819bbbe7a48881f2fb59f9bd4b5106d910c4981ec126aad952ac802b81339ba2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 21:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
Size

270KB
MD5

2dc85bdb941c35bcbd7b3a888e234902
SHA1

dc85ff91d58884be81795975763df3decc67f2e2
SHA256

819bbbe7a48881f2fb59f9bd4b5106d910c4981ec126aad952ac802b81339ba2
SHA512

b04d4e5798d09fba5b8886d174fc00e12b4771469d1aa1ebfa5a1488f0e87e4b5c3dc1418ba6caa0530f598699a140d93ad5fe1371dd512e08c08a0e9eef606a
SSDEEP

6144:ws+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:1HMwm9AHebVKkdrH5eyr

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\2DC85B~1.EXE,"	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1180-0-0x0000000000400000-0x0000000000589000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2DC85B~1.EXE"	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c8a50878 = "\x18\r\u008d\bõÓÑÇ\bÒX\x13À\u008fJÊ\x04\x19=h'Žð¿”V¤OoG&dG˜³Óº?Øö\x1f]rO\u008dŒˆÛTï/\x1fi¶˜ß\rù\u008fVáä—²ëÆ\x16í-‚\x7fLØÍ\x14®ðUýU÷AÃ3cL$žåù«W)¶\rU4Ykf¾ž\x11¼\\Û\x7fË-\rñ„L'yÝ'\x03ÖV³~Å!‹ô\x01´q¹\x1cß™\x01Ó\x03³¡û\u00adDÃÃ+}[\x05\x13ci›«+[\u008fé%ž\x19\r#–\u00819#Fñ;kßs«¾£C?väÅYžGåÜ®áW!›M51aS\x19'IËU³\x191›‘ûßé9at‹;çûm“SÃ?SnÓsæFéë}[5ã\x13®Óy\x1cD\x13gsÑëÞ“Ž\x11\u00adi\x7f\x196¥\rtg\x15¹³çÎ"	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2DC85B~1.EXE"	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
Token: SeSecurityPrivilege	1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
Token: SeSecurityPrivilege	1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
Token: SeSecurityPrivilege	1180	2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2dc85bdb941c35bcbd7b3a888e234902_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-0-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1180-1-0x0000000000640000-0x0000000000688000-memory.dmp

Filesize
288KB

Download
memory/1180-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1180-4-0x00000000022A0000-0x0000000002352000-memory.dmp

Filesize
712KB

Download
memory/1180-5-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1180-6-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-18-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1180-17-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1180-10-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-9-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-75-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-113-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-116-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-115-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-114-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-112-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-111-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-110-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-109-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-108-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-107-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-106-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-105-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-104-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-103-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-102-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-101-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-100-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-99-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-98-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-97-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-96-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-95-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-94-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-93-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-92-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-90-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-89-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-88-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-86-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-85-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-84-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-83-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-82-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-81-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-80-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-79-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-78-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-76-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-74-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-73-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-72-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-71-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-70-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-69-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-68-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-67-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-66-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-65-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-64-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-63-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-91-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-87-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-77-0x0000000002360000-0x0000000002418000-memory.dmp

Filesize
736KB

Download
memory/1180-191-0x0000000000640000-0x0000000000688000-memory.dmp

Filesize
288KB

Download
memory/1180-193-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download