d22db20d92124e9d102b6f017c7b6e9fd803a37e16aab6e7b6b38df0937815c0

Analysis

max time kernel
145s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe
Size

320KB
MD5

fc904f466e5c122a5a51d73f760afdee
SHA1

c3b28d9dcfa5c4569fdd1a139b90efff8303a3bb
SHA256

d22db20d92124e9d102b6f017c7b6e9fd803a37e16aab6e7b6b38df0937815c0
SHA512

44ae716bd312c2e7a6a8a5f3429ad453de602728c119c6498062ad91d2c98da62ab8213bf37524280d6f74dbdc875cfc66e75806ac08ae4d1e334e24a2d278e7
SSDEEP

6144:cKEmY9BU4aP5cERBHo83ItPBopwbjQRvqJfIDEjs:e9BU4OcmBI8gPBopwbjCvqJfIN

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe,C:\\Arquivos de programas\\mxzxtQVU.exe"	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\MSFS	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\MAPI	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\IMAIL	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\winlogn.ini	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc904f466e5c122a5a51d73f760afdee_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-0-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2752-1-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-3-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-4-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-5-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-6-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-7-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-8-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-9-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-10-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-11-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-12-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-13-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2752-14-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads