162e75673dc2873b99c895f48d8b1621296c8fdde2e98dd70dd490999ef8e03e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
Size

245KB
MD5

22dd39db0489272af6af0c20d213f62c
SHA1

026b92a6ff74a689fdfcd7484c14931601564e24
SHA256

162e75673dc2873b99c895f48d8b1621296c8fdde2e98dd70dd490999ef8e03e
SHA512

7efd5ff67a42a56ddeb977193290678358d9b8d8b247c9b896857b0d6ac782864292f4685c296355c6f136e2ec38b1cdfbafcf8b6b2b47745be936f7c7b03c9b
SSDEEP

6144:+pAwrYwShsVZffYGw4veAEZ2uaUQ2vdEHFhfN:+9rOGZfw2E4mQiMF

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\22DD39~1.EXE,"	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\22DD39~1.EXE"	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\3837d5c4 = "JƒU\u009d;T™+máŸùõf\u008fq\u0090‘œÊoô¡qfò\x18\|ô\x15–Eyq‰þè”†‘Œ\x1bkà«ýÿÓã©ý\a\x02šUÖ¯\u0081%g(2bú«XT»r{‡\b¢};mWp’"	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\22DD39~1.EXE"	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
Token: SeSecurityPrivilege	848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
Token: SeSecurityPrivilege	848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
Token: SeSecurityPrivilege	848	22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22dd39db0489272af6af0c20d213f62c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-0-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/848-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/848-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/848-3-0x0000000001E50000-0x0000000001F02000-memory.dmp

Filesize
712KB

Download
memory/848-5-0x0000000001E50000-0x0000000001F02000-memory.dmp

Filesize
712KB

Download
memory/848-13-0x0000000001E50000-0x0000000001F02000-memory.dmp

Filesize
712KB

Download
memory/848-11-0x0000000001E50000-0x0000000001F02000-memory.dmp

Filesize
712KB

Download
memory/848-9-0x0000000001E50000-0x0000000001F02000-memory.dmp

Filesize
712KB

Download
memory/848-14-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/848-7-0x0000000001E50000-0x0000000001F02000-memory.dmp

Filesize
712KB

Download
memory/848-15-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-19-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-21-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/848-17-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-41-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-47-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-51-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-58-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-42-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-43-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-44-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-45-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-46-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-48-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-49-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-50-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-52-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-53-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-57-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-66-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-65-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-64-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-63-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-62-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-61-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-60-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-59-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-56-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-55-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-54-0x0000000002070000-0x0000000002128000-memory.dmp

Filesize
736KB

Download
memory/848-169-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/848-170-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download