General

  • Target

    80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118

  • Size

    548KB

  • Sample

    241031-aqzj4sveqm

  • MD5

    80cdc7c264ea951dedde8d7cda97fe25

  • SHA1

    9961e22ff166d873068b85f829c0b17f8680c889

  • SHA256

    a7b6fb08d17320632c5a3f97d3f265a5e594035fc2b92585b81d0aba16a46df1

  • SHA512

    1efb232e4569fbb233dd9e60f2d38225cc6e091008a2375f6834e5f0785dddd71970c005b78540123ffb9735df1949933937748d554450e51cd9c302f0d44e53

  • SSDEEP

    12288:N6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgWgho+5:GvdezCByqTtlMQsFuqzRbzI7IVQ5

Malware Config

Targets

    • Target

      80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118

    • Size

      548KB

    • MD5

      80cdc7c264ea951dedde8d7cda97fe25

    • SHA1

      9961e22ff166d873068b85f829c0b17f8680c889

    • SHA256

      a7b6fb08d17320632c5a3f97d3f265a5e594035fc2b92585b81d0aba16a46df1

    • SHA512

      1efb232e4569fbb233dd9e60f2d38225cc6e091008a2375f6834e5f0785dddd71970c005b78540123ffb9735df1949933937748d554450e51cd9c302f0d44e53

    • SSDEEP

      12288:N6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgWgho+5:GvdezCByqTtlMQsFuqzRbzI7IVQ5

    • Modifies WinLogon for persistence

    • UAC bypass

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks