General
-
Target
0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118
-
Size
255KB
-
Sample
240625-pha9wasdlk
-
MD5
0e0b392d511d9c14d51fff720b3f3d9e
-
SHA1
a7e78a574012637e6c300dba2f482a94e6ecfb65
-
SHA256
c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112
-
SHA512
d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad
-
SSDEEP
3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx
Static task
static1
Behavioral task
behavioral1
Sample
0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Targets
-
-
Target
0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118
-
Size
255KB
-
MD5
0e0b392d511d9c14d51fff720b3f3d9e
-
SHA1
a7e78a574012637e6c300dba2f482a94e6ecfb65
-
SHA256
c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112
-
SHA512
d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad
-
SSDEEP
3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1