General
-
Target
d4104f8f71df1639d38987bb2e2faac1_JaffaCakes118
-
Size
698KB
-
Sample
240908-ln16psyejq
-
MD5
d4104f8f71df1639d38987bb2e2faac1
-
SHA1
8d9d39087621a69814ce9073e0de0dea0f818951
-
SHA256
e458cdccbc2d7aa7378c2f9113183ceec0a1ce1ee057cef817ab748c12265f34
-
SHA512
3f32f3cbd71add2a3dd4034769a55f9157ecf7724cc99d936961dd7e4385d47206f6fdb4bb5d2d5b391ccc8bc32cb6a8992fa93d5ba80e39c990b90f65e3c73b
-
SSDEEP
12288:VBl8M3xpw1WYDo3hNSeJczWm/EyEowLYJNTzteGzyKxy1PeNw0xqtt:t8Gp+WVxkeJpm/zwLUDy16yt
Static task
static1
Behavioral task
behavioral1
Sample
d4104f8f71df1639d38987bb2e2faac1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4104f8f71df1639d38987bb2e2faac1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
d4104f8f71df1639d38987bb2e2faac1_JaffaCakes118
-
Size
698KB
-
MD5
d4104f8f71df1639d38987bb2e2faac1
-
SHA1
8d9d39087621a69814ce9073e0de0dea0f818951
-
SHA256
e458cdccbc2d7aa7378c2f9113183ceec0a1ce1ee057cef817ab748c12265f34
-
SHA512
3f32f3cbd71add2a3dd4034769a55f9157ecf7724cc99d936961dd7e4385d47206f6fdb4bb5d2d5b391ccc8bc32cb6a8992fa93d5ba80e39c990b90f65e3c73b
-
SSDEEP
12288:VBl8M3xpw1WYDo3hNSeJczWm/EyEowLYJNTzteGzyKxy1PeNw0xqtt:t8Gp+WVxkeJpm/zwLUDy16yt
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2