General
-
Target
JaffaCakes118_dee1ad01acc568321de6181882b237af839e7153a943343d56644884fef4e82c
-
Size
4.0MB
-
Sample
241223-vt57aawjgv
-
MD5
e32f2c32c5ee6726873c8ee58a9c2dfb
-
SHA1
38427a4762f45c7457969dc913297257a5b73990
-
SHA256
dee1ad01acc568321de6181882b237af839e7153a943343d56644884fef4e82c
-
SHA512
251b7b4fd672d514adee8752ba7c2ed94d50599adad6d0b354dfbc7b5d0fcc36361b5edba0186e08acd96e82e4cdda6479c262a24a7671d49703d4426b4aa751
-
SSDEEP
98304:m7edekgigunh06Ik9TeoPWZZ5XO9Ah7sd6zUz:egekdhHIkcgW0uFsdKo
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_dee1ad01acc568321de6181882b237af839e7153a943343d56644884fef4e82c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_dee1ad01acc568321de6181882b237af839e7153a943343d56644884fef4e82c.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_dee1ad01acc568321de6181882b237af839e7153a943343d56644884fef4e82c
-
Size
4.0MB
-
MD5
e32f2c32c5ee6726873c8ee58a9c2dfb
-
SHA1
38427a4762f45c7457969dc913297257a5b73990
-
SHA256
dee1ad01acc568321de6181882b237af839e7153a943343d56644884fef4e82c
-
SHA512
251b7b4fd672d514adee8752ba7c2ed94d50599adad6d0b354dfbc7b5d0fcc36361b5edba0186e08acd96e82e4cdda6479c262a24a7671d49703d4426b4aa751
-
SSDEEP
98304:m7edekgigunh06Ik9TeoPWZZ5XO9Ah7sd6zUz:egekdhHIkcgW0uFsdKo
-
Glupteba family
-
Glupteba payload
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1