General
-
Target
67ca8b3139015cedeef819ec900f4917_JaffaCakes118
-
Size
2.6MB
-
Sample
240522-s9y2ssgc7z
-
MD5
67ca8b3139015cedeef819ec900f4917
-
SHA1
f3d8e13e84e82673fb1533bc7bc60e34c65040ff
-
SHA256
a76b02df006a87908592635101834500b87b25ad53cd6dcb3ea45f7bcd6f221f
-
SHA512
0d1eb66f2865f472224ff6c0fe046a1e48b0a197f4b604aa1ea31c67d88bd99edc8780644f47fc123bd929dc74987370635a724fc17a2fe81d5aa618e3089a11
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl4:86SIROiFJiwp0xlrl4
Behavioral task
behavioral1
Sample
67ca8b3139015cedeef819ec900f4917_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
67ca8b3139015cedeef819ec900f4917_JaffaCakes118
-
Size
2.6MB
-
MD5
67ca8b3139015cedeef819ec900f4917
-
SHA1
f3d8e13e84e82673fb1533bc7bc60e34c65040ff
-
SHA256
a76b02df006a87908592635101834500b87b25ad53cd6dcb3ea45f7bcd6f221f
-
SHA512
0d1eb66f2865f472224ff6c0fe046a1e48b0a197f4b604aa1ea31c67d88bd99edc8780644f47fc123bd929dc74987370635a724fc17a2fe81d5aa618e3089a11
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl4:86SIROiFJiwp0xlrl4
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1