8626018552d0429ed34fc847203b3ba12f459f446e679e318c653996a438da98

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f71cd32104a490af24802ce9ab8cf8ef_JaffaCakes118.exe
Size

202KB
MD5

f71cd32104a490af24802ce9ab8cf8ef
SHA1

de02d72f7e8776488a7cf56bd382982eaed9de2f
SHA256

8626018552d0429ed34fc847203b3ba12f459f446e679e318c653996a438da98
SHA512

aa73cc4cb6074c6ff5ce1936ce3fc2f3fcffa8eb7bf43e42d55b3ad2d5f887d6be3ce5299c903d8de8f2a70ec5da43f508e7dfe9e00a809b356a759c0fe96218
SSDEEP

6144:seoGs0nLprGHub4kIcFQPlK0LRvfjHFKrNZ:seuQB//WP75js

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\f71cd32104a490af24802ce9ab8cf8ef_JaffaCakes118.exe,"	f71cd32104a490af24802ce9ab8cf8ef_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2952-0-0x0000000000400000-0x0000000000484000-memory.dmp	upx
behavioral1/memory/2952-2-0x0000000000400000-0x0000000000484000-memory.dmp	upx
behavioral1/memory/2952-5-0x0000000000400000-0x0000000000484000-memory.dmp	upx
behavioral1/memory/2952-9-0x0000000000400000-0x0000000000484000-memory.dmp	upx
behavioral1/memory/2952-15-0x0000000000400000-0x0000000000484000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\com\simupdconf.dll	f71cd32104a490af24802ce9ab8cf8ef_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\com\simupdconf.dll	f71cd32104a490af24802ce9ab8cf8ef_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f71cd32104a490af24802ce9ab8cf8ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f71cd32104a490af24802ce9ab8cf8ef_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2952-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-2-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2952-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-5-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2952-9-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2952-15-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads