General
-
Target
0835e61cfb0ac61ee5a305d3005c6659_JaffaCakes118
-
Size
100KB
-
Sample
241002-bmnh4szcqr
-
MD5
0835e61cfb0ac61ee5a305d3005c6659
-
SHA1
4089c20eaf13ddfed3a269d65dc08c7a36b12c16
-
SHA256
2243c468b4f59ce8c029e95945192e3121dd8805c3733cbda751e874bab028cc
-
SHA512
e435858eaca3f0c8f7f6e1d38b4adb315d4f859be7efd4e94d9e218181afb32f4d86bc499c3b6b6893e5ca9d027f1c0083c532c40b7ce41e83d7320a3b54a659
-
SSDEEP
1536:PMuICWyM9Weufu66jIYD5l9hsMqJKZYUTrJ4nDb16jCJyX6nxOM4v:uPafu7UYD551YUP816jeyX6nxOJ
Static task
static1
Behavioral task
behavioral1
Sample
0835e61cfb0ac61ee5a305d3005c6659_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
0835e61cfb0ac61ee5a305d3005c6659_JaffaCakes118
-
Size
100KB
-
MD5
0835e61cfb0ac61ee5a305d3005c6659
-
SHA1
4089c20eaf13ddfed3a269d65dc08c7a36b12c16
-
SHA256
2243c468b4f59ce8c029e95945192e3121dd8805c3733cbda751e874bab028cc
-
SHA512
e435858eaca3f0c8f7f6e1d38b4adb315d4f859be7efd4e94d9e218181afb32f4d86bc499c3b6b6893e5ca9d027f1c0083c532c40b7ce41e83d7320a3b54a659
-
SSDEEP
1536:PMuICWyM9Weufu66jIYD5l9hsMqJKZYUTrJ4nDb16jCJyX6nxOM4v:uPafu7UYD551YUP816jeyX6nxOJ
-
Modifies firewall policy service
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5