General
-
Target
JaffaCakes118_060d0d947bda5a2c879b4d8c2b53960e
-
Size
2.2MB
-
Sample
250517-j5trvabm4x
-
MD5
060d0d947bda5a2c879b4d8c2b53960e
-
SHA1
e159a6f56db1241a4070502a492e264dcd2f56c0
-
SHA256
b9a8b56fe7101ac8b4c2335ccea3323d8685063adc2354999d402ea791ce1122
-
SHA512
7ab888f5b446dc58b3841d974ee8c0276d44d98e958d0cc3e0964340fb369cc528824acaa5bf7d4b61d5e598afe66ef0658b19a7e59b7657bfa5e59ea180c3d4
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwF
Behavioral task
behavioral1
Sample
JaffaCakes118_060d0d947bda5a2c879b4d8c2b53960e.exe
Resource
win10v2004-20250502-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
JaffaCakes118_060d0d947bda5a2c879b4d8c2b53960e
-
Size
2.2MB
-
MD5
060d0d947bda5a2c879b4d8c2b53960e
-
SHA1
e159a6f56db1241a4070502a492e264dcd2f56c0
-
SHA256
b9a8b56fe7101ac8b4c2335ccea3323d8685063adc2354999d402ea791ce1122
-
SHA512
7ab888f5b446dc58b3841d974ee8c0276d44d98e958d0cc3e0964340fb369cc528824acaa5bf7d4b61d5e598afe66ef0658b19a7e59b7657bfa5e59ea180c3d4
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwF
-
Detects Mofksys worm
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Mofksys family
-
Pony family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4