Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 18:29
Static task
static1
Behavioral task
behavioral1
Sample
a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
a1be9a0c2c85599235c3be2e4184607b
-
SHA1
f227faf68af52b92f52b06a0bcd854e496178b79
-
SHA256
2a25b5d94792b3a014f279dfabf23a59bcc3857a664a9ba790944d2ad48a86c9
-
SHA512
a1d3df5142b0866702ed1267afe4382495d13893c7352f2a4bb327cd98608a0056ac87bc4e9c5f6e66502fd1328d7585f1785ebf1da9432cb19e6ea62107da7e
-
SSDEEP
24576:CmUNJyJqb1FcMap2ATT5rmUNJyJqb1FcMap6mUNJyJqb1FcMap2ATT5rmUNJyJqG:CmV2AprmV6mV2AprmV6mV2AprmVG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 3140 svchost.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\3a4f0a00 = "–ÖúbQ€:Ä;ýѯv\x06\x14Y_\x15<§\u008f‚ß\rœ‡t+ž„²ßV¼Ì¨U.´/\x1bάŽ_–\x15£í”uÝ\x1c<$N¦\x1f\\..6†uu”.\v›pæ“–\f#ŸK,¾H†„à¿‹L\u009d[¾†\u009d´6ï”TÈF½-tÎã<¤“\x18H{$•¸çç…—^ <>ãÓ|wÖÔŽDÕ›.æVvý\x1cu{Uë|\x1c\fΞw\b»¯\x1c½f»?s7\v;]<\u008d\x0e\v}ÞlÅ\x13¬\x18¼\x18wö|ÀF¼SȇÔ-KŒh•äý\x1e~Ó—5lgn«U\bµƒÓF…ÎÐHÛÝŒåc«Ìä/T& ”^›õ#®–<ßæ0Õwp\x7fÆ„ÄtÔ_Ö€þ¬>Ó§P.\x14dMT\x1c=Ý" a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\3a4f0a00 = "–ÖúbQ€:Ä;ýѯv\x06\x14Y_\x15<§\u008f‚ß\rœ‡t+ž„²ßV¼Ì¨U.´/\x1bάŽ_–\x15£í”uÝ\x1c<$N¦\x1f\\..6†uu”.\v›pæ“–\f#ŸK,¾H†„à¿‹L\u009d[¾†\u009d´6ï”TÈF½-tÎã<¤“\x18H{$•¸çç…—^ <>ãÓ|wÖÔŽDÕ›.æVvý\x1cu{Uë|\x1c\fΞw\b»¯\x1c½f»?s7\v;]<\u008d\x0e\v}ÞlÅ\x13¬\x18¼\x18wö|ÀF¼SȇÔ-KŒh•äý\x1e~Ó—5lgn«U\bµƒÓF…ÎÐHÛÝŒåc«Ìä/T& ”^›õ#®–<ßæ0Õwp\x7fÆ„ÄtÔ_Ö€þ¬>Ó§P.\x14dMT\x1c=Ý" svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe File opened for modification C:\Windows\apppatch\svchost.exe a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe 3140 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1356 wrote to memory of 3140 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 82 PID 1356 wrote to memory of 3140 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 82 PID 1356 wrote to memory of 3140 1356 a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD56cde2fbb3e7380533540f1e7c3717c34
SHA1c5f7632a1a4504a233b900fe1dedc1233f0f5ba4
SHA2561e95ca2377b67497e3ae350a0bffb72e3173a12a9fe67a685ffa1f701500e9f0
SHA512c0e8ba27c8b39223ff7e7eb02f265f971470340ed80147651ec5511e59fac1f37e9112636f95563cf990c66ddee92b5501977b869a460c84e93504af1ab45c0a