Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 18:29

General

  • Target

    a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    a1be9a0c2c85599235c3be2e4184607b

  • SHA1

    f227faf68af52b92f52b06a0bcd854e496178b79

  • SHA256

    2a25b5d94792b3a014f279dfabf23a59bcc3857a664a9ba790944d2ad48a86c9

  • SHA512

    a1d3df5142b0866702ed1267afe4382495d13893c7352f2a4bb327cd98608a0056ac87bc4e9c5f6e66502fd1328d7585f1785ebf1da9432cb19e6ea62107da7e

  • SSDEEP

    24576:CmUNJyJqb1FcMap2ATT5rmUNJyJqb1FcMap6mUNJyJqb1FcMap2ATT5rmUNJyJqG:CmV2AprmV6mV2AprmV6mV2AprmVG

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a1be9a0c2c85599235c3be2e4184607b_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Suspicious behavior: EnumeratesProcesses
      PID:3140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\apppatch\svchost.exe

    Filesize

    1.7MB

    MD5

    6cde2fbb3e7380533540f1e7c3717c34

    SHA1

    c5f7632a1a4504a233b900fe1dedc1233f0f5ba4

    SHA256

    1e95ca2377b67497e3ae350a0bffb72e3173a12a9fe67a685ffa1f701500e9f0

    SHA512

    c0e8ba27c8b39223ff7e7eb02f265f971470340ed80147651ec5511e59fac1f37e9112636f95563cf990c66ddee92b5501977b869a460c84e93504af1ab45c0a

  • memory/1356-9-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3140-10-0x0000000002940000-0x00000000029E8000-memory.dmp

    Filesize

    672KB

  • memory/3140-11-0x0000000002B30000-0x0000000002BE6000-memory.dmp

    Filesize

    728KB

  • memory/3140-15-0x0000000002B30000-0x0000000002BE6000-memory.dmp

    Filesize

    728KB

  • memory/3140-13-0x0000000002B30000-0x0000000002BE6000-memory.dmp

    Filesize

    728KB