525a621533388fe211966d5f68017f6da2213c761d73061e848963a2427e1b4e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
Size

255KB
MD5

34aee0dcdcbc050198beca599326c92d
SHA1

fdc2d7cc9ad7e129a28ca9ba0f9f2b3656040739
SHA256

525a621533388fe211966d5f68017f6da2213c761d73061e848963a2427e1b4e
SHA512

c003cd43d73cd7a94fde0c6000a8a329f885194dd7f8ce902d5ba35aa52e4262cae601011f571d474195a145734dfeeefae8ade1b8704ec6fea6fbccbe2e85b6
SSDEEP

6144:KNU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:KNRdpgdRRoTCD4ijpoix

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\34AEE0~1.EXE,"	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34AEE0~1.EXE"	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34AEE0~1.EXE"	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\646bd2a4 = "\x1bŸ3M›2ÚZl·°\x108~} îŸé\x1fêF\x18\u008f\x06\x1d\x06\x17Å\x12áÊ´{¥_J®ê‰GÅw$¶^TXˆ÷&\f»£Ð‚roÕ…\u008dB\x7f®æujíF1²Œ\x16eÄÊj1™ƒ¶AdØ=ð,§(\x06g¾¥«\u008fgÌí\x17m\u008f‡U\a5Î\x04PdHYŸlëWe÷÷‡§7è\bó€_\x17% w\x0f¡a'/¨3.p×¡_\\ïæÓÙîãÆq\x0fÍ\vW0e\x04lÇ–#õ\x0fÅ÷\x0f\x14M‹ø-\x19ÅÐ\u009dL_F–…ë=ñ˜×Q0wvœ4è¯?{gg?%\x01¬^‘\u00a0À¹”q#¯áCó\x05y}»gH¬0È\x17¦7‹å¼`¥\x18\u00a09û°\x10ŽÏ-\v·g\x7f\u0090\x17ñtüF\x11÷µ\tgP>Ì#?"	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
Token: SeSecurityPrivilege	4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
Token: SeSecurityPrivilege	4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
Token: SeSecurityPrivilege	4504	34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34aee0dcdcbc050198beca599326c92d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4504-0-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/4504-1-0x00000000009E0000-0x0000000000A37000-memory.dmp

Filesize
348KB

Download
memory/4504-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4504-4-0x0000000002370000-0x0000000002422000-memory.dmp

Filesize
712KB

Download
memory/4504-5-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/4504-6-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-11-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-8-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-102-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-88-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-73-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-60-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-59-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-70-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-69-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-68-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-67-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-66-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-65-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-114-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-113-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-112-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-111-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-110-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-109-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-108-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-107-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-106-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-105-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-104-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-103-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-101-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-100-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-99-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-98-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-97-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-96-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-95-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-94-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-93-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-92-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-91-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-90-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-89-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-87-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-86-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-85-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-84-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-83-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-82-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-81-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-80-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-79-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-78-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-77-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-76-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-75-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-74-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-72-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-71-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-64-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-63-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-62-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-61-0x0000000002430000-0x00000000024E8000-memory.dmp

Filesize
736KB

Download
memory/4504-188-0x00000000009E0000-0x0000000000A37000-memory.dmp

Filesize
348KB

Download
memory/4504-189-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download