General

  • Target

    JaffaCakes118_1c313f33f6d80d68b5de5617be4b1136

  • Size

    255KB

  • Sample

    250704-p1h3fafp2t

  • MD5

    1c313f33f6d80d68b5de5617be4b1136

  • SHA1

    8e1fe99302338fc0950bd4aae8f7b1fc53dd885e

  • SHA256

    9b3368baff8e616d8eebd26cd2f5b73d81b4c062201d4dc39ce1d90dfee03ef2

  • SHA512

    1f93638d33d8096853c0e0c23c357b00b34fa7f27c390739b54ef3d49f1890149bc211b49edba6d869300e296b12abaa91c685139188c3d429e40037e7e86ec7

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJL:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIG

Malware Config

Targets

    • Target

      JaffaCakes118_1c313f33f6d80d68b5de5617be4b1136

    • Size

      255KB

    • MD5

      1c313f33f6d80d68b5de5617be4b1136

    • SHA1

      8e1fe99302338fc0950bd4aae8f7b1fc53dd885e

    • SHA256

      9b3368baff8e616d8eebd26cd2f5b73d81b4c062201d4dc39ce1d90dfee03ef2

    • SHA512

      1f93638d33d8096853c0e0c23c357b00b34fa7f27c390739b54ef3d49f1890149bc211b49edba6d869300e296b12abaa91c685139188c3d429e40037e7e86ec7

    • SSDEEP

      3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJL:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIG

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks