General
-
Target
606a9064aba969682f1772ddb56b2521_JaffaCakes118
-
Size
2.6MB
-
Sample
240520-wgfljabh7z
-
MD5
606a9064aba969682f1772ddb56b2521
-
SHA1
651fb3792f58abf818e5f1ded096b7e455c2f430
-
SHA256
6efd2bf328eaca2fcfd10acfcef12ea264fc81dc6d38c1baf4908579c1947757
-
SHA512
6a1634badb163fd03b7e136e2734ad3ddf815a837a3c622c38b1580c792a08af3263b086334fb66ff296840d46847ab27a845aefb3394bfd0397cc436366fb4f
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlh:86SIROiFJiwp0xlrlh
Behavioral task
behavioral1
Sample
606a9064aba969682f1772ddb56b2521_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
606a9064aba969682f1772ddb56b2521_JaffaCakes118
-
Size
2.6MB
-
MD5
606a9064aba969682f1772ddb56b2521
-
SHA1
651fb3792f58abf818e5f1ded096b7e455c2f430
-
SHA256
6efd2bf328eaca2fcfd10acfcef12ea264fc81dc6d38c1baf4908579c1947757
-
SHA512
6a1634badb163fd03b7e136e2734ad3ddf815a837a3c622c38b1580c792a08af3263b086334fb66ff296840d46847ab27a845aefb3394bfd0397cc436366fb4f
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlh:86SIROiFJiwp0xlrlh
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1