43e9b2f4808600a50d88cc950c76e966b2e86e50d35058540e5b4292c065d8d8

Analysis

max time kernel
6s
max time network
6s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 14:08

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

22a24c201648e49a79e830af51a7905b_JaffaCakes118.exe
Size

88KB
MD5

22a24c201648e49a79e830af51a7905b
SHA1

b1ad6b2f37bf70bd1b2170c6a4a22dc608aed616
SHA256

43e9b2f4808600a50d88cc950c76e966b2e86e50d35058540e5b4292c065d8d8
SHA512

96da5fd4143e4f024389adc683efd56c8557690f66ca7ced9b15b8fa6ec402459163b2c3abe65cd6a2dd319a6db59da24dc830fc5ebea86938d395ae81ba51b3
SSDEEP

1536:tJlHQ6vCPGvPifXCbpVNmmIm+scu9xot+QxZ5E3lXYEEEC7xZopSluTHT9KoTJlz:nlHQbPszETm+srot+QxrAoBEC7oEkrhN

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bzozqud.dll	22a24c201648e49a79e830af51a7905b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2984	22a24c201648e49a79e830af51a7905b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\22a24c201648e49a79e830af51a7905b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22a24c201648e49a79e830af51a7905b_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2596

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-5-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/2620-6-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2984-0-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2984-2-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2984-1-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download