47606b7e37496ffa9246f2e06128059232257f6119c7f44c4b189af4788ebc79

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
Size

124KB
MD5

68f6d1ba43c3f08c08bbfee6c0053a2a
SHA1

7d88debd65d2f820c0106fafd620d83d30217376
SHA256

47606b7e37496ffa9246f2e06128059232257f6119c7f44c4b189af4788ebc79
SHA512

3e8afb57cbac781aa9a06fe4c6acba90f5a5df879073cccc5f70e7a7bab13fc7f9b3b32fca0e559040469e5011f29c5a7e2b9115fdc1db746c94df0bf88c52ff
SSDEEP

3072:RtvMumOpGpgL/ePsGDObXyHDMsoRzQed9yjcMpJHKBrCj6:R5kOKrlHDYzQ+9yjdXKB8

Score

10^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\msconfig.dat"	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3024-18-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
2056	explorer.exe
1184	Explorer.EXE
1580	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe
1580	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1184	Explorer.EXE
1184	Explorer.EXE
1184	Explorer.EXE
1184	Explorer.EXE
2788	ctfmon.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1184	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1580	svchost.exe
1580	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3040	3024	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2056	3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	32
PID 3040 wrote to memory of 2056	3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	32
PID 3040 wrote to memory of 2056	3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	32
PID 3040 wrote to memory of 2056	3040	68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe	32
PID 2056 wrote to memory of 1184	2056	explorer.exe	21
PID 1184 wrote to memory of 1580	1184	Explorer.EXE	33
PID 1184 wrote to memory of 1580	1184	Explorer.EXE	33
PID 1184 wrote to memory of 1580	1184	Explorer.EXE	33
PID 1184 wrote to memory of 1580	1184	Explorer.EXE	33
PID 1184 wrote to memory of 1580	1184	Explorer.EXE	33
PID 1580 wrote to memory of 2788	1580	svchost.exe	34
PID 1580 wrote to memory of 2788	1580	svchost.exe	34
PID 1580 wrote to memory of 2788	1580	svchost.exe	34
PID 1580 wrote to memory of 2788	1580	svchost.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\68f6d1ba43c3f08c08bbfee6c0053a2a_JaffaCakes118.exe
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:2056
- C:\Windows\syswow64\svchost.exe
  "C:\Windows\syswow64\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\ctfmon.exe
    ctfmon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-25-0x0000000002D50000-0x0000000002D59000-memory.dmp

Filesize
36KB

Download
memory/1580-36-0x00000000000D0000-0x00000000000D9000-memory.dmp

Filesize
36KB

Download
memory/1580-31-0x00000000000D0000-0x00000000000D9000-memory.dmp

Filesize
36KB

Download
memory/2056-62-0x00000000FF150000-0x00000000FF410000-memory.dmp

Filesize
2.8MB

Download
memory/2056-29-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/2056-30-0x00000000FF150000-0x00000000FF410000-memory.dmp

Filesize
2.8MB

Download
memory/3024-18-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3024-2-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/3024-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3024-15-0x0000000000220000-0x0000000000320000-memory.dmp

Filesize
1024KB

Download
memory/3040-20-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-7-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-22-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3040-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-24-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-21-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3040-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download