f7bc22b68f58ec8eaa451a9a72ff88279c9c5e64c445a25d0a1f7708665ef5ff

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
Size

255KB
MD5

2a6c6bd2481ef96afbec29d05d62a3d8
SHA1

f16dd35f48208e9db57dc18c2d200b2b1e777287
SHA256

f7bc22b68f58ec8eaa451a9a72ff88279c9c5e64c445a25d0a1f7708665ef5ff
SHA512

a15dc81a1f238955c2180eb42e4d32c3f809e6adde8ad802fb482d78fd752d614a2779bce617fc0a30d4bc5808398b9f06e697742ac7648df5b952ce8cc8ac24
SSDEEP

6144:92C6wWXvGR+kby8dw2bBiV7elkIaWtWMQpeScz5JXPW:IS4vGcaPGOB6EJlfmejz5g

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\2A6C6B~1.EXE,"	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2A6C6B~1.EXE"	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c8f44415 = "\x1f\x03~V'ß«ÛÃ›5‘qW@Î¬ÑhvÈõ£”®ú+"	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2A6C6B~1.EXE"	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
Token: SeSecurityPrivilege	2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
Token: SeSecurityPrivilege	2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
Token: SeSecurityPrivilege	2424	2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a6c6bd2481ef96afbec29d05d62a3d8_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-0-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/2424-1-0x00000000001B0000-0x00000000001FA000-memory.dmp

Filesize
296KB

Download
memory/2424-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2424-4-0x00000000024F0000-0x00000000025A2000-memory.dmp

Filesize
712KB

Download
memory/2424-6-0x00000000024F0000-0x00000000025A2000-memory.dmp

Filesize
712KB

Download
memory/2424-12-0x00000000024F0000-0x00000000025A2000-memory.dmp

Filesize
712KB

Download
memory/2424-14-0x00000000024F0000-0x00000000025A2000-memory.dmp

Filesize
712KB

Download
memory/2424-10-0x00000000024F0000-0x00000000025A2000-memory.dmp

Filesize
712KB

Download
memory/2424-8-0x00000000024F0000-0x00000000025A2000-memory.dmp

Filesize
712KB

Download
memory/2424-15-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/2424-16-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-19-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-20-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-21-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-45-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-50-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-42-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-44-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-55-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-56-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-54-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-52-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-46-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-61-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-51-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-49-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-48-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-47-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-43-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-53-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-72-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-75-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-77-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-84-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-58-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-57-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-59-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-62-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-69-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-87-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-86-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-85-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-83-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-82-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-81-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-80-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-79-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-78-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-76-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-74-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-73-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-71-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-70-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-68-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-67-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-66-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-65-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-64-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-63-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-60-0x00000000026B0000-0x0000000002768000-memory.dmp

Filesize
736KB

Download
memory/2424-170-0x00000000001B0000-0x00000000001FA000-memory.dmp

Filesize
296KB

Download
memory/2424-172-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download