5331da36f8610054bb8004c8b929857ea358f43b0be69ee49137a870e9cfd81e

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
Size

156KB
MD5

6117b80ee3911fc8e08298e79c9b6f11
SHA1

b08f77975f45b33c3d8e10ff774684d8abdcd99a
SHA256

5331da36f8610054bb8004c8b929857ea358f43b0be69ee49137a870e9cfd81e
SHA512

362b38f9b10dc31666311a816deafcc903f88bd09bed7cd208a09f3ccab5a96f0279ed1a973158861ae94fca2017f35e4b472b5bc7a6be12ef649735f6f1869f
SSDEEP

3072:ghJhCoUVyZKygkP0YLhUVlyICMUftwodFbvai7/5bXQ/DCcVX:ghJ0P0BL0YLhYyIytbNjQ/VVX

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3476	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mtxeimes	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mtxeimes\DllName = "C:\\Windows\\system32\\mtxeimes.dll"	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mtxeimes\Startup = "WlxStartupEvent"	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mtxeimes\Shutdown = "WlxShutdownEvent"	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mtxeimes\Impersonate = "0"	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mtxeimes\Asynchronous = "0"	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mtxeimes.dll	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mtxeimes.exe	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3476	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
3476	6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6117b80ee3911fc8e08298e79c9b6f11_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mtxeimes.dll

Filesize
116KB

MD5
390029121772a48c7a0897d36507c6b9

SHA1
e42384aef3a1a7c277c25e3378002d4743135532

SHA256
9416d1a63fb0838a5731cb00f28675b72ae12dc3e60e94a2d8c3e05edc8f8788

SHA512
973228afaef002fca86b037558af8aef752158f0606c29a5d9d1710aa5e9e501d41a64853597039e557eebbb9fec12215e05784c01bc05da7c16dd859ff5c76e

Download Submit