General

  • Target

    JaffaCakes118_05ce908f8f5b3ae9c849ea00e9c57830

  • Size

    184KB

  • Sample

    250516-zpmxcs1py8

  • MD5

    05ce908f8f5b3ae9c849ea00e9c57830

  • SHA1

    f2d5ca0dba1e7702578360be66da506801b70c5f

  • SHA256

    369907592d622309c2288c64f06ede644c43b4a7377e946d2c2e24d7e65ce737

  • SHA512

    b4de958b4771e30afd49d7f6229e6c7f93aeef3925d7b48e651526a5c7a65fa87596a61f8f4aedbe95e3aacc63b1c32c2d9498cb511c03978b167d4817b18182

  • SSDEEP

    3072:FWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW1/QQQQQQQQQQQQQQQQQQQQQQQQy:FWkWXV9wUezUroW+tCmCCfNGyQQQQQQG

Malware Config

Targets

    • Target

      JaffaCakes118_05ce908f8f5b3ae9c849ea00e9c57830

    • Size

      184KB

    • MD5

      05ce908f8f5b3ae9c849ea00e9c57830

    • SHA1

      f2d5ca0dba1e7702578360be66da506801b70c5f

    • SHA256

      369907592d622309c2288c64f06ede644c43b4a7377e946d2c2e24d7e65ce737

    • SHA512

      b4de958b4771e30afd49d7f6229e6c7f93aeef3925d7b48e651526a5c7a65fa87596a61f8f4aedbe95e3aacc63b1c32c2d9498cb511c03978b167d4817b18182

    • SSDEEP

      3072:FWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW1/QQQQQQQQQQQQQQQQQQQQQQQQy:FWkWXV9wUezUroW+tCmCCfNGyQQQQQQG

    • Detects Mofksys worm

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Mofksys

      Mofksys is a worm written in VisualBasic.

    • Mofksys family

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks