Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 18:29

General

  • Target

    a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    a1be9a0c2c85599235c3be2e4184607b

  • SHA1

    f227faf68af52b92f52b06a0bcd854e496178b79

  • SHA256

    2a25b5d94792b3a014f279dfabf23a59bcc3857a664a9ba790944d2ad48a86c9

  • SHA512

    a1d3df5142b0866702ed1267afe4382495d13893c7352f2a4bb327cd98608a0056ac87bc4e9c5f6e66502fd1328d7585f1785ebf1da9432cb19e6ea62107da7e

  • SSDEEP

    24576:CmUNJyJqb1FcMap2ATT5rmUNJyJqb1FcMap6mUNJyJqb1FcMap2ATT5rmUNJyJqG:CmV2AprmV6mV2AprmV6mV2AprmVG

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Suspicious behavior: EnumeratesProcesses
      PID:1996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\AppPatch\svchost.exe

    Filesize

    1.7MB

    MD5

    1a4d3917e20b70fb7c26194deb0b40f9

    SHA1

    cef6429b496c0bb4dd481687aa44e34b710d9825

    SHA256

    421763ec9ecbb49f320bb917e75f808e5a847b0208fca8db98a59eaf458d028f

    SHA512

    e5f89b83d835e51cf908d4d792422da13142616a7ec6fc75881df944838424c794591c79d107b5f364b7e7942c33ec79ed9896e90f1183ed404861491986cc29

  • memory/1736-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1996-14-0x00000000021A0000-0x0000000002248000-memory.dmp

    Filesize

    672KB

  • memory/1996-22-0x00000000021A0000-0x0000000002248000-memory.dmp

    Filesize

    672KB

  • memory/1996-20-0x00000000021A0000-0x0000000002248000-memory.dmp

    Filesize

    672KB

  • memory/1996-18-0x00000000021A0000-0x0000000002248000-memory.dmp

    Filesize

    672KB

  • memory/1996-16-0x00000000021A0000-0x0000000002248000-memory.dmp

    Filesize

    672KB

  • memory/1996-24-0x00000000021A0000-0x0000000002248000-memory.dmp

    Filesize

    672KB

  • memory/1996-25-0x0000000002350000-0x0000000002406000-memory.dmp

    Filesize

    728KB

  • memory/1996-27-0x0000000002350000-0x0000000002406000-memory.dmp

    Filesize

    728KB

  • memory/1996-31-0x0000000002350000-0x0000000002406000-memory.dmp

    Filesize

    728KB