General
-
Target
b3bd7cb5dd6f0526477c5d0f7855668a_JaffaCakes118
-
Size
2.6MB
-
Sample
240616-qp2k3svdkd
-
MD5
b3bd7cb5dd6f0526477c5d0f7855668a
-
SHA1
64878c34cf273c1b833dd32be25451fff1332910
-
SHA256
0f69a626451b7e3b28e8dc007d7c0f38c9fd407280ef801472c3b9cd5f49fb7f
-
SHA512
1c50a71a0007d2422a0e01df2cc8b1320fe24a64056d63ee77c5a2eca2d98034fd72a55c4d6a08dd83ad486a1f79c366b905c5d9eaf0cdfe4d205a4e2638dd6c
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB
Behavioral task
behavioral1
Sample
b3bd7cb5dd6f0526477c5d0f7855668a_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
b3bd7cb5dd6f0526477c5d0f7855668a_JaffaCakes118
-
Size
2.6MB
-
MD5
b3bd7cb5dd6f0526477c5d0f7855668a
-
SHA1
64878c34cf273c1b833dd32be25451fff1332910
-
SHA256
0f69a626451b7e3b28e8dc007d7c0f38c9fd407280ef801472c3b9cd5f49fb7f
-
SHA512
1c50a71a0007d2422a0e01df2cc8b1320fe24a64056d63ee77c5a2eca2d98034fd72a55c4d6a08dd83ad486a1f79c366b905c5d9eaf0cdfe4d205a4e2638dd6c
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1