bf35e80e534bcf502b1ad926b917b82694bfa2131abb1cb5efea806b029607aa

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
Size

3.4MB
MD5

0a51233f81c42c08f544378fae754ea8
SHA1

9d78dc6f4e20e7ab006ce59ad024fc3831011b50
SHA256

bf35e80e534bcf502b1ad926b917b82694bfa2131abb1cb5efea806b029607aa
SHA512

f7041c1d5752fc1f7ad11535856704af8794739ee639cec4a2b88d43196cbcc193e6db824d4f363d3133dde88ea93317654ccfd37c0a818b31a54760e86afc0d
SSDEEP

49152:9QDhlHXrtrTU/Ife2pd1INA0QqfnHTbpzpNkX33BHslzVIGEOgxUPfokHRMPNw3L:OhlHpH9fe2HWA09f3iKlzVoDeHo9wtd

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\createdump.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\setup.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\mip.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ExtExport.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\dotnet.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\dotnet.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ExtExport.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a51233f81c42c08f544378fae754ea8_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7z.exe

Filesize
3.4MB

MD5
2f0bad5691a5f9603aeaa968363ca4e8

SHA1
5f8366788498fa32e0e853e36013677b6a011881

SHA256
6fe90a531bd93d748a35b1f1013116820b44d72cb68df619e5fa82dbc730e490

SHA512
da593a22a9bf680c0c3f35c6ca280246495d0aa1c3a436ba54258c29a59b8849314e4eb724f027f16d0593ffe114367fd7e9ab61a018b4b96f9024f5f8b8c32a

Download Submit
memory/864-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-77-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-78-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-79-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-80-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-81-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-82-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-83-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-84-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-85-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-86-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-87-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-88-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-89-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/864-90-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads