General
-
Target
b13605766b48d2d4cadea70a5656189a_JaffaCakes118
-
Size
73KB
-
Sample
241129-pkdssazlgp
-
MD5
b13605766b48d2d4cadea70a5656189a
-
SHA1
67033dbdbacd9701f02951e4fe20dc80c203273c
-
SHA256
21020225a6264c72c8b75eb76f998a40dd37f722e7276d512fb1a57e92c9063f
-
SHA512
529d29434e80f038beb2863f9a047d37e10aa03ea9c6e2cac55ad21c85be7f8d8bf33dcccb45a78a77f03bd4da4ad04ed2a6ee02b093010776893f4ae535f722
-
SSDEEP
1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRB:KCaZ2Yrb0VTXJYWEsCGuiv
Static task
static1
Behavioral task
behavioral1
Sample
b13605766b48d2d4cadea70a5656189a_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Targets
-
-
Target
b13605766b48d2d4cadea70a5656189a_JaffaCakes118
-
Size
73KB
-
MD5
b13605766b48d2d4cadea70a5656189a
-
SHA1
67033dbdbacd9701f02951e4fe20dc80c203273c
-
SHA256
21020225a6264c72c8b75eb76f998a40dd37f722e7276d512fb1a57e92c9063f
-
SHA512
529d29434e80f038beb2863f9a047d37e10aa03ea9c6e2cac55ad21c85be7f8d8bf33dcccb45a78a77f03bd4da4ad04ed2a6ee02b093010776893f4ae535f722
-
SSDEEP
1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRB:KCaZ2Yrb0VTXJYWEsCGuiv
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1