General

  • Target

    JaffaCakes118_086e046731a21258e1cd54730260add0

  • Size

    184KB

  • Sample

    250523-3wagdstjx2

  • MD5

    086e046731a21258e1cd54730260add0

  • SHA1

    581c9f8ee52917dc4060832325c5982b17a84a74

  • SHA256

    f31c2cc0dbd6ae3c4639d75d5062c29282a8d01382c385856ec3010b04ba7d07

  • SHA512

    44f2b5588cff2f599bbcd48f3d49b25bf21141a438fc902f30343b5c9d0cb8be645d0ff91ad605d947fa6c1c602e9552cd88354b49488afdf544765d0458f659

  • SSDEEP

    3072:GWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW1W:GWkWXV9wUezUroW+tCmCCfNGr

Malware Config

Targets

    • Target

      JaffaCakes118_086e046731a21258e1cd54730260add0

    • Size

      184KB

    • MD5

      086e046731a21258e1cd54730260add0

    • SHA1

      581c9f8ee52917dc4060832325c5982b17a84a74

    • SHA256

      f31c2cc0dbd6ae3c4639d75d5062c29282a8d01382c385856ec3010b04ba7d07

    • SHA512

      44f2b5588cff2f599bbcd48f3d49b25bf21141a438fc902f30343b5c9d0cb8be645d0ff91ad605d947fa6c1c602e9552cd88354b49488afdf544765d0458f659

    • SSDEEP

      3072:GWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW1W:GWkWXV9wUezUroW+tCmCCfNGr

    • Detects Mofksys worm

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Mofksys

      Mofksys is a worm written in VisualBasic.

    • Mofksys family

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks