General

  • Target

    JaffaCakes118_0a641e90a2ed5795c491cc19ee383830

  • Size

    260KB

  • Sample

    250527-rsvsdaej6y

  • MD5

    0a641e90a2ed5795c491cc19ee383830

  • SHA1

    70a23292f3317b89992d3b07ed7f2eea2bd5a0ed

  • SHA256

    7a1bdb83714d8ca9108a8055c73b87e7fd9258ac07003e8470a3bbdd9cdb1706

  • SHA512

    8a43844c059b231d43f1aaf5b22046d2a517bbcf4d510dfae3482198aed33e28c85d964d6c5e77bde855253eb7978c9c9232ce0ffb8cc110074ed6c65f7a2519

  • SSDEEP

    3072:PWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW18:PWkWXV9wUezUroW+tCmCCfNG5

Malware Config

Targets

    • Target

      JaffaCakes118_0a641e90a2ed5795c491cc19ee383830

    • Size

      260KB

    • MD5

      0a641e90a2ed5795c491cc19ee383830

    • SHA1

      70a23292f3317b89992d3b07ed7f2eea2bd5a0ed

    • SHA256

      7a1bdb83714d8ca9108a8055c73b87e7fd9258ac07003e8470a3bbdd9cdb1706

    • SHA512

      8a43844c059b231d43f1aaf5b22046d2a517bbcf4d510dfae3482198aed33e28c85d964d6c5e77bde855253eb7978c9c9232ce0ffb8cc110074ed6c65f7a2519

    • SSDEEP

      3072:PWkWRM0We9kVF3GezUroWlBCtCmCdXC1D1NGW18:PWkWXV9wUezUroW+tCmCCfNG5

    • Detects Mofksys worm

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Mofksys

      Mofksys is a worm written in VisualBasic.

    • Mofksys family

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks