General
-
Target
b4ea233d665e82b96a71414443fa3c28_JaffaCakes118
-
Size
2.2MB
-
Sample
240616-yl2exayeqq
-
MD5
b4ea233d665e82b96a71414443fa3c28
-
SHA1
20b346654fc0408006dfed70b056dd8d00187713
-
SHA256
ac50f10329840ab03f0d0c6f0631e0f349a269b24720e71e1224d6f67aeb7505
-
SHA512
8a0ef38be3af5bcf0768d984400a5a7566117df5bff7564eea3df513f9040e68b2e08990c34b2c658443d48c9161237badfadc6a50799c615d25b3c8afe4f124
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwt
Behavioral task
behavioral1
Sample
b4ea233d665e82b96a71414443fa3c28_JaffaCakes118.exe
Resource
win7-20240611-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
b4ea233d665e82b96a71414443fa3c28_JaffaCakes118
-
Size
2.2MB
-
MD5
b4ea233d665e82b96a71414443fa3c28
-
SHA1
20b346654fc0408006dfed70b056dd8d00187713
-
SHA256
ac50f10329840ab03f0d0c6f0631e0f349a269b24720e71e1224d6f67aeb7505
-
SHA512
8a0ef38be3af5bcf0768d984400a5a7566117df5bff7564eea3df513f9040e68b2e08990c34b2c658443d48c9161237badfadc6a50799c615d25b3c8afe4f124
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwt
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1