General

  • Target

    f3987326538e5cb56782d1a4d9c73819_JaffaCakes118

  • Size

    272KB

  • Sample

    241215-mll5fatjhl

  • MD5

    f3987326538e5cb56782d1a4d9c73819

  • SHA1

    7c8eebfd02d9791cafff8ebe0c45be90aaf6121b

  • SHA256

    b67453daff810578504caff00a43ec9f26b8c1808a0872af086852200adb03e5

  • SHA512

    f75000799ab66eb6cb28b5d5c6177849bc8bbd5eb5b748b412b1ec2964a443e607362c46c241f2169d50ca21d7855b660fdcf23a92a8c76f3b0c231ad26290d2

  • SSDEEP

    3072:wuE+8MXzT68mUZ7v92xfJXxg0phoLQtGv3dpSclFClpI2OrOmhx+LW1zn:wuE+8M6uvwZY0CQg1KlpI2SO0+W5

Malware Config

Targets

    • Target

      f3987326538e5cb56782d1a4d9c73819_JaffaCakes118

    • Size

      272KB

    • MD5

      f3987326538e5cb56782d1a4d9c73819

    • SHA1

      7c8eebfd02d9791cafff8ebe0c45be90aaf6121b

    • SHA256

      b67453daff810578504caff00a43ec9f26b8c1808a0872af086852200adb03e5

    • SHA512

      f75000799ab66eb6cb28b5d5c6177849bc8bbd5eb5b748b412b1ec2964a443e607362c46c241f2169d50ca21d7855b660fdcf23a92a8c76f3b0c231ad26290d2

    • SSDEEP

      3072:wuE+8MXzT68mUZ7v92xfJXxg0phoLQtGv3dpSclFClpI2OrOmhx+LW1zn:wuE+8M6uvwZY0CQg1KlpI2SO0+W5

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Ramnit family

    • UAC bypass

    • Windows security bypass

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks