General

  • Target

    JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809

  • Size

    600KB

  • Sample

    250328-rh4brsw1f1

  • MD5

    8abe43cb15a9dd8d69f77c0c833c6809

  • SHA1

    a011f0a13161d2dac9f01e609af99a4afc39b871

  • SHA256

    fab208d4fde711f95e4da7fdfe3d7855f866bd2f367570aac74320952291faa1

  • SHA512

    e66d77f0df46f46d278a9c22f204d346cbc9a4028d433307967421c9d62f4d54d26d5c8cd23511e733941c15b086e9d92925d5d55c5402770bdd90b509df2b1a

  • SSDEEP

    12288:46onxOp8FySpE5zvIdtU+YmefaRfMMMMM2MMMMM:swp8DozAdO9aRfMMMMM2MMMMM

Malware Config

Targets

    • Target

      JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809

    • Size

      600KB

    • MD5

      8abe43cb15a9dd8d69f77c0c833c6809

    • SHA1

      a011f0a13161d2dac9f01e609af99a4afc39b871

    • SHA256

      fab208d4fde711f95e4da7fdfe3d7855f866bd2f367570aac74320952291faa1

    • SHA512

      e66d77f0df46f46d278a9c22f204d346cbc9a4028d433307967421c9d62f4d54d26d5c8cd23511e733941c15b086e9d92925d5d55c5402770bdd90b509df2b1a

    • SSDEEP

      12288:46onxOp8FySpE5zvIdtU+YmefaRfMMMMM2MMMMM:swp8DozAdO9aRfMMMMM2MMMMM

    • Modifies WinLogon for persistence

    • Pykspa

      Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    • Pykspa family

    • Detect Pykspa worm

    • Adds policy Run key to start application

    • Blocklisted process makes network request

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks