Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
18/04/2024, 12:00
General
- Target f7f2b489d60ab8dfaf61694e48a700d0_JaffaCakes118.exe
- Size 280KB
- Sample240418-n6hs7acf66
- SHA256 e1562eb3537e28e60e400bb11ab1ce4fa948e8dbb7841775c6b876658ba05093
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7f2b489d60ab8dfaf61694e48a700d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7f2b489d60ab8dfaf61694e48a700d0_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
winlog.ini
memory/3916-30-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-33-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-25-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-26-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-27-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-28-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3916-29-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-0-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-1-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3916-31-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-32-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-34-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-35-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-36-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-37-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-38-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-39-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3916-40-0x0000000000400000-0x00000000004B2000-memory.dmp