General
-
Target
a09396395729f7f086f03c14a4bbe852_JaffaCakes118
-
Size
2.2MB
-
Sample
240612-n2wt9atekh
-
MD5
a09396395729f7f086f03c14a4bbe852
-
SHA1
24a44b7b75491ae385105a0165797d6416b4a5a9
-
SHA256
2f9fd999fcabe0730ca789985437916aff640c47409381d507108819c58a642a
-
SHA512
f249772dc588e79bea676ff44235647ee4fd6a76da62f8833005661d451bd813b7d156a095173004d3a56c74fe394f6e914eaeda3d357e6cfb5eebd1a07bfe46
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwp
Behavioral task
behavioral1
Sample
a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
Resource
win7-20240220-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
a09396395729f7f086f03c14a4bbe852_JaffaCakes118
-
Size
2.2MB
-
MD5
a09396395729f7f086f03c14a4bbe852
-
SHA1
24a44b7b75491ae385105a0165797d6416b4a5a9
-
SHA256
2f9fd999fcabe0730ca789985437916aff640c47409381d507108819c58a642a
-
SHA512
f249772dc588e79bea676ff44235647ee4fd6a76da62f8833005661d451bd813b7d156a095173004d3a56c74fe394f6e914eaeda3d357e6cfb5eebd1a07bfe46
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwp
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1