eece2e8c858e5154a4b07203dea880000ac879b022b20f9fa559d78ac81cc889

Analysis

max time kernel
150s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
Size

243KB
MD5

0f56e67e981b66a9df2626a707e368fe
SHA1

0ffce91789ed8c10506982e0d04ad449aba303d7
SHA256

eece2e8c858e5154a4b07203dea880000ac879b022b20f9fa559d78ac81cc889
SHA512

2ca1ac67d297e29f3ff8d8dbaffca2275a749a73e421f870f8a051bb4e1a569f25e82d4139a1b8dbbd0f45a15e752e20d1b9c68386329f4eedd92a8d27a0520d
SSDEEP

6144:YnScTKd/ASzisjWzxCyEBQFyTrfdiaXuQtqc7YKqkYh:4TKCS2sjWC1rfd/Rtqc7HqkYh

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\0F56E6~1.EXE,"	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0F56E6~1.EXE"	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\cfaaa5ff = "HR•hÂ¤WQ‘,T=âÍ\x17ÉÍ{%øeŠÄÏö°\x03¿~tŽ\x16KQï.ÜÕ¸¥JMbðÃ€.½¢\x14\u009dÎR„JÅYh`O\x06»\x11Jåí§“»\x1c9¹*S"	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0F56E6~1.EXE"	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
Token: SeSecurityPrivilege	1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
Token: SeSecurityPrivilege	1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
Token: SeSecurityPrivilege	1756	0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f56e67e981b66a9df2626a707e368fe_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1756-1-0x00000000007F0000-0x000000000083A000-memory.dmp

Filesize
296KB

Download
memory/1756-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1756-4-0x0000000002550000-0x0000000002602000-memory.dmp

Filesize
712KB

Download
memory/1756-8-0x0000000002550000-0x0000000002602000-memory.dmp

Filesize
712KB

Download
memory/1756-6-0x0000000002550000-0x0000000002602000-memory.dmp

Filesize
712KB

Download
memory/1756-14-0x0000000002550000-0x0000000002602000-memory.dmp

Filesize
712KB

Download
memory/1756-12-0x0000000002550000-0x0000000002602000-memory.dmp

Filesize
712KB

Download
memory/1756-10-0x0000000002550000-0x0000000002602000-memory.dmp

Filesize
712KB

Download
memory/1756-15-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1756-16-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-21-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-20-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-18-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-42-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-43-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-48-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-51-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-55-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-44-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-45-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-46-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-69-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-47-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-49-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-50-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-52-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-53-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-67-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-87-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-86-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-85-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-84-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-83-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-82-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-81-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-80-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-79-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-78-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-77-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-76-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-75-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-74-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-73-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-72-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-71-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-70-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-68-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-66-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-65-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-64-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-63-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-62-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-61-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-60-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-59-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-58-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-57-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-56-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-54-0x0000000002710000-0x00000000027C8000-memory.dmp

Filesize
736KB

Download
memory/1756-170-0x00000000007F0000-0x000000000083A000-memory.dmp

Filesize
296KB

Download
memory/1756-171-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download