General
-
Target
b5002c27c6a5d5cd593af082ad964528_JaffaCakes118
-
Size
2.2MB
-
Sample
240616-y1rh9azckl
-
MD5
b5002c27c6a5d5cd593af082ad964528
-
SHA1
14a299adc384ae4f08b0c90ff384d2c754dfddfd
-
SHA256
a3f95675b909e07e53d08dfcce4a8f9e75ce950935afd0a900344092889a17e6
-
SHA512
f4df53a813b286db02a5e9fc55b6a804b3b82578682625139445acdf3b77eeb9a46012647b11cdb11e6f3780f2a81503cf9c18747db3ea02138008c14dc78043
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwg
Behavioral task
behavioral1
Sample
b5002c27c6a5d5cd593af082ad964528_JaffaCakes118.exe
Resource
win7-20240611-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
b5002c27c6a5d5cd593af082ad964528_JaffaCakes118
-
Size
2.2MB
-
MD5
b5002c27c6a5d5cd593af082ad964528
-
SHA1
14a299adc384ae4f08b0c90ff384d2c754dfddfd
-
SHA256
a3f95675b909e07e53d08dfcce4a8f9e75ce950935afd0a900344092889a17e6
-
SHA512
f4df53a813b286db02a5e9fc55b6a804b3b82578682625139445acdf3b77eeb9a46012647b11cdb11e6f3780f2a81503cf9c18747db3ea02138008c14dc78043
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwg
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1