ba20375f8f3769e1b105b4c70582ee54f05f546e057bb8bf8878c42677cc0fd4

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
Size

100KB
MD5

f17f2ed8d1e046c6627117d25a81fbb4
SHA1

ab3bdaf7f543495c0e09af55ad77d2294261afb1
SHA256

ba20375f8f3769e1b105b4c70582ee54f05f546e057bb8bf8878c42677cc0fd4
SHA512

e4bc129576394589dfdf0562e69da94d8481336e39ff04a8c4fb3bdf2a1606f46d9fb6f72fd97376751e37ba2a400c7cc5100f84e437205b75773e7c2ce1fa68
SSDEEP

3072:drRpnM2SMeKrVd/DJBwL9vG3VJWOBRdev/ruQ:drHM2SMekr/VBwB0J7BRsB

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2184	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mprwanp	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mprwanp\DllName = "C:\\Windows\\system32\\mprwanp.dll"	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mprwanp\Startup = "WlxStartupEvent"	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mprwanp\Shutdown = "WlxShutdownEvent"	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mprwanp\Impersonate = "0"	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mprwanp\Asynchronous = "0"	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mprwanp.dll	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mprwanp.exe	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2184	f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f17f2ed8d1e046c6627117d25a81fbb4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\mprwanp.dll

Filesize
112KB

MD5
fae9ff2aedbf70ac2a09ba631cf09b7e

SHA1
35a0a74f115631ed3477a149ff9fad8f83ea1361

SHA256
c14b30605d682693e6ca2e7304bd61b22af7f65c59552093d8432559c1ec615c

SHA512
f02e2ab5ed2ad51e0b297bdb80cdbeda21cb9977eaf47565e55c73901f909a20bf3b248f67b95db3ee8fc231a9d95ffd3ed9b980bbfe1c2dbfa6bdb1e97e3fc7

Download Submit
memory/2184-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2184-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download