General
-
Target
78e6df9bf7b542974088afbddfd42f2f_JaffaCakes118
-
Size
2.2MB
-
Sample
240527-mw9y9agh2w
-
MD5
78e6df9bf7b542974088afbddfd42f2f
-
SHA1
f657f53c6ffdf1131f3fa050cfae27eb08ed110b
-
SHA256
82d1fb1a76ee3e91c1e3e9488b19d5506c18a297d568f9fb6bbfc4da3deb3fbb
-
SHA512
599a26c5a959dbeb5fec788ff6ae7e91aea4fbbb0d058b15348d77ee27a41ce16490b678db6a53b94a6ea6b2a85e9962685fa68ed3a7d9feb46e079f05c3c09c
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWww0
Behavioral task
behavioral1
Sample
78e6df9bf7b542974088afbddfd42f2f_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
78e6df9bf7b542974088afbddfd42f2f_JaffaCakes118
-
Size
2.2MB
-
MD5
78e6df9bf7b542974088afbddfd42f2f
-
SHA1
f657f53c6ffdf1131f3fa050cfae27eb08ed110b
-
SHA256
82d1fb1a76ee3e91c1e3e9488b19d5506c18a297d568f9fb6bbfc4da3deb3fbb
-
SHA512
599a26c5a959dbeb5fec788ff6ae7e91aea4fbbb0d058b15348d77ee27a41ce16490b678db6a53b94a6ea6b2a85e9962685fa68ed3a7d9feb46e079f05c3c09c
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWww0
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1