General
-
Target
JaffaCakes118_ab8e39159793933b6ce8cec1ff2c367a4cbf6e953aefbe62086bb6bf776394ea
-
Size
201.0MB
-
Sample
241222-fwf8lsvnas
-
MD5
317b2236590cf3c39a377db2b619a5fc
-
SHA1
e76eb307659792b8894f8720f240c3c6aef88dbd
-
SHA256
ab8e39159793933b6ce8cec1ff2c367a4cbf6e953aefbe62086bb6bf776394ea
-
SHA512
65e8341931af9d373e401b2d3ba76aac0c12b3509992789201e711323c1656c6eb1f1cafcd45776f4a63d1e4b2f9ef10f6f09020a7c3735ed4f5d9f0bdd67bf5
-
SSDEEP
98304:qDsqmfeoT5qEM+1+LofOz7VNBLghT2tNcTWTQbictE:X5GoVasEofyrRsEEWTQ3tE
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ab8e39159793933b6ce8cec1ff2c367a4cbf6e953aefbe62086bb6bf776394ea.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_ab8e39159793933b6ce8cec1ff2c367a4cbf6e953aefbe62086bb6bf776394ea
-
Size
201.0MB
-
MD5
317b2236590cf3c39a377db2b619a5fc
-
SHA1
e76eb307659792b8894f8720f240c3c6aef88dbd
-
SHA256
ab8e39159793933b6ce8cec1ff2c367a4cbf6e953aefbe62086bb6bf776394ea
-
SHA512
65e8341931af9d373e401b2d3ba76aac0c12b3509992789201e711323c1656c6eb1f1cafcd45776f4a63d1e4b2f9ef10f6f09020a7c3735ed4f5d9f0bdd67bf5
-
SSDEEP
98304:qDsqmfeoT5qEM+1+LofOz7VNBLghT2tNcTWTQbictE:X5GoVasEofyrRsEEWTQ3tE
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1