General
-
Target
0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118
-
Size
2.2MB
-
Sample
240425-zzl3taeh6v
-
MD5
0014cb2974a8f2ea528843b3310e0a69
-
SHA1
f452c3a22e4de324c80bc2dbb15f285853eb6a02
-
SHA256
00a605dd0c4989ff8e81145406fb46c67891acdf98dd8c7f9597206e03ad9343
-
SHA512
34c474c3948720e15d95933894176c22377e61e7a4588a763d89e568e16d7af99c2190c99a8ccf19ac57c374e338a98d27af494535a152e01c9a059213de211b
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ6:0UzeyQMS4DqodCnoe+iitjWww+
Behavioral task
behavioral1
Sample
0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe
Resource
win7-20240215-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118
-
Size
2.2MB
-
MD5
0014cb2974a8f2ea528843b3310e0a69
-
SHA1
f452c3a22e4de324c80bc2dbb15f285853eb6a02
-
SHA256
00a605dd0c4989ff8e81145406fb46c67891acdf98dd8c7f9597206e03ad9343
-
SHA512
34c474c3948720e15d95933894176c22377e61e7a4588a763d89e568e16d7af99c2190c99a8ccf19ac57c374e338a98d27af494535a152e01c9a059213de211b
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ6:0UzeyQMS4DqodCnoe+iitjWww+
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1