General
-
Target
2ffb2dc1947e351eebcafb5388b1b78d_JaffaCakes118
-
Size
130KB
-
Sample
241010-p74ygssbjm
-
MD5
2ffb2dc1947e351eebcafb5388b1b78d
-
SHA1
0694563b61bfa96f7b51e78ae62ee8fe4d3b7b1e
-
SHA256
46264d841dc40c44d71e1973216c431c9786396aa9f368318c74a4b518cd14e0
-
SHA512
78139cd9536ce9a0eb0718962aa0b03fe1624629f5ee841d2e4b7cc5eeecc21bca09df9083fbf09b1b3a30da41c6d980963b8567064fd7a99fe05f7be1e08e0e
-
SSDEEP
1536:DmsuQJc7vZ1bZIgf8pC++5B3ZOk4EEJtlY463Q8asf74pIpJJR7EJTZ:DmQc7fbZh0pb+5L/3EJtlYdA8aS74goZ
Static task
static1
Behavioral task
behavioral1
Sample
2ffb2dc1947e351eebcafb5388b1b78d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2ffb2dc1947e351eebcafb5388b1b78d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
2ffb2dc1947e351eebcafb5388b1b78d_JaffaCakes118
-
Size
130KB
-
MD5
2ffb2dc1947e351eebcafb5388b1b78d
-
SHA1
0694563b61bfa96f7b51e78ae62ee8fe4d3b7b1e
-
SHA256
46264d841dc40c44d71e1973216c431c9786396aa9f368318c74a4b518cd14e0
-
SHA512
78139cd9536ce9a0eb0718962aa0b03fe1624629f5ee841d2e4b7cc5eeecc21bca09df9083fbf09b1b3a30da41c6d980963b8567064fd7a99fe05f7be1e08e0e
-
SSDEEP
1536:DmsuQJc7vZ1bZIgf8pC++5B3ZOk4EEJtlY463Q8asf74pIpJJR7EJTZ:DmQc7fbZh0pb+5L/3EJtlYdA8aS74goZ
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request
-
Server Software Component: Terminal Services DLL
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Server Software Component
1Terminal Services DLL
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1Remote System Discovery
2System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Network Connections Discovery
1