General
-
Target
812494a810d3f0299d9459ff41af7e70_JaffaCakes118
-
Size
2.6MB
-
Sample
240529-sefxqsaf88
-
MD5
812494a810d3f0299d9459ff41af7e70
-
SHA1
cb0444952002e60ceed33909e70bdc062d0433cc
-
SHA256
958066b708d87eb36e1b55402f437efa708235ff418b77abfdcba388952721f1
-
SHA512
0d6166bb54b71ffdb8c8ba13d9a16b4d9d49a89fef1b44080230ab58064395bc12384ff37c5e3ab5c5f47b6809d1338a44947bd7e70fe17915253ed57928ebe5
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrla:86SIROiFJiwp0xlrla
Behavioral task
behavioral1
Sample
812494a810d3f0299d9459ff41af7e70_JaffaCakes118.exe
Resource
win7-20240215-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
812494a810d3f0299d9459ff41af7e70_JaffaCakes118
-
Size
2.6MB
-
MD5
812494a810d3f0299d9459ff41af7e70
-
SHA1
cb0444952002e60ceed33909e70bdc062d0433cc
-
SHA256
958066b708d87eb36e1b55402f437efa708235ff418b77abfdcba388952721f1
-
SHA512
0d6166bb54b71ffdb8c8ba13d9a16b4d9d49a89fef1b44080230ab58064395bc12384ff37c5e3ab5c5f47b6809d1338a44947bd7e70fe17915253ed57928ebe5
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrla:86SIROiFJiwp0xlrla
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1