General
-
Target
441c29beb785825773565a52f663ab64_JaffaCakes118
-
Size
1.2MB
-
Sample
241014-zkxk1awane
-
MD5
441c29beb785825773565a52f663ab64
-
SHA1
310041ea7b3fc883df2b81516f42b0ae311bf6cd
-
SHA256
a7c204f16dbae8eb221bb143d67e5f926dd5fe71a0c07b4ee19d0893872061a3
-
SHA512
cb4d8ae091cb07a441041e824f3ef1d2b2d606eac3be3c57d96c8dde5b259f1b5dbe0714ff4639df0d12ba7fc1b7c2b486479197316c9521ca48b85a4ee05021
-
SSDEEP
24576:1Lxy7ZcQ7wAXRAbhDdAGLMMiw4Fj0qN+x4QCO490V94fYgtvGk6GA:u7ZpFi8j5O497oDGA
Static task
static1
Behavioral task
behavioral1
Sample
441c29beb785825773565a52f663ab64_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
441c29beb785825773565a52f663ab64_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
441c29beb785825773565a52f663ab64_JaffaCakes118
-
Size
1.2MB
-
MD5
441c29beb785825773565a52f663ab64
-
SHA1
310041ea7b3fc883df2b81516f42b0ae311bf6cd
-
SHA256
a7c204f16dbae8eb221bb143d67e5f926dd5fe71a0c07b4ee19d0893872061a3
-
SHA512
cb4d8ae091cb07a441041e824f3ef1d2b2d606eac3be3c57d96c8dde5b259f1b5dbe0714ff4639df0d12ba7fc1b7c2b486479197316c9521ca48b85a4ee05021
-
SSDEEP
24576:1Lxy7ZcQ7wAXRAbhDdAGLMMiw4Fj0qN+x4QCO490V94fYgtvGk6GA:u7ZpFi8j5O497oDGA
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-