Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 23:30

General

  • Target

    a71d3613016780d00c82f4fb96975956_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    a71d3613016780d00c82f4fb96975956

  • SHA1

    43841dc474f6da972b5a6be8705fcaa942084836

  • SHA256

    5be2fab6e4c7b734dff715f7a02bf69e00703f57819b71c6758d259469fa77f3

  • SHA512

    4ba41c576dc7adad058bdda870eda0a13380a8151ddb88992d5654256fc5235711acc8c1e56bec55417036b18716e8b9fcd28a35c8b4615f3ca9c32ba547643e

  • SSDEEP

    24576:vmUNJyJqb1FcMap2ATT5qmUNJyJqb1FcMap2ATT5qmUNJyJqb1FcMap2ATT58:vmV2ApqmV2ApqmV2Ap8

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a71d3613016780d00c82f4fb96975956_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a71d3613016780d00c82f4fb96975956_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Suspicious behavior: EnumeratesProcesses
      PID:4488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\apppatch\svchost.exe

    Filesize

    1.0MB

    MD5

    b716580790de5aaf1062f17ef449c6a7

    SHA1

    b820837cbae65f0e4926f7d5f459d19e35f322d1

    SHA256

    2925c975ed4919dd564e6a91ad922877c083a55a8d5ab3a035c3e0a39efdd08b

    SHA512

    3928ff0e39adec905218d427a66c8ef1ce81cd2d20600018795e87a9571c9a6038e4abd97069836fe65e6b184d68e78d2985343c71108b509a8f2026ace65a0b

  • memory/4488-10-0x0000000002720000-0x00000000027C8000-memory.dmp

    Filesize

    672KB

  • memory/4488-11-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/4488-13-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/4488-16-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/4904-9-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB