Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 02:40

General

  • Target

    a39084f6914df376a522019e89028713_JaffaCakes118.exe

  • Size

    355KB

  • MD5

    a39084f6914df376a522019e89028713

  • SHA1

    4391986d2241cab28241d335cd6cac890d4c45cb

  • SHA256

    ccb22c4efc01a9fd7d18e544628da418685c943732f659cba88eeeceed27b349

  • SHA512

    f62705e6a9d2b1fd404dc43b0421846425093de2cab5bce86150c50fcacfe6178d42011c99394b6ab08070b4001e4a9b1f81ebaa1b23ee866698222e8cbe48c5

  • SSDEEP

    6144:k3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:vmWhND9yJz+b1FcMLmp2ATTSsdS

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a39084f6914df376a522019e89028713_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a39084f6914df376a522019e89028713_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Suspicious behavior: EnumeratesProcesses
      PID:2652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\apppatch\svchost.exe

    Filesize

    355KB

    MD5

    4a083254988c12f573a897690558a8a4

    SHA1

    da9ae6b7ef92b1d10f28cae0a4e2cbb96accd104

    SHA256

    1fa99f777ac758a52d3ebfe5aaab7d56d0d075e2c878301efe8b29f739efc706

    SHA512

    23a76b52325b81b73cf15c60c76c65ea25cefdc55eeed81aa12d7f35634c646661be77bdcb93870ff0c600dd165ac49ab442fd8ab3eb34aabaa453b21c78669c

  • memory/1156-9-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2652-10-0x0000000002720000-0x00000000027C8000-memory.dmp

    Filesize

    672KB

  • memory/2652-11-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/2652-15-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/2652-13-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB