b3eab21377d2206f1bd5e1f2589dafa91c3896d9d0d95bfc537cd10ddca1039d

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe
Size

239KB
MD5

22a3f06f8f5cae94a499b6b2f7e8f563
SHA1

d66cc039fc435b20d644485fdfd91d38a815e155
SHA256

b3eab21377d2206f1bd5e1f2589dafa91c3896d9d0d95bfc537cd10ddca1039d
SHA512

dedab80e6dfa8c6154ca79aaeb835136db6e8cbabcbd500f4ba0b1bd22cc084ae19767f646506c8d30e4c6c4058f88e4cd186a8683a2e5cb6b4d19fa00feb8f9
SSDEEP

6144:hymIF7+kuCDqHZmyQ4EaDU7PvRPRYuHoLc:hyTF+1sqU4EaIFPRoLc

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe,"	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntos.exe	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ntos.exe	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe
2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe
2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe
2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5
PID 2996 wrote to memory of 620	2996	22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620

C:\Users\Admin\AppData\Local\Temp\22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22a3f06f8f5cae94a499b6b2f7e8f563_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4092,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-51-0x0000000024BE0000-0x0000000024C02000-memory.dmp

Filesize
136KB

Download
memory/620-56-0x0000000024C10000-0x0000000024C32000-memory.dmp

Filesize
136KB

Download
memory/620-76-0x0000000024CD0000-0x0000000024CF2000-memory.dmp

Filesize
136KB

Download
memory/620-72-0x0000000024CA0000-0x0000000024CC2000-memory.dmp

Filesize
136KB

Download
memory/620-66-0x0000000024C70000-0x0000000024C92000-memory.dmp

Filesize
136KB

Download
memory/620-61-0x0000000024C40000-0x0000000024C62000-memory.dmp

Filesize
136KB

Download
memory/620-29-0x0000000024AF0000-0x0000000024B12000-memory.dmp

Filesize
136KB

Download
memory/620-36-0x0000000024B50000-0x0000000024B72000-memory.dmp

Filesize
136KB

Download
memory/620-32-0x0000000024B20000-0x0000000024B42000-memory.dmp

Filesize
136KB

Download
memory/620-21-0x0000000024AC0000-0x0000000024AE2000-memory.dmp

Filesize
136KB

Download
memory/620-46-0x0000000024BB0000-0x0000000024BD2000-memory.dmp

Filesize
136KB

Download
memory/620-17-0x0000000024A90000-0x0000000024AB2000-memory.dmp

Filesize
136KB

Download
memory/620-11-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/620-41-0x0000000024B80000-0x0000000024BA2000-memory.dmp

Filesize
136KB

Download
memory/2996-2-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2996-0-0x0000000000400000-0x000000000040D344-memory.dmp

Filesize
52KB

Download
memory/2996-5-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2996-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2996-3-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2996-4-0x0000000000401000-0x000000000040F000-memory.dmp

Filesize
56KB

Download
memory/2996-1-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/2996-3383-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2996-3759-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download