9416d1a63fb0838a5731cb00f28675b72ae12dc3e60e94a2d8c3e05edc8f8788

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

390029121772a48c7a0897d36507c6b9_JaffaCakes118.dll
Size

116KB
MD5

390029121772a48c7a0897d36507c6b9
SHA1

e42384aef3a1a7c277c25e3378002d4743135532
SHA256

9416d1a63fb0838a5731cb00f28675b72ae12dc3e60e94a2d8c3e05edc8f8788
SHA512

973228afaef002fca86b037558af8aef752158f0606c29a5d9d1710aa5e9e501d41a64853597039e557eebbb9fec12215e05784c01bc05da7c16dd859ff5c76e
SSDEEP

3072:dOaKhJBck9q0j65u0xzx2Ec2kc8+QxyqWbsi3+LBeU4:IhJBcKdj70hIUkcExyqQsveU

Score

6^/10

persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\390029121772a48c7a0897d36507c6b9_JaffaCakes118\Shutdown = "WlxShutdownEvent"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\390029121772a48c7a0897d36507c6b9_JaffaCakes118\Impersonate = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\390029121772a48c7a0897d36507c6b9_JaffaCakes118\Asynchronous = "0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\390029121772a48c7a0897d36507c6b9_JaffaCakes118	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\390029121772a48c7a0897d36507c6b9_JaffaCakes118\DllName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\390029121772a48c7a0897d36507c6b9_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\390029121772a48c7a0897d36507c6b9_JaffaCakes118\Startup = "WlxStartupEvent"	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mtxeimes.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	rundll32.exe
2468	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30
PID 1864 wrote to memory of 2468	1864	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\390029121772a48c7a0897d36507c6b9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\390029121772a48c7a0897d36507c6b9_JaffaCakes118.dll,#1
  2⤵
  - Modifies WinLogon
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads