General
-
Target
e096ccb0e8a65612cee0590961d5857a_JaffaCakes118
-
Size
2.6MB
-
Sample
240914-t5f6vsthrh
-
MD5
e096ccb0e8a65612cee0590961d5857a
-
SHA1
6493f032ebfed8e41bc145ad2ed899339bbe4f89
-
SHA256
ead034be93f88cefc867711dd93e42888e283b429dd395aa144ab60d5f1e288f
-
SHA512
76e203d08c4b217e5c01f8f399ff4be60538c240775b39254278c8225c3aba83c9a2dff44c0c79741abb9d188077a97c84939ae238999ac21278e715d1b7a27c
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlI:86SIROiFJiwp0xlrlI
Behavioral task
behavioral1
Sample
e096ccb0e8a65612cee0590961d5857a_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
e096ccb0e8a65612cee0590961d5857a_JaffaCakes118
-
Size
2.6MB
-
MD5
e096ccb0e8a65612cee0590961d5857a
-
SHA1
6493f032ebfed8e41bc145ad2ed899339bbe4f89
-
SHA256
ead034be93f88cefc867711dd93e42888e283b429dd395aa144ab60d5f1e288f
-
SHA512
76e203d08c4b217e5c01f8f399ff4be60538c240775b39254278c8225c3aba83c9a2dff44c0c79741abb9d188077a97c84939ae238999ac21278e715d1b7a27c
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlI:86SIROiFJiwp0xlrlI
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4