General
-
Target
8e4dc96dc37e0c882500ecd0983f05fe_JaffaCakes118
-
Size
73KB
-
Sample
241104-a2h2ha1qam
-
MD5
8e4dc96dc37e0c882500ecd0983f05fe
-
SHA1
c467a8399c92e0d8ff73f7bad9ea1194cae903d0
-
SHA256
b4e5c71440c20850e73fbb8e70bb2a8b1c69ba06433f5010ef036361edace8b3
-
SHA512
4f930ad43d9bcfb6a0a01d7d1d31b059e0eb5d23be2934636abd65a673020200a9afc0a43c46e9af6d1406403543b7c445dbbefb310f149fdbc755f8e3debfeb
-
SSDEEP
1536:yCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRO:yCaZ2Yrb0VTXJYWEsCGuiU
Static task
static1
Behavioral task
behavioral1
Sample
8e4dc96dc37e0c882500ecd0983f05fe_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
8e4dc96dc37e0c882500ecd0983f05fe_JaffaCakes118
-
Size
73KB
-
MD5
8e4dc96dc37e0c882500ecd0983f05fe
-
SHA1
c467a8399c92e0d8ff73f7bad9ea1194cae903d0
-
SHA256
b4e5c71440c20850e73fbb8e70bb2a8b1c69ba06433f5010ef036361edace8b3
-
SHA512
4f930ad43d9bcfb6a0a01d7d1d31b059e0eb5d23be2934636abd65a673020200a9afc0a43c46e9af6d1406403543b7c445dbbefb310f149fdbc755f8e3debfeb
-
SSDEEP
1536:yCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRO:yCaZ2Yrb0VTXJYWEsCGuiU
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1