General
-
Target
7313fa87781998c68e3bb117b7af5a28_JaffaCakes118
-
Size
2.6MB
-
Sample
240525-yp5azagg96
-
MD5
7313fa87781998c68e3bb117b7af5a28
-
SHA1
4c0f1c08f9ec89f448bdee46b15d2bb1b902d989
-
SHA256
755ab29e21828a07bb553e5d1a3cc21eba44a138a78f2b47347698f9d9b408d6
-
SHA512
754879808803810e49bec0dfde59664fb9d7827b3640aa9039221a7f46c43c827584d1772d5a39f9fc62e9279d4ebf45bb4b4e9c9ff774540a5872f1de89d6b5
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlc:86SIROiFJiwp0xlrlc
Behavioral task
behavioral1
Sample
7313fa87781998c68e3bb117b7af5a28_JaffaCakes118.exe
Resource
win7-20240419-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
7313fa87781998c68e3bb117b7af5a28_JaffaCakes118
-
Size
2.6MB
-
MD5
7313fa87781998c68e3bb117b7af5a28
-
SHA1
4c0f1c08f9ec89f448bdee46b15d2bb1b902d989
-
SHA256
755ab29e21828a07bb553e5d1a3cc21eba44a138a78f2b47347698f9d9b408d6
-
SHA512
754879808803810e49bec0dfde59664fb9d7827b3640aa9039221a7f46c43c827584d1772d5a39f9fc62e9279d4ebf45bb4b4e9c9ff774540a5872f1de89d6b5
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlc:86SIROiFJiwp0xlrlc
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1