7913e7e662230271bf6bdf2aabd15534d701322b218194650a9cc40a4ea2c329

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe
Size

134KB
MD5

332594c2668b35386f7a70c2212a4672
SHA1

c6f9c23cd59a0aa404b1059fa177554166574f7e
SHA256

7913e7e662230271bf6bdf2aabd15534d701322b218194650a9cc40a4ea2c329
SHA512

28d88f1c3e3dce22eb9202b533deac7a7bd2f6911089be478a4a894f76e6babe5849829e14064f3e5009f5e1cd0f8968ef5321b71a5b2d0d628059e69c8ab617
SSDEEP

3072:0OyakxuZRZjuU/WKHe9hKyXk4N1sB8a5ckua/:0OyakMRZjuUreC46ckt

Score

10^/10

defense_evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\lsass.exe"	reg.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/580-2-0x0000000000400000-0x0000000000D4D000-memory.dmp	upx
behavioral1/memory/580-4-0x0000000000400000-0x0000000000D4D000-memory.dmp	upx
behavioral1/memory/580-0-0x0000000000400000-0x0000000000D4D000-memory.dmp	upx

Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2248	cmd.exe
2084	cmd.exe
2164	cmd.exe
1236	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1036	cmd.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1648	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	29
PID 580 wrote to memory of 1648	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	29
PID 580 wrote to memory of 1648	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	29
PID 580 wrote to memory of 1648	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	29
PID 580 wrote to memory of 1744	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	31
PID 580 wrote to memory of 1744	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	31
PID 580 wrote to memory of 1744	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	31
PID 580 wrote to memory of 1744	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	31
PID 580 wrote to memory of 2248	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	33
PID 580 wrote to memory of 2248	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	33
PID 580 wrote to memory of 2248	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	33
PID 580 wrote to memory of 2248	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	33
PID 580 wrote to memory of 1236	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	35
PID 580 wrote to memory of 1236	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	35
PID 580 wrote to memory of 1236	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	35
PID 580 wrote to memory of 1236	580	332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe	35
PID 1648 wrote to memory of 1036	1648	cmd.exe	36
PID 1648 wrote to memory of 1036	1648	cmd.exe	36
PID 1648 wrote to memory of 1036	1648	cmd.exe	36
PID 1648 wrote to memory of 1036	1648	cmd.exe	36
PID 1744 wrote to memory of 1560	1744	cmd.exe	37
PID 1744 wrote to memory of 1560	1744	cmd.exe	37
PID 1744 wrote to memory of 1560	1744	cmd.exe	37
PID 1744 wrote to memory of 1560	1744	cmd.exe	37
PID 1236 wrote to memory of 2084	1236	cmd.exe	39
PID 1236 wrote to memory of 2084	1236	cmd.exe	39
PID 1236 wrote to memory of 2084	1236	cmd.exe	39
PID 1236 wrote to memory of 2084	1236	cmd.exe	39
PID 2084 wrote to memory of 2276	2084	cmd.exe	40
PID 2084 wrote to memory of 2276	2084	cmd.exe	40
PID 2084 wrote to memory of 2276	2084	cmd.exe	40
PID 2084 wrote to memory of 2276	2084	cmd.exe	40
PID 2248 wrote to memory of 2164	2248	cmd.exe	41
PID 2248 wrote to memory of 2164	2248	cmd.exe	41
PID 2248 wrote to memory of 2164	2248	cmd.exe	41
PID 2248 wrote to memory of 2164	2248	cmd.exe	41
PID 1560 wrote to memory of 2320	1560	cmd.exe	42
PID 1560 wrote to memory of 2320	1560	cmd.exe	42
PID 1560 wrote to memory of 2320	1560	cmd.exe	42
PID 1560 wrote to memory of 2320	1560	cmd.exe	42
PID 2164 wrote to memory of 2056	2164	cmd.exe	43
PID 2164 wrote to memory of 2056	2164	cmd.exe	43
PID 2164 wrote to memory of 2056	2164	cmd.exe	43
PID 2164 wrote to memory of 2056	2164	cmd.exe	43

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2276	attrib.exe
2056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd /c move /y "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe" "C:\Users\Admin\AppData\lsass.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c move /y "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\332594c2668b35386f7a70c2212a4672_JaffaCakes118.exe" "C:\Users\Admin\AppData\lsass.exe"
    3⤵
    - Suspicious behavior: RenamesItself
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd /c reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon" /v userinit /t reg_sz /d "C:\WINDOWS\system32\userinit.exe,C:\Users\Admin\AppData\lsass.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon" /v userinit /t reg_sz /d "C:\WINDOWS\system32\userinit.exe,C:\Users\Admin\AppData\lsass.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\SysWOW64\reg.exe
      reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon" /v userinit /t reg_sz /d "C:\WINDOWS\system32\userinit.exe,C:\Users\Admin\AppData\lsass.exe" /f
      4⤵
      Modifies WinLogon for persistence
      PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd /c attrib +h "C:\Users\Admin\AppData\lsass.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +h "C:\Users\Admin\AppData\lsass.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Users\Admin\AppData\lsass.exe"
      4⤵
      Views/modifies file attributes
      PID:2056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd /c attrib +h "C:\Users\Admin\AppData"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +h "C:\Users\Admin\AppData"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h "C:\Users\Admin\AppData"
      4⤵
      Views/modifies file attributes
      PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-1-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/580-2-0x0000000000400000-0x0000000000D4D000-memory.dmp

Filesize
9.3MB

Download
memory/580-4-0x0000000000400000-0x0000000000D4D000-memory.dmp

Filesize
9.3MB

Download
memory/580-0-0x0000000000400000-0x0000000000D4D000-memory.dmp

Filesize
9.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads