General
-
Target
063d21bd9a5036a89712e570acdfa8f1_JaffaCakes118
-
Size
2.6MB
-
Sample
240428-2pp3tsba74
-
MD5
063d21bd9a5036a89712e570acdfa8f1
-
SHA1
a2309bb7288237f2ddfe3a624ad9204af4ca525f
-
SHA256
dfeeaf9486b0f80c35a6c58b323aca1f9c4912da4be68dcbaedee60ff0b8e1c2
-
SHA512
7f38d739059de02a4cd33aed7e05d9be1f80ad063b3437156309b8f4553f7358e849609db92683bdd0be3c21c8657165a8395a0de9a8ef85ec4e84bbcd3f31ba
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlh:86SIROiFJiwp0xlrlh
Behavioral task
behavioral1
Sample
063d21bd9a5036a89712e570acdfa8f1_JaffaCakes118.exe
Resource
win7-20240419-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
063d21bd9a5036a89712e570acdfa8f1_JaffaCakes118
-
Size
2.6MB
-
MD5
063d21bd9a5036a89712e570acdfa8f1
-
SHA1
a2309bb7288237f2ddfe3a624ad9204af4ca525f
-
SHA256
dfeeaf9486b0f80c35a6c58b323aca1f9c4912da4be68dcbaedee60ff0b8e1c2
-
SHA512
7f38d739059de02a4cd33aed7e05d9be1f80ad063b3437156309b8f4553f7358e849609db92683bdd0be3c21c8657165a8395a0de9a8ef85ec4e84bbcd3f31ba
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlh:86SIROiFJiwp0xlrlh
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1