21427789b93d3b86f9ce460bdee75656d0ba358f63b5ca9e13fefd88287be488

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe
Size

50KB
MD5

3666dd84c5e8f326923dba7549c7c829
SHA1

c93d116b5cdcf74fcdff526aa6bc053a162a0eaa
SHA256

21427789b93d3b86f9ce460bdee75656d0ba358f63b5ca9e13fefd88287be488
SHA512

992ca34e9af0c7d6aa50459f587c729abd4a45c4ce9bf6c25fd4194a7f3be3a62a41c64d026dde0271766040ec9b6093b19b4fef55dcdd04f90f3e7d908d8c7e
SSDEEP

768:9fEDrvWgl9X+epBIWqhwfZ3OShsg0XQhShaH28BwTN5s9T4bwmUqo:9fEfvW+X+epu9eVsgPhS4H23I9sbPUqo

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\ntos.exe,"	3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntos.exe	3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

pid process

2948 3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe
2948 3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2948 3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

pid	process
2948	3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe
2948	3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2948	3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3666dd84c5e8f326923dba7549c7c829_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2948-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2948-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2948-3-0x0000000000410000-0x0000000000412000-memory.dmp

Filesize
8KB

Download
memory/2948-9-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2948-11-0x0000000000410000-0x0000000000412000-memory.dmp

Filesize
8KB

Download