General

  • Target

    JaffaCakes118_437a963159d0326806fa3289fee280b6

  • Size

    1.2MB

  • Sample

    250127-zec96svpel

  • MD5

    437a963159d0326806fa3289fee280b6

  • SHA1

    55a29e7c4b96e87ff204d7e4c43da940d36597c9

  • SHA256

    df0801a2c1176e47fa367fbf3da8ec7ad2aff6a4b9edb793dbbd9cbeb92d6c72

  • SHA512

    86b6adee3c60e8e2a63daa903eee1ff143dfac9fa93c5b35bc8404f9c0e51288257b2cf5fb7ee355709a2f1f27099eaa9c0633ba4912caaaade8bb1eed6886c6

  • SSDEEP

    12288:p3TdtLW5WIj1YSSdFxBn+Y4DrcUbJEAspaioTrLJ7lUapDFT2+zUk1FaJu9q:BDsj1dE4Y4DrJbkpavLhpxDgk18Ju9q

Malware Config

Targets

    • Target

      JaffaCakes118_437a963159d0326806fa3289fee280b6

    • Size

      1.2MB

    • MD5

      437a963159d0326806fa3289fee280b6

    • SHA1

      55a29e7c4b96e87ff204d7e4c43da940d36597c9

    • SHA256

      df0801a2c1176e47fa367fbf3da8ec7ad2aff6a4b9edb793dbbd9cbeb92d6c72

    • SHA512

      86b6adee3c60e8e2a63daa903eee1ff143dfac9fa93c5b35bc8404f9c0e51288257b2cf5fb7ee355709a2f1f27099eaa9c0633ba4912caaaade8bb1eed6886c6

    • SSDEEP

      12288:p3TdtLW5WIj1YSSdFxBn+Y4DrcUbJEAspaioTrLJ7lUapDFT2+zUk1FaJu9q:BDsj1dE4Y4DrJbkpavLhpxDgk18Ju9q

    • Modifies WinLogon for persistence

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks