General
-
Target
fddfc00afdbee76bc87893521abb7b47_JaffaCakes118
-
Size
2.2MB
-
Sample
240929-f2hzds1eqm
-
MD5
fddfc00afdbee76bc87893521abb7b47
-
SHA1
b1d5810ea6599c55e2f3d80f812aec2851425fd6
-
SHA256
8fe142e57379fd5838a153790e8e6e624aaf7552ea57ee7956164b7a3fa98f36
-
SHA512
a1277ddcfe993d83ed925367b74658c272aa7d68e3691a3b34daf96a9f7894c11d7a7a8669a4dbdbf7e866ab20b4e80373ee0abc6e596dd794063eb00782cfa7
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZc:0UzeyQMS4DqodCnoe+iitjWww4
Behavioral task
behavioral1
Sample
fddfc00afdbee76bc87893521abb7b47_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
fddfc00afdbee76bc87893521abb7b47_JaffaCakes118
-
Size
2.2MB
-
MD5
fddfc00afdbee76bc87893521abb7b47
-
SHA1
b1d5810ea6599c55e2f3d80f812aec2851425fd6
-
SHA256
8fe142e57379fd5838a153790e8e6e624aaf7552ea57ee7956164b7a3fa98f36
-
SHA512
a1277ddcfe993d83ed925367b74658c272aa7d68e3691a3b34daf96a9f7894c11d7a7a8669a4dbdbf7e866ab20b4e80373ee0abc6e596dd794063eb00782cfa7
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZc:0UzeyQMS4DqodCnoe+iitjWww4
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4