25682ff93cc268d80c5f09c4a2bc8e89a0b49e563f17677eda0d4fda2ca99f45

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
Size

259KB
MD5

103bd8225b0e0dafc46bd78bf508d9f6
SHA1

9e884670c5a80720ab4e5bfd17327a1a1fafcb8a
SHA256

25682ff93cc268d80c5f09c4a2bc8e89a0b49e563f17677eda0d4fda2ca99f45
SHA512

cd278589099ea5e2cf4382c971815f17519db9171f33c797ea9d1a3a9162da846a16a3943bfacdfedf039861f9e9888401c801001356dbbf4002009e94f46df3
SSDEEP

6144:JTWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:RXoImYuzheQWZAZ

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\103BD8~1.EXE,"	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2056-0-0x0000000000400000-0x00000000005A1000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\103BD8~1.EXE"	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\103BD8~1.EXE"	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\288a23ed = "AD&Ç¸¤Ñ1FçN7 8í?~Ò’Z-\x0f\u008d^]•¿J²\u009ds?³¢wi‚¬ºú H³ÔÚ\x1c{\nx\\ZÇß4ålÖx¤32nâc-=Á4 (\\\x03µZùÔ\x1dßÈBÐObci\x12“.\x19Á2ú;jvKÁÊqªy:\x12ÙAsê±J\x01Ñƒj¶\x13\x06c\u0081j\"r\x1e’Š\x12\x1ažÓÎ\x06\x02²þ’\x12ëÎ;êêa\x1aêÂnÎ.Ž²²^jîj±»\x0e1&æ~RÎÖ3S!;ö\x11\x02Ë^Vb~V\x02ÃÒcnÊ\x0eö†:\x1a¢V‹¦\x06³†2’²CÃNB³9«B{ÛsYBV’#&û\"ÓjRËÛ²C»†‘:2¾k\x16IRúÊ\x13ŽëV\x13ºzjBC®Njf&\x16æ¾ê\x11"	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
Token: SeSecurityPrivilege	2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
Token: SeSecurityPrivilege	2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
Token: SeSecurityPrivilege	2056	103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\103bd8225b0e0dafc46bd78bf508d9f6_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x0000000000400000-0x00000000005A1000-memory.dmp

Filesize
1.6MB

Download
memory/2056-1-0x00000000003B0000-0x00000000003F9000-memory.dmp

Filesize
292KB

Download
memory/2056-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2056-14-0x0000000002F90000-0x0000000003042000-memory.dmp

Filesize
712KB

Download
memory/2056-12-0x0000000002F90000-0x0000000003042000-memory.dmp

Filesize
712KB

Download
memory/2056-8-0x0000000002F90000-0x0000000003042000-memory.dmp

Filesize
712KB

Download
memory/2056-6-0x0000000002F90000-0x0000000003042000-memory.dmp

Filesize
712KB

Download
memory/2056-5-0x0000000002F90000-0x0000000003042000-memory.dmp

Filesize
712KB

Download
memory/2056-10-0x0000000002F90000-0x0000000003042000-memory.dmp

Filesize
712KB

Download
memory/2056-15-0x0000000000400000-0x00000000005A1000-memory.dmp

Filesize
1.6MB

Download
memory/2056-16-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-20-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-18-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-42-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-43-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-46-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-45-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-44-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-47-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-72-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-49-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-48-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-87-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-86-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-85-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-84-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-83-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-82-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-81-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-80-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-79-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-78-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-77-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-76-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-75-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-74-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-73-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-71-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-70-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-69-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-68-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-67-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-66-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-65-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-64-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-63-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-62-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-61-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-60-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-59-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-58-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-57-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-56-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-55-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-54-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-53-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-52-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-51-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-50-0x0000000003150000-0x0000000003208000-memory.dmp

Filesize
736KB

Download
memory/2056-170-0x00000000003B0000-0x00000000003F9000-memory.dmp

Filesize
292KB

Download
memory/2056-172-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download