General
-
Target
a4c62aaaf8bef937d5f6753380a008b9_JaffaCakes118
-
Size
10.4MB
-
Sample
240818-a91lhswgjh
-
MD5
a4c62aaaf8bef937d5f6753380a008b9
-
SHA1
cee80c2d735feb03bd61da2f488dc386894bb1a0
-
SHA256
f86153d75a3d22cbdc99ec796afaec3a1ce6c64280eeab0a42812445e624416f
-
SHA512
b71f5deff39b46a6672a5bfab6df0d189ce627301a609c194da4540d7405fdb2644dae8b3a3c22020c5ccebb2b7b35a891bd52928453c27ab0db1f3282e6201f
-
SSDEEP
12288:w+/49QM1wKw8Xwl9Uxhof+zCTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTD:pRKw5bU9z
Static task
static1
Behavioral task
behavioral1
Sample
a4c62aaaf8bef937d5f6753380a008b9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a4c62aaaf8bef937d5f6753380a008b9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Targets
-
-
Target
a4c62aaaf8bef937d5f6753380a008b9_JaffaCakes118
-
Size
10.4MB
-
MD5
a4c62aaaf8bef937d5f6753380a008b9
-
SHA1
cee80c2d735feb03bd61da2f488dc386894bb1a0
-
SHA256
f86153d75a3d22cbdc99ec796afaec3a1ce6c64280eeab0a42812445e624416f
-
SHA512
b71f5deff39b46a6672a5bfab6df0d189ce627301a609c194da4540d7405fdb2644dae8b3a3c22020c5ccebb2b7b35a891bd52928453c27ab0db1f3282e6201f
-
SSDEEP
12288:w+/49QM1wKw8Xwl9Uxhof+zCTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTD:pRKw5bU9z
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2