7fd7a385d60db49e72e15aa82fd45c7dded4e8417614b9ce5d62c0b047692f97

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
Size

95KB
MD5

5ccad158cfc2c7c5e2910787e34de62d
SHA1

2d87ddb08e44e4d2bf8b98785d158c777ed4b090
SHA256

7fd7a385d60db49e72e15aa82fd45c7dded4e8417614b9ce5d62c0b047692f97
SHA512

35bc4458cb16ced7e9df37dc97a4603ea883310f0da3e3db692fe9ad5d5a716332d0dd13711691b358615ae4a2c696b94472d1e3a0dfba164ebabf782fbe3fbe
SSDEEP

1536:SVwVzPcECy/3dLWZoTfdsn9cxQLEes4N4Lt+9tliFIlcUk6wACfPugD8iXhVGG1u:S2VY1y/3dVbGn9VwekLtqtUFIYrWgpXA

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\ntos.exe,"	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntos.exe	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
1620	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1620-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1620-1-0x0000000000411000-0x0000000000421000-memory.dmp

Filesize
64KB

Download
memory/1620-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download