

    • Adds policy Run key to start application

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks