General
-
Target
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118
-
Size
2.2MB
-
Sample
240523-q14jtadb31
-
MD5
6b214ace0c1343ee65660c5e8c19e714
-
SHA1
629ad1be1699a2f83618aba735c0bd9543f2e7b2
-
SHA256
28a9eb8953fbe5d833c7855b6021b95fb620899896d097ddde7f6f94fffbd41b
-
SHA512
6d5a147b6c1bf56adc9cd19f8ba1099cfc358b86e82aa4ca7b50ef015a7b8f6787cc1809acda3c1f607c3cc4b6ab3fad35823024b04c4f3526f8428afb3346d9
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwww
Behavioral task
behavioral1
Sample
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118
-
Size
2.2MB
-
MD5
6b214ace0c1343ee65660c5e8c19e714
-
SHA1
629ad1be1699a2f83618aba735c0bd9543f2e7b2
-
SHA256
28a9eb8953fbe5d833c7855b6021b95fb620899896d097ddde7f6f94fffbd41b
-
SHA512
6d5a147b6c1bf56adc9cd19f8ba1099cfc358b86e82aa4ca7b50ef015a7b8f6787cc1809acda3c1f607c3cc4b6ab3fad35823024b04c4f3526f8428afb3346d9
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwww
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1