General
-
Target
032a7d68e1234c9a0ccdda5a288708e7_JaffaCakes118
-
Size
2.2MB
-
Sample
240427-nrt8nshf57
-
MD5
032a7d68e1234c9a0ccdda5a288708e7
-
SHA1
6f075e904902102b5e04e612c4b72d8a56ba8b9c
-
SHA256
d4f195d677c8c5dac381139b1d6fb940622f31abe884a6ec757baa4f225f0be9
-
SHA512
8073a7b7cd61d777475414757b2011c0eaa3e74b9b66e0ffbc1acacf88b28a4051cf2df141a4213f45409c9dae21eff0c9829149e8de9de164b7955dbfbbc324
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwE
Behavioral task
behavioral1
Sample
032a7d68e1234c9a0ccdda5a288708e7_JaffaCakes118.exe
Resource
win7-20240220-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
032a7d68e1234c9a0ccdda5a288708e7_JaffaCakes118
-
Size
2.2MB
-
MD5
032a7d68e1234c9a0ccdda5a288708e7
-
SHA1
6f075e904902102b5e04e612c4b72d8a56ba8b9c
-
SHA256
d4f195d677c8c5dac381139b1d6fb940622f31abe884a6ec757baa4f225f0be9
-
SHA512
8073a7b7cd61d777475414757b2011c0eaa3e74b9b66e0ffbc1acacf88b28a4051cf2df141a4213f45409c9dae21eff0c9829149e8de9de164b7955dbfbbc324
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwE
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1