General
-
Target
166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118
-
Size
73KB
-
Sample
241005-gfg1msydpp
-
MD5
166480b160f6013cbc67e8c1dc7a937b
-
SHA1
6488c38bbf570691456f0639039138ca4fbd5b48
-
SHA256
9183b8178cc8412a505fdd0a3209afba89e67e388fef51c222f20f20d483029d
-
SHA512
58f5f61ca47c0374b58251e60a38d672aa17a748e7c8993e794bde89351e839be33a33b9ff4b8e268ab62c0cdae9e19df5655d4e1924573b8d1920262cd9916d
-
SSDEEP
1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRH:KCaZ2Yrb0VTXJYWEsCGuiN
Static task
static1
Behavioral task
behavioral1
Sample
166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Targets
-
-
Target
166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118
-
Size
73KB
-
MD5
166480b160f6013cbc67e8c1dc7a937b
-
SHA1
6488c38bbf570691456f0639039138ca4fbd5b48
-
SHA256
9183b8178cc8412a505fdd0a3209afba89e67e388fef51c222f20f20d483029d
-
SHA512
58f5f61ca47c0374b58251e60a38d672aa17a748e7c8993e794bde89351e839be33a33b9ff4b8e268ab62c0cdae9e19df5655d4e1924573b8d1920262cd9916d
-
SSDEEP
1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRH:KCaZ2Yrb0VTXJYWEsCGuiN
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1