f3710f4c344f37c504d2910feac8f81c87a57c8f2d895b3e64e5b119009c499e

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 08:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
Size

282KB
MD5

27da74017fb2685c32f2d74dec75d820
SHA1

d7828f8e98875e621d38e4355afef38d7ac3ca04
SHA256

f3710f4c344f37c504d2910feac8f81c87a57c8f2d895b3e64e5b119009c499e
SHA512

bcb33e6fa51485521f403df48256ae1691349bee19b0dace79598db9171c94b4b2e80316b74ad8609aad399a91800731292a3ed02b373d196bbcfc8a9c2cdd55
SSDEEP

6144:eZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:yFTxWYMh5qoLb8LCy9E

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\27DA74~1.EXE,"	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2784-0-0x0000000000400000-0x000000000062D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\27DA74~1.EXE"	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\36ad6a0d = "¨T‡ê@æ$X7ús–ºÁ\x1fž·V_\x16?\x06‡êÌ%g£ç\x03\x06ŠÏoÁˆ\x7fÃ0¿ß'cÚyÎ\x15G\x0e¸?iI\u00ad—x\x02ˆ\x11¹\x14ú\x10_\x16V[M^í\ns¼µQ+YÆ\r\x03\x14\x02ŒR\x16G¦\x13Ã·öºû{_?¦«Sìã¿+\x1e[\u008f¢$O?®zÚÜÃ\nk×§†¶$Lžrì¢\x03æ“{CÓÏû{²3†.ÓÃ\u008f{Ór'c¬«–«#.§Nbã»ôÿ\x0e†[Þ\x1b\x17TÎ„¾þã^#û\x1e“'¤\x1bL¯Ö'WKK”lžû\v\x1fz3ÿS\x12›\x0fÿ›[Ö§·w‡¼¾,“¤\x1bëÿ¢£«_CúÞÞ¬D7çv\v£CÛÎÛ7û{f÷ò^¾c2¬ÿ»G{†Ã“ãÌ·æÌÚ"	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\27DA74~1.EXE"	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
Token: SeSecurityPrivilege	2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
Token: SeSecurityPrivilege	2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
Token: SeSecurityPrivilege	2784	27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27da74017fb2685c32f2d74dec75d820_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2784-1-0x0000000000250000-0x000000000029A000-memory.dmp

Filesize
296KB

Download
memory/2784-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2784-3-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2784-6-0x0000000002050000-0x0000000002102000-memory.dmp

Filesize
712KB

Download
memory/2784-4-0x0000000002050000-0x0000000002102000-memory.dmp

Filesize
712KB

Download
memory/2784-14-0x0000000002050000-0x0000000002102000-memory.dmp

Filesize
712KB

Download
memory/2784-12-0x0000000002050000-0x0000000002102000-memory.dmp

Filesize
712KB

Download
memory/2784-10-0x0000000002050000-0x0000000002102000-memory.dmp

Filesize
712KB

Download
memory/2784-8-0x0000000002050000-0x0000000002102000-memory.dmp

Filesize
712KB

Download
memory/2784-15-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2784-16-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-18-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-20-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-42-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-50-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-43-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-44-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-70-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-45-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-46-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-47-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-48-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-82-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-49-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-51-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-52-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-86-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-85-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-84-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-83-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-81-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-80-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-79-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-78-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-77-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-76-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-75-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-74-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-73-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-72-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-71-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-69-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-68-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-67-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-66-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-65-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-64-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-63-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-62-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-61-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-60-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-59-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-58-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-57-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-56-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-55-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-54-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-53-0x0000000002BE0000-0x0000000002C98000-memory.dmp

Filesize
736KB

Download
memory/2784-170-0x0000000000250000-0x000000000029A000-memory.dmp

Filesize
296KB

Download
memory/2784-171-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download