7fd7a385d60db49e72e15aa82fd45c7dded4e8417614b9ce5d62c0b047692f97

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
Size

95KB
MD5

5ccad158cfc2c7c5e2910787e34de62d
SHA1

2d87ddb08e44e4d2bf8b98785d158c777ed4b090
SHA256

7fd7a385d60db49e72e15aa82fd45c7dded4e8417614b9ce5d62c0b047692f97
SHA512

35bc4458cb16ced7e9df37dc97a4603ea883310f0da3e3db692fe9ad5d5a716332d0dd13711691b358615ae4a2c696b94472d1e3a0dfba164ebabf782fbe3fbe
SSDEEP

1536:SVwVzPcECy/3dLWZoTfdsn9cxQLEes4N4Lt+9tliFIlcUk6wACfPugD8iXhVGG1u:S2VY1y/3dVbGn9VwekLtqtUFIYrWgpXA

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe,"	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntos.exe	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5
PID 2792 wrote to memory of 592	2792	5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:592

C:\Users\Admin\AppData\Local\Temp\5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ccad158cfc2c7c5e2910787e34de62d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-32-0x0000000029180000-0x00000000291A1000-memory.dmp

Filesize
132KB

Download
memory/592-24-0x0000000029120000-0x0000000029141000-memory.dmp

Filesize
132KB

Download
memory/592-78-0x0000000029390000-0x00000000293B1000-memory.dmp

Filesize
132KB

Download
memory/592-72-0x0000000029360000-0x0000000029381000-memory.dmp

Filesize
132KB

Download
memory/592-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/592-12-0x0000000029090000-0x00000000290B1000-memory.dmp

Filesize
132KB

Download
memory/592-16-0x00000000290C0000-0x00000000290E1000-memory.dmp

Filesize
132KB

Download
memory/592-41-0x00000000291E0000-0x0000000029201000-memory.dmp

Filesize
132KB

Download
memory/592-36-0x00000000291B0000-0x00000000291D1000-memory.dmp

Filesize
132KB

Download
memory/592-29-0x0000000029150000-0x0000000029171000-memory.dmp

Filesize
132KB

Download
memory/592-69-0x0000000029330000-0x0000000029351000-memory.dmp

Filesize
132KB

Download
memory/592-67-0x0000000029300000-0x0000000029321000-memory.dmp

Filesize
132KB

Download
memory/592-20-0x00000000290F0000-0x0000000029111000-memory.dmp

Filesize
132KB

Download
memory/592-46-0x0000000029210000-0x0000000029231000-memory.dmp

Filesize
132KB

Download
memory/592-49-0x0000000029240000-0x0000000029261000-memory.dmp

Filesize
132KB

Download
memory/592-52-0x0000000029270000-0x0000000029291000-memory.dmp

Filesize
132KB

Download
memory/592-57-0x00000000292A0000-0x00000000292C1000-memory.dmp

Filesize
132KB

Download
memory/592-60-0x00000000292D0000-0x00000000292F1000-memory.dmp

Filesize
132KB

Download
memory/592-66-0x0000000029300000-0x0000000029321000-memory.dmp

Filesize
132KB

Download
memory/2792-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2792-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2792-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2792-2-0x0000000000401000-0x000000000040F000-memory.dmp

Filesize
56KB

Download