51905ea134a854a0f4712457f7517e91df7b12128737a556509f0ab11829b3e4

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe
Size

46KB
MD5

fdef02cf0ad653d9cfabb78a155a0fe5
SHA1

42cdf5cb2b41bf83f530ee67d50cbca0db10eccf
SHA256

51905ea134a854a0f4712457f7517e91df7b12128737a556509f0ab11829b3e4
SHA512

152570f69696354621daf300a3dbf063d4bacc5bd4715a4cc1402957e0ecbb83bb347d905fdb130ec6f94fb81e123bfe744ea5d0a42c710ed7621dc525273c8e
SSDEEP

768:wchsJ6+4ZdlEaNo7WIOLAq39jWhc5txcn3a7AbUR9AT3GgSIi:XS6+4Z0aiWZ8CjWhc5txcn3a0b1TLSIi

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\ntos.exe,"	fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntos.exe	fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ntos.exe	fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe
2364	fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdef02cf0ad653d9cfabb78a155a0fe5_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2364-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2364-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download