6d7aace562fda7f3e4b8303d87eda0eb37981106a4fd01c3a503ca1a9ce405f3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
Size

268KB
MD5

46b8c9275a9c438aa08d83a08f327463
SHA1

3807f809512e6e31950a47cc4aada10ea77b75ec
SHA256

6d7aace562fda7f3e4b8303d87eda0eb37981106a4fd01c3a503ca1a9ce405f3
SHA512

e861228dba1f1d3fbec46006f1d42a8e3d4e3152ae13c0562af667fe429fadc5b38941d7623e4244efda54ea842fe7d24f8bb77f88100034a765f28b7bc26c14
SSDEEP

6144:V3CKOyZ0CHJb9TseghpHx1jHw6IjZlVFCrvThn:V3KyCqXghNx1jHwblVFO

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\46B8C9~1.EXE,"	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\46B8C9~1.EXE"	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\559118c5 = "O—ù†\x19î\u008fIq\x1cŽfÓóiªª\x15Ñ\f‡Ýù\aƒö,\x18öiöŽ…¹9Ý_»&Š\aš§T\x13\x19)>\x13<\x04%\n7Í.\\âKtÆ@\u009dF”fÝ°óCÄ,—œþPøb3ýEh\x15È%•¢k-}\vä5KÂ5úýRºz-¢‹Íõ}“Ë5ªºe³d\x05M\u00adåU½bÝ]3Sz\n\x15\|’„«]\"Š2åÅº”{[åUZuÍÒõ´„\|M}Â‹ÕJ\x1duzäÚ‚ë\x15u\u009dJ\x05\x1dD]’\u008d\|\rº…u›uzeÍ’5umm\x1b\x1bÊ\x02$rå%\|l;]mõBŒ\u008dÒ¼%m\\âMj\x15}DmEÌ5%{ý\x1c\u008dÓ\x053õj\x1d¬‚\x1ak\x1c“šõ\fM\x12*½•MmDå½Ý<ü%u\u008d\r"	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\46B8C9~1.EXE"	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
Token: SeSecurityPrivilege	2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
Token: SeSecurityPrivilege	2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
Token: SeSecurityPrivilege	2308	46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46b8c9275a9c438aa08d83a08f327463_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2308-1-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2308-2-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2308-3-0x0000000002720000-0x00000000027E1000-memory.dmp

Filesize
772KB

Download
memory/2308-5-0x0000000002720000-0x00000000027E1000-memory.dmp

Filesize
772KB

Download
memory/2308-7-0x0000000002720000-0x00000000027E1000-memory.dmp

Filesize
772KB

Download
memory/2308-13-0x0000000002720000-0x00000000027E1000-memory.dmp

Filesize
772KB

Download
memory/2308-11-0x0000000002720000-0x00000000027E1000-memory.dmp

Filesize
772KB

Download
memory/2308-9-0x0000000002720000-0x00000000027E1000-memory.dmp

Filesize
772KB

Download
memory/2308-14-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/2308-15-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-18-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-19-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-42-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-48-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-56-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-43-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-41-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-44-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-45-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-54-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-46-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-68-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-47-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-49-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-50-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-51-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-53-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-52-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-81-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-83-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-86-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-55-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-82-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-85-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-84-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-80-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-79-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-78-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-77-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-76-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-75-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-74-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-73-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-72-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-71-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-70-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-69-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-67-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-66-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-65-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-64-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-63-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-62-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-61-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-60-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-59-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-58-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-57-0x0000000002A80000-0x0000000002B47000-memory.dmp

Filesize
796KB

Download
memory/2308-169-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download