b034210dd486ae846824749411a3145424ebf587e16744ab0c0717502ce7b0d4

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe
Size

53KB
MD5

fef4d051bb6e7134d60fd0bb0835b99c
SHA1

08a3ba08d12a95b118064c7fe2ac623f90fc30fb
SHA256

b034210dd486ae846824749411a3145424ebf587e16744ab0c0717502ce7b0d4
SHA512

d0d9cf63e52512ef94883aa7e751852122faf87c330dd7776a6d6ddbaab6fa6c86630d79c729c1fee6a1f53ec0254c970d2b249f0beefaba1f37b2ed9eae1490
SSDEEP

1536:VlEXx4KSghRRjwVJcBHWpvFR9Fi0Cruj7:3ojEDQHWpvFR9Fi5

Score

6^/10

persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensSrv\Impersonate = "1"	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensSrv\StartShell = "Entry"	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensSrv\DllName = "senssrv.dll"	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensSrv	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensSrv\Asynchronous = "1"	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\senssrv.dll	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21
PID 1640 wrote to memory of 1200	1640	fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fef4d051bb6e7134d60fd0bb0835b99c_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-34-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-61-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-4-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-7-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-10-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-13-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-16-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-19-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-22-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-25-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-28-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-1-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-40-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-37-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-64-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-43-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-46-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-49-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-52-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-55-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-58-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1200-31-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1640-0-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download
memory/1640-93-0x0000000013140000-0x000000001315E000-memory.dmp

Filesize
120KB

Download