e04f9f31f7d74600febcbcad5303c97081f4c82e3ca6f2711237ef14131b1e34

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
Size

259KB
MD5

177afddeb1517982c7cb42759ad746c3
SHA1

e385770b1fbd2438c3094f56bc17daf950ee9c1f
SHA256

e04f9f31f7d74600febcbcad5303c97081f4c82e3ca6f2711237ef14131b1e34
SHA512

af2277b9dee6368c359d33d5627e831e30ee783e05fc2440d9a5dff7cb061d665d9549f6a993675c110a105a77f792e33d72a7431ce78b601c971c08eff4dbdc
SSDEEP

6144:tSAqWATnZSdjM6SoqizS0vzyCpMJE1d5L+H328r5h:thUMdjRLLztpMJAz+X225h

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\177AFD~1.EXE,"	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\177AFD~1.EXE"	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ebfedcdd = "HYŒ\x7fë˜W¥Y¯x\x15Ÿ<ßBî“ß§\x02\n\x0e’}ÿjææ$^¦ÎVcÄÔ\x17•\x1fO\x0e¢3½„:zë2ÀaÅ!!\x14DN¡÷\fqQæñ·D!k˜Œ\x02ˆ\x12\x106“Ý\"kjF#6è~üÎ[+»(~–<kîûö0˜þªó`:Å,†ãNKã¢û\x06\u00a0ª»,Ž³Í\x13=cŽ@\f®\x06ú]+~²H~l²£ôDö\|\x05¤¨[\u00adSsûpDš\u0090–h£kæ\x0eÈÚ\x18ÃíÛšM£þ`\x06¢}°{\x0e®2ÌäÕœ¸VâÂVæÝ#æ[ƒk^\"Õ\nUMû”ÎvNò\rã\x13ë«‹Û•œÕ&¼\x13-sdÐ¾Ã¶\u008dÊ#ð¶5\u008dDÞ\br\x03–¶…K;½“ÍÅ\u00adýãîããÕ\rÖ"	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\177AFD~1.EXE"	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
Token: SeSecurityPrivilege	1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
Token: SeSecurityPrivilege	1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
Token: SeSecurityPrivilege	1848	177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\177afddeb1517982c7cb42759ad746c3_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-0-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download
memory/1848-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1848-11-0x00000000024A0000-0x0000000002552000-memory.dmp

Filesize
712KB

Download
memory/1848-9-0x00000000024A0000-0x0000000002552000-memory.dmp

Filesize
712KB

Download
memory/1848-7-0x00000000024A0000-0x0000000002552000-memory.dmp

Filesize
712KB

Download
memory/1848-3-0x00000000024A0000-0x0000000002552000-memory.dmp

Filesize
712KB

Download
memory/1848-6-0x00000000024A0000-0x0000000002552000-memory.dmp

Filesize
712KB

Download
memory/1848-14-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/1848-13-0x00000000024A0000-0x0000000002552000-memory.dmp

Filesize
712KB

Download
memory/1848-15-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-17-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-19-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-40-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-41-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-42-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-43-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-44-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-45-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-46-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-86-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-85-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-84-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-83-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-82-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-81-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-80-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-79-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-78-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-77-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-76-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-75-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-74-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-73-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-72-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-71-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-70-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-69-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-68-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-67-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-66-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-65-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-64-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-63-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-62-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-61-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-60-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-59-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-58-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-57-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-56-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-55-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-54-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-53-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-52-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-51-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-50-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-49-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-48-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-47-0x00000000027D0000-0x0000000002888000-memory.dmp

Filesize
736KB

Download
memory/1848-168-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download
memory/1848-169-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download