General
-
Target
b3c51dd0ef2319f3e4a3d04e29f00e99_JaffaCakes118
-
Size
2.6MB
-
Sample
240616-qt6qlaygrl
-
MD5
b3c51dd0ef2319f3e4a3d04e29f00e99
-
SHA1
43e99e3a54904f81af6dc1b4257fdefa5d0bbfe9
-
SHA256
5ec645d378dd293fde3198358dadfc63bc57b347ba32ede16b30561cf2c1d483
-
SHA512
07ddb17576196fe775bdb2b198a4298751bc8a7fa6bd113530e2bca13b92d404e48d3ee590200591e7c40104bb19d3dae6e1633634d4b4408b1e772e4838cf3a
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB
Behavioral task
behavioral1
Sample
b3c51dd0ef2319f3e4a3d04e29f00e99_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
b3c51dd0ef2319f3e4a3d04e29f00e99_JaffaCakes118
-
Size
2.6MB
-
MD5
b3c51dd0ef2319f3e4a3d04e29f00e99
-
SHA1
43e99e3a54904f81af6dc1b4257fdefa5d0bbfe9
-
SHA256
5ec645d378dd293fde3198358dadfc63bc57b347ba32ede16b30561cf2c1d483
-
SHA512
07ddb17576196fe775bdb2b198a4298751bc8a7fa6bd113530e2bca13b92d404e48d3ee590200591e7c40104bb19d3dae6e1633634d4b4408b1e772e4838cf3a
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1