General

  • Target

    JaffaCakes118_439742a35ed88059eaa579105f0adcc2

  • Size

    112KB

  • Sample

    250127-zpsslswjfj

  • MD5

    439742a35ed88059eaa579105f0adcc2

  • SHA1

    4abf030a6e523a780c5bdd39ac1f2761b03b0927

  • SHA256

    c07cdb18802e73af6f22157dc313d9bca8021e11cfa8f4b938d5d1a7d6c71a7e

  • SHA512

    ff8e0b7f0786fa81611bb776d2eaba746ab23ef1ee09b9385fa724b2b78b655303a870cf728cef791be2707e50e7b61327388416a6fb8eab96bd1770cb46f0df

  • SSDEEP

    3072:DVi+GaaeMfzwqkOD/bRKBl5+02g3/lU+3:Zi+GaaeMfEqke/bo393

Malware Config

Targets

    • Target

      JaffaCakes118_439742a35ed88059eaa579105f0adcc2

    • Size

      112KB

    • MD5

      439742a35ed88059eaa579105f0adcc2

    • SHA1

      4abf030a6e523a780c5bdd39ac1f2761b03b0927

    • SHA256

      c07cdb18802e73af6f22157dc313d9bca8021e11cfa8f4b938d5d1a7d6c71a7e

    • SHA512

      ff8e0b7f0786fa81611bb776d2eaba746ab23ef1ee09b9385fa724b2b78b655303a870cf728cef791be2707e50e7b61327388416a6fb8eab96bd1770cb46f0df

    • SSDEEP

      3072:DVi+GaaeMfzwqkOD/bRKBl5+02g3/lU+3:Zi+GaaeMfEqke/bo393

    • Adds policy Run key to start application

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks