bbed1a77acad799272a9c59943f4ce7a067b9ffa950bffd761e7dbd6c0f037e8

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

331beee4808dd3fd1d379959eb1a406a_JaffaCakes118.exe
Size

804KB
MD5

331beee4808dd3fd1d379959eb1a406a
SHA1

8722c5545cee8eabe8f292445747979318e15636
SHA256

bbed1a77acad799272a9c59943f4ce7a067b9ffa950bffd761e7dbd6c0f037e8
SHA512

13d21d02f2ec5e0eabb30b72bbdd6b2346c18a89dc862426a8b43ae5d679d8645d89573fe98d34e73342a823eda0a8df9fc595df143b52b8f1c17f8a60ac2170
SSDEEP

12288:oqawg6JvQa0NXc77fYIyBnr9mAKKK9INzFP10QadZPm7yaLg3aX6n2aj:orwgqYlg7fYIAvH+exPzjuaLwLj

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",C:\\Users\\Admin\\AppData\\Local\\Temp\\331beee4808dd3fd1d379959eb1a406a_JaffaCakes118.exe,"	331beee4808dd3fd1d379959eb1a406a_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	2444	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2444	331beee4808dd3fd1d379959eb1a406a_JaffaCakes118.exe
2444	331beee4808dd3fd1d379959eb1a406a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\331beee4808dd3fd1d379959eb1a406a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\331beee4808dd3fd1d379959eb1a406a_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 388
  2⤵
  - Program crash
  PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2444 -ip 2444
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-0-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2444-2-0x00000000008E0000-0x0000000000927000-memory.dmp

Filesize
284KB

Download
memory/2444-3-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2444-6-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/2444-5-0x0000000003200000-0x0000000003279000-memory.dmp

Filesize
484KB

Download
memory/2444-4-0x0000000002510000-0x000000000251D000-memory.dmp

Filesize
52KB

Download
memory/2444-7-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/2444-9-0x00000000008E0000-0x0000000000927000-memory.dmp

Filesize
284KB

Download
memory/2444-10-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download