5976518ab273f5dcfedb9a311113fcebe1603e6cbaac730d5d09cc7c296796cc

Analysis

max time kernel
148s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a3c0a424eb480ba198bb17184fbb019_JaffaCakes118.dll
Size 52KB
Sample240707-3v8ykavbpg
SHA256 5976518ab273f5dcfedb9a311113fcebe1603e6cbaac730d5d09cc7c296796cc
MD5 2a3c0a424eb480ba198bb17184fbb019
SHA1 9c790b4b307842ac0d1e894f41f11abce445d793
SHA512 2d6dd71f030d5c7dfd8ec9f1754ca5db2ca54296f1a173248380a006f23d9eb7ff79eb7f24c51d9a8252e02ad5391ead923d2c374f954c177984f0cc1f3afbb6
SSDEEP 1536:kWlHiMlXukGRbgTpbWrvdQ90PQ/6apON:k6HiMlX+dQ9p/rpI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",C:\\Windows\\system32\\msvcrty.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4240	1448	rundll32.exe	82
PID 1448 wrote to memory of 4240	1448	rundll32.exe	82
PID 1448 wrote to memory of 4240	1448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a3c0a424eb480ba198bb17184fbb019_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a3c0a424eb480ba198bb17184fbb019_JaffaCakes118.dll,#1
  2⤵
  - Modifies WinLogon for persistence
  PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads