e0816ad1c6796200c4094e757aa02671189b5c24e59fae52b8d9aca52d18825e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe
Size

811KB
MD5

2bd4fb8eec201c4ab09f86abe7a2c7f5
SHA1

7adcac629f86bb63eb9b1bd8c4b2062ed6e3f8c5
SHA256

e0816ad1c6796200c4094e757aa02671189b5c24e59fae52b8d9aca52d18825e
SHA512

ecaa6944e57ad4f9ca3294f448ee1b3318c18b78d607f5c9fb8cc3e5b963df84ff515c197b2c8239820c8c38021487dd67d075e088f9bfd3ff65e4a5d159f47a
SSDEEP

12288:fH3vH/sBOKAfF8CkqSwHUFOxWDrURkFBKjyYRASdDdrfXAztoOQldD:fHns4vJSIUFxD/E+MdXXD

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\cnnsc.exe"	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2600	cmd.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cnnsc.exe	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cnnsc.exe	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cnnsc.dll	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cnnsc.dll	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2376	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1196	2376	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe	21
PID 2376 wrote to memory of 2600	2376	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2600	2376	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2600	2376	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2600	2376	2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2bd4fb8eec201c4ab09f86abe7a2c7f5_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\system32\Deleteme.bat
    3⤵
    - Deletes itself
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat

Filesize
212B

MD5
9cb61b687ae5c9183e52c7bd9ae0b1bf

SHA1
90c2df3d98aa630e5a09653757fdb7e05472552f

SHA256
29e4b64385acb526ad00bcf39286a839f2cea8f21d3dc96985813024db8d94b0

SHA512
f174f6c9bbf44f2cc23b0d88beb3e17d3e2cd8e5e6fcb87ec41a2573680a3100084d6291ec720df27eeace7ad8b571a9b696541f879543c52b6830af56181bc8

Download Submit
memory/1196-15-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2376-2-0x0000000000220000-0x00000000002D9000-memory.dmp

Filesize
740KB

Download
memory/2376-1-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2376-6-0x0000000000220000-0x00000000002D9000-memory.dmp

Filesize
740KB

Download
memory/2376-8-0x00000000004EB000-0x00000000004EC000-memory.dmp

Filesize
4KB

Download
memory/2376-5-0x0000000000220000-0x00000000002D9000-memory.dmp

Filesize
740KB

Download
memory/2376-10-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2376-3-0x0000000001E90000-0x00000000020B1000-memory.dmp

Filesize
2.1MB

Download
memory/2376-4-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2376-11-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2376-24-0x0000000000220000-0x00000000002D9000-memory.dmp

Filesize
740KB

Download
memory/2376-28-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2376-27-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download