779bf77972fe4ce4ca9c2e4d8d9edd718f82c037480dbef8e7f5fe41331955fa

Analysis

max time kernel
150s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
Size

253KB
MD5

2cfd80ce4a7e72861438e4829d69eceb
SHA1

247c4b96da39006d06f1fc1613a285fc6f76fb9d
SHA256

779bf77972fe4ce4ca9c2e4d8d9edd718f82c037480dbef8e7f5fe41331955fa
SHA512

f690464a56286a4f96aedfc7f441d5d52c3c6168d06cf7434d488f5caf4ba7f2482103610514cc202c4442765d4d323f02e8c1f84e13de9b789853d9a3eb8a69
SSDEEP

6144:0j89h36jLTfrPXGxxkDal4jZUNesLT91omGSSG4u2WOMNOsPaU7:fyTjOxa0+ZdsLTLGJC2WNYrU7

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\2CFD80~1.EXE,"	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2CFD80~1.EXE"	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\507564cb = "F7‰èA°Ož©¤š§\fCix\x1d-¢4\u008dŒiaZþ<\u0081\x1dÙ\b£¦á$r\x03\t•\rFc\x01ÜaÐÂûý\x13?j>ñ`ÑÝÇw\x12û´X^àcBèü\vS\x03þLå\u0090þ»Ü5\x1c/U •Éö\u009d\u00ad\u00ad†\x1d\x06\r%!ÅÉNÍ\x15\x05\rE…\x05\x1dE\u00adq2ù•åö\u00ada\x19‰2íV•\x16-î\x11Q…Í½’ÖÝ\u008dîÍjÅVQ\tª\nÅ\u008di¥‘¦îme\ržöéÅ5aÎ©AæÉb--q±>ú\x1eNî}a’\u008d\x1eå¦Í±½vÝy-=Íež\u008dÒÍa¶ÍÕáÍ\x15ÍÝµ\x19%ÍÕmýÉmõÑÕ}-ÍÎ\x011‰ÅÝb\u008dÕ\u00adÍµù-mm\x15]ÑÆ-¶Íe6úŽÍAåmq\rÉµîEu¥¶"	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2CFD80~1.EXE"	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
Token: SeSecurityPrivilege	3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
Token: SeSecurityPrivilege	3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
Token: SeSecurityPrivilege	3008	2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cfd80ce4a7e72861438e4829d69eceb_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x00000000024D0000-0x0000000002532000-memory.dmp

Filesize
392KB

Download
memory/3008-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3008-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3008-3-0x00000000025D0000-0x0000000002682000-memory.dmp

Filesize
712KB

Download
memory/3008-13-0x00000000025D0000-0x0000000002682000-memory.dmp

Filesize
712KB

Download
memory/3008-11-0x00000000025D0000-0x0000000002682000-memory.dmp

Filesize
712KB

Download
memory/3008-9-0x00000000025D0000-0x0000000002682000-memory.dmp

Filesize
712KB

Download
memory/3008-7-0x00000000025D0000-0x0000000002682000-memory.dmp

Filesize
712KB

Download
memory/3008-5-0x00000000025D0000-0x0000000002682000-memory.dmp

Filesize
712KB

Download
memory/3008-14-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/3008-15-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-17-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-19-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-41-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-43-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-47-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-40-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-57-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-42-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-45-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-44-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-73-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-46-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-48-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-49-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-50-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-51-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-54-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-53-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-52-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-65-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-85-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-84-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-83-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-82-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-81-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-80-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-79-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-78-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-77-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-76-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-75-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-74-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-72-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-71-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-70-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-69-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-68-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-67-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-66-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-64-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-63-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-62-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-61-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-60-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-59-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-58-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-56-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-55-0x0000000002B50000-0x0000000002C08000-memory.dmp

Filesize
736KB

Download
memory/3008-168-0x00000000024D0000-0x0000000002532000-memory.dmp

Filesize
392KB

Download
memory/3008-170-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download