General

  • Target

    82919e9b4f8033558fc2f788a9222d69_JaffaCakes118

  • Size

    194KB

  • Sample

    241031-k1qeaswapq

  • MD5

    82919e9b4f8033558fc2f788a9222d69

  • SHA1

    be96a6d35e367a96c942181e0d08b62c53a0e5bc

  • SHA256

    b6974ca8a33b4c2ce8da705fccf8e09ca8e418a46b30cc91231db423929ae72b

  • SHA512

    52f1d3bdc97cf38f72f57f2b2ffa6bd7770ef58a40fe7e665c0538b7a4ed49c8e185a5cc8c5947fc6c3ec867398caf6abd40806d08da780daafffe64b60e36d9

  • SSDEEP

    6144:fPIoILU8pdShUF0qZfEPgZk0/D8L6cxKv8:fPIw+dShUx8YV4mc

Malware Config

Targets

    • Target

      82919e9b4f8033558fc2f788a9222d69_JaffaCakes118

    • Size

      194KB

    • MD5

      82919e9b4f8033558fc2f788a9222d69

    • SHA1

      be96a6d35e367a96c942181e0d08b62c53a0e5bc

    • SHA256

      b6974ca8a33b4c2ce8da705fccf8e09ca8e418a46b30cc91231db423929ae72b

    • SHA512

      52f1d3bdc97cf38f72f57f2b2ffa6bd7770ef58a40fe7e665c0538b7a4ed49c8e185a5cc8c5947fc6c3ec867398caf6abd40806d08da780daafffe64b60e36d9

    • SSDEEP

      6144:fPIoILU8pdShUF0qZfEPgZk0/D8L6cxKv8:fPIw+dShUx8YV4mc

    • Adds policy Run key to start application

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks