7406c8b55f4a592ec2e520370bb21ce14346c957d80217bd8e2823b85adc21f2

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
Size

248KB
MD5

1919a1d6b34fcdab2055060ad19dbb9f
SHA1

79c596c45a4774d2d0470dea39dfaed66fbbf2f4
SHA256

7406c8b55f4a592ec2e520370bb21ce14346c957d80217bd8e2823b85adc21f2
SHA512

445dd84604ad4a05e4ff3b337ef8ee9a9886f59bcb99f432eb2a7dab79f1c4a60d522171a606d2033863265ae2f353c73029cef7bbaab32fcca100ed13d652f4
SSDEEP

6144:SyDfVXVc7cl5ZFdEH6IDvl5UaErsr53kTmrY:SOXVbTEH6IDDEAKTms

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\1919A1~1.EXE,"	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1919A1~1.EXE"	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1919A1~1.EXE"	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\50ed107f = "\x14\x1fi\nÊ`G\\C4\x03òh¿\x11î·Õ\x01\x1e½\u00a0yãN¶\x16ó-\x01\x12ØÇédæ¨ü¦ˆñ!\x0f^-o4+\x14OçÍ”ÌŸcç4#6æÅ3oîk\x12ƒX™³p.ÀŽš*.„™KP\x152…õAç©Eåu…•Ÿ¡µ5Ý\x15\a7\x17±EM'Á±mQÇý]í}Ñ\u008fÿ‡‡\u009d_Í1y\r%\x11ÁÍ\x0f\x05õI?iÍ%Y•µg}\u008f\x19\u00ad]ßÑ\u008dáÏuáUÿ\x1dÍ-¿?eW7Ç\x1f‰\x05Å%\x1f\x0fwù%mÅu\x1fý\u0081±\r!5\x1d©eí\rÑ‘‰\a¡‡%Á]µý•Çý‡Ý]¡Õ=Õ\x15\x01=\x1dGßÏÑýGù-õm!I_%A1…‡÷mÙ!×g¿\x1fUq1ýÍaõ½Á\rE\x0f\tõ=m‰ÿ"	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
Token: SeSecurityPrivilege	1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
Token: SeSecurityPrivilege	1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
Token: SeSecurityPrivilege	1932	1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1919a1d6b34fcdab2055060ad19dbb9f_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-0-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/1932-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1932-2-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1932-3-0x00000000023F0000-0x00000000024A2000-memory.dmp

Filesize
712KB

Download
memory/1932-5-0x00000000023F0000-0x00000000024A2000-memory.dmp

Filesize
712KB

Download
memory/1932-11-0x00000000023F0000-0x00000000024A2000-memory.dmp

Filesize
712KB

Download
memory/1932-13-0x00000000023F0000-0x00000000024A2000-memory.dmp

Filesize
712KB

Download
memory/1932-9-0x00000000023F0000-0x00000000024A2000-memory.dmp

Filesize
712KB

Download
memory/1932-7-0x00000000023F0000-0x00000000024A2000-memory.dmp

Filesize
712KB

Download
memory/1932-14-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1932-15-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-17-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-19-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-42-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-43-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-48-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-55-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-41-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-44-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-46-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-45-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-47-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-82-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-49-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-50-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-51-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-52-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-53-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-65-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-64-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-63-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-62-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-61-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-60-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-59-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-58-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-57-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-56-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-54-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-86-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-85-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-84-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-83-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-81-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-80-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-79-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-78-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-77-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-76-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-75-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-74-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-73-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-72-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-71-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-70-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-69-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-68-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-67-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-66-0x00000000025B0000-0x0000000002668000-memory.dmp

Filesize
736KB

Download
memory/1932-169-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/1932-170-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download