General

  • Target

    JaffaCakes118_1c2426de3fcb65c30dd3dbc3d9a0d103

  • Size

    255KB

  • Sample

    250704-nr75jadp7t

  • MD5

    1c2426de3fcb65c30dd3dbc3d9a0d103

  • SHA1

    c109767ab727e16dfd473bde787066208b7bb3e8

  • SHA256

    4ab9b6d8cd5df29cd333d49a7d25cca37806ff4a13288863cac1ea06ef398987

  • SHA512

    bb53536d73148eabe9896251b1ad26a3b1706527a5a9ef4bd1e16cba14ea6a8fc5be7733896ecaa781f8d5572dff58f1be024892a4a316192db70634c629fd8b

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ9:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIG

Malware Config

Targets

    • Target

      JaffaCakes118_1c2426de3fcb65c30dd3dbc3d9a0d103

    • Size

      255KB

    • MD5

      1c2426de3fcb65c30dd3dbc3d9a0d103

    • SHA1

      c109767ab727e16dfd473bde787066208b7bb3e8

    • SHA256

      4ab9b6d8cd5df29cd333d49a7d25cca37806ff4a13288863cac1ea06ef398987

    • SHA512

      bb53536d73148eabe9896251b1ad26a3b1706527a5a9ef4bd1e16cba14ea6a8fc5be7733896ecaa781f8d5572dff58f1be024892a4a316192db70634c629fd8b

    • SSDEEP

      3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ9:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIG

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks