General
-
Target
a1a97dcd483b73bd4ea54856cda9513d_JaffaCakes118
-
Size
2.2MB
-
Sample
240612-wqltxavapd
-
MD5
a1a97dcd483b73bd4ea54856cda9513d
-
SHA1
b24ca4e77fd787baa3417172ffb1ccca528d2c6c
-
SHA256
2e37d4883a93ca39b50846722369c843dc3f7493c9c1527b0632e6edd4938bc8
-
SHA512
2660979a7daaf2fb98a64a87fbedfad2959ee24bcf846a32fff33479fb42bf6647bc134ecbd365b2a9f7d8395bf2b9eb12b12d26f186f8d844468dae96d5cedc
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWww8
Behavioral task
behavioral1
Sample
a1a97dcd483b73bd4ea54856cda9513d_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
a1a97dcd483b73bd4ea54856cda9513d_JaffaCakes118
-
Size
2.2MB
-
MD5
a1a97dcd483b73bd4ea54856cda9513d
-
SHA1
b24ca4e77fd787baa3417172ffb1ccca528d2c6c
-
SHA256
2e37d4883a93ca39b50846722369c843dc3f7493c9c1527b0632e6edd4938bc8
-
SHA512
2660979a7daaf2fb98a64a87fbedfad2959ee24bcf846a32fff33479fb42bf6647bc134ecbd365b2a9f7d8395bf2b9eb12b12d26f186f8d844468dae96d5cedc
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWww8
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1