a1443967344dce54aabd8b2b7388eba4903b2c71f402c40c37541a6f601e67e0

Analysis

max time kernel
6s
max time network
8s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 16:12

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

4a6ce8cb2cb3593e2a6a2c45ba492ebc_JaffaCakes118.exe
Size

88KB
MD5

4a6ce8cb2cb3593e2a6a2c45ba492ebc
SHA1

ff120de32cafbba95ab0e7ae2b63f38a6d177fe3
SHA256

a1443967344dce54aabd8b2b7388eba4903b2c71f402c40c37541a6f601e67e0
SHA512

4f7a81651510b1f508705137dd5d286075e169df59efe697c0172c6592d06c2c0a21d8fb0c2fd82fb578ed1524b5697263324b51a1a09a3aa470f392fb8186c1
SSDEEP

1536:zfw/9/0HbjV7NMsHrp5dsszYqzRcZ2Z/g6h4jmlSBG3kEC7xZopyFuTHT9KoeJlz:zfg9/0/VhrHd5IocZ2Z/ImBUEC7okErg

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fyiikca.dll	4a6ce8cb2cb3593e2a6a2c45ba492ebc_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2292	4a6ce8cb2cb3593e2a6a2c45ba492ebc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4a6ce8cb2cb3593e2a6a2c45ba492ebc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a6ce8cb2cb3593e2a6a2c45ba492ebc_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2748

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2292-2-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2292-1-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download
memory/2600-6-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2748-5-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download