Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 02:49

General

  • Target

    3fe5c195765933bc273cc32afc186e9d_JaffaCakes118.exe

  • Size

    263KB

  • MD5

    3fe5c195765933bc273cc32afc186e9d

  • SHA1

    f9a85a75f46aadc8a1d5f00d260aafb0c9377634

  • SHA256

    d21ba5386b7f9f15f4cd1195b07520cd04e18732d7f79e63de68fa168f9fd18b

  • SHA512

    19b4a4fa8538ca989abae8275b199e505e3f3d8647fe5ecf491814ac6b285c4f8ff0a3719fb9854646a59ded3d53a7c382b717c132b86f4e86b1f7bec710a9e6

  • SSDEEP

    3072:6LQ0S1wdTDmI2tozYy2NfLa+l/HIKJSsI+AlKlmiJqJy5IB0OUbS9CrOEBT:v0/oKYy2NfLZl/HjDJqJy5IB6C+Dp

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fe5c195765933bc273cc32afc186e9d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3fe5c195765933bc273cc32afc186e9d_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3512-0-0x000000007FDE0000-0x000000007FE47000-memory.dmp

    Filesize

    412KB

  • memory/3512-1-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/3512-3-0x0000000002680000-0x0000000002732000-memory.dmp

    Filesize

    712KB

  • memory/3512-4-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/3512-5-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-9-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-7-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-66-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-100-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-119-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-118-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-117-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-116-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-115-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-114-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-113-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-112-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-110-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-109-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-108-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-107-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-106-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-105-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-104-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-103-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-102-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-101-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-99-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-82-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-98-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-97-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-96-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-95-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-94-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-93-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-92-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-91-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-90-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-89-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-87-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-86-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-85-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-84-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-83-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-81-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-80-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-79-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-78-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-77-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-75-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-74-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-73-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-71-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-69-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-68-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-111-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-67-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-65-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-88-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-64-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-63-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-76-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-72-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-70-0x00000000028D0000-0x0000000002988000-memory.dmp

    Filesize

    736KB

  • memory/3512-192-0x000000007FDE0000-0x000000007FE47000-memory.dmp

    Filesize

    412KB

  • memory/3512-193-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB