aa7bd0132535ceac52a6f36c3730053b1d15af167d4a630139d732647f71b83f

Analysis

max time kernel
6s
max time network
6s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

05c10572b8a7e586b029d723671c97c3_JaffaCakes118.exe
Size

124KB
MD5

05c10572b8a7e586b029d723671c97c3
SHA1

acd5f7a3679190d5bb65277cd1fdb87e5c5b83d8
SHA256

aa7bd0132535ceac52a6f36c3730053b1d15af167d4a630139d732647f71b83f
SHA512

a185580277136119688504687c15bc45d534a5f1bda6f5e9e58ad2ddbee2b11b1d9a23415642091806046f1e7e63e8823cb30640258a2ccdeb8255fe74814ca0
SSDEEP

1536:trgzsp9HyEJ1y7BXr3UBZHxZiOaZupjCswNb1GGGZZmliLFcHo5A4PXHuAkl5zCH:tFHyEJmmvR5Br6bGZQiLiHo5LWAE5zY

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hynfjmg.dll	05c10572b8a7e586b029d723671c97c3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3036	05c10572b8a7e586b029d723671c97c3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\05c10572b8a7e586b029d723671c97c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05c10572b8a7e586b029d723671c97c3_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2468

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-5-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/2648-6-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/3036-0-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/3036-2-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/3036-1-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download