General
-
Target
JaffaCakes118_cc8718484c2549e2318a19f5bda5cafe
-
Size
667KB
-
Sample
250119-tnpfxavpcy
-
MD5
cc8718484c2549e2318a19f5bda5cafe
-
SHA1
64609b5e3f4e42177e0a45ccaf974d88bb285031
-
SHA256
2acc4f42fd5082b21c30a4ddbaf0a8761b1a2f0d50bd681c3ca1630f6679d5c5
-
SHA512
68e3b30a76d30d058f55397a540d6250f9ff5acd8e22c970459f31fdf849709dc028991e66aaa813207236a01287274d63ab7c9871dd7bc02556913553594ad3
-
SSDEEP
12288:WbMqmzEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WItEEb4Ev/ATEXKGVnGTzpA1Ec1A
Behavioral task
behavioral1
Sample
JaffaCakes118_cc8718484c2549e2318a19f5bda5cafe.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_cc8718484c2549e2318a19f5bda5cafe.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_cc8718484c2549e2318a19f5bda5cafe
-
Size
667KB
-
MD5
cc8718484c2549e2318a19f5bda5cafe
-
SHA1
64609b5e3f4e42177e0a45ccaf974d88bb285031
-
SHA256
2acc4f42fd5082b21c30a4ddbaf0a8761b1a2f0d50bd681c3ca1630f6679d5c5
-
SHA512
68e3b30a76d30d058f55397a540d6250f9ff5acd8e22c970459f31fdf849709dc028991e66aaa813207236a01287274d63ab7c9871dd7bc02556913553594ad3
-
SSDEEP
12288:WbMqmzEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WItEEb4Ev/ATEXKGVnGTzpA1Ec1A
-
Cycbot family
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
Modiloader family
-
ModiLoader Second Stage
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1