General
-
Target
b3c9b2c140608b63f2d2f4ebfc6f64f8_JaffaCakes118
-
Size
2.6MB
-
Sample
240616-qxfnksvfna
-
MD5
b3c9b2c140608b63f2d2f4ebfc6f64f8
-
SHA1
754d30d5340f67b88d0a32291cf6457e3f301023
-
SHA256
57615c1ed2c6d65907fb155e9ea532955a3818f6847438b3fe370dd5b5dc1041
-
SHA512
2f7d3792f36a7b85b63c2b3a038e0cafcd01dd7cc5941af172ebadc7e4b0c0848de83db6984a8ef5ff3b41103cba02ff379790eee8c2e1561bff80b544fe2697
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlI:86SIROiFJiwp0xlrlI
Behavioral task
behavioral1
Sample
b3c9b2c140608b63f2d2f4ebfc6f64f8_JaffaCakes118.exe
Resource
win7-20240611-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
b3c9b2c140608b63f2d2f4ebfc6f64f8_JaffaCakes118
-
Size
2.6MB
-
MD5
b3c9b2c140608b63f2d2f4ebfc6f64f8
-
SHA1
754d30d5340f67b88d0a32291cf6457e3f301023
-
SHA256
57615c1ed2c6d65907fb155e9ea532955a3818f6847438b3fe370dd5b5dc1041
-
SHA512
2f7d3792f36a7b85b63c2b3a038e0cafcd01dd7cc5941af172ebadc7e4b0c0848de83db6984a8ef5ff3b41103cba02ff379790eee8c2e1561bff80b544fe2697
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlI:86SIROiFJiwp0xlrlI
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1