Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14/07/2024, 17:10
General
-
Target
46c0c7389221733ef367a47614bcd683_JaffaCakes118.exe
-
Size
189KB
-
MD5
46c0c7389221733ef367a47614bcd683
-
SHA1
2453191977629235cc8a9ef81e64dcda2f7cd5dc
-
SHA256
05036cdefed1e2e405eb6b288aacf6c2df59e780de8c2493d76fc14c0b42aa8b
-
SHA512
6704d1a2e72d99523e87ab36331acafd86f5802ef05bd7dba5169f5c9814da0718e141331a1c8c7e405b7169de6994ce8d4ed84fe8b68b068745524f28c54d93
-
SSDEEP
3072:GEHGP1HGCqWpkmP46b5NOiT8zMMJDRQN2ajzKUx+WJ26sBSZjVIidm3ZMFRJwdT3:GEmPlpk846FNOiTQDtRQzjGeRZ5NjRaJ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Users\Admin\AppData\Local\Temp\46c0c7389221733ef367a47614bcd683_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\46c0c7389221733ef367a47614bcd683_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1