Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
25/07/2024, 23:00
General
-
Target
71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
-
Size
395KB
-
MD5
71999a8d62e79b89ff7a0c2df8fe9fd9
-
SHA1
fd91edaf9f4d280f06a017b33d00bd5dc359ee45
-
SHA256
67c5cf4ef1f40ebb9e3d0d7406306e1f25227b8e4e014ec7573edb5d85df0fb4
-
SHA512
e0ff5100fa1787b8c7194a1e2ab0140ff6cc806bfc241e8b977ed1cb4a2bb3ad2567588cb7e4d0431e08908e3028a9fa9bda7ea138cca30631e4780098fb267a
-
SSDEEP
12288:YYT96JJ558EHwiQLykataz+wZT0Msxyj/LErqOUW9BH:1IJJ558EHwiQLykataz+wZT0Msxyj/L
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 4 IoCs
-
Drops file in System32 directory 25 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 17 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Debug\debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.pluC:\Windows\Debug\debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b2855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5e92d3a824a0578a50d2dd81b5060145f
SHA150ef7c645fd5cbb95d50fbaddf6213800f9296ec
SHA25687f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661
SHA51240d0ac6fa5a424b099923fcdb465e9a2f44569af1c75cf05323315a8720517316a7e8627be248cff3a83382fb6db1cf026161f627a39bc1908e63f67a34c0fd5
-
Filesize
163KB
MD5a7790328035bbfcf041a6d815f9c28df
SHA17ee75c72f50d37b1c69f72f33ba1063e8278b29e
SHA2566cee4877b6663fc93e94ecc0489834379d2fae6c363eb36035d863733ab7c304
SHA512125d7e387a90dde64858a9b82e237233f3262f22f47474714d3a3fad193d1cd3bf4823e239b967ae73979bf9492dc15b3d57adbddf91831e5b6aa6b18906aa09
-
Filesize
207KB
MD51c1760ed4d19cdbecb2398216922628b
SHA166b6158b28cc2b970e454b6a8cf1824dd99e4029
SHA256d66458a3eb1b68715b552b3af32a9d2e889bbf8ac0c23c1afa8d0982023d1ce2
SHA512f058eda0c65e59105a7c794721697782f1e1db759c69a11dab09ca454aa89767addcc8ecefa54995527bc2cae983e44c9ed42b0973fdb47435b31428150b96db
-
Filesize
322KB
MD5bd63d72db4fa96a1e0250b1d36b7a827
SHA1aad4b770b25789b7acd508bf3cf266d4ddb88111
SHA256f6953923fa9537edd709488db8fc17c7991f4f053a904306d9b93d79391fb0e6
SHA512e68b7a255cd22dcb885a094c24e8fe2c86cd8d1014aa0064917d33dee96c345fda594baad6d86ec087a2b167cad9936624aadd5b4953337a4a39e79ca88f8f3c
-
Filesize
228KB
MD54ea55a213ff5cc019e388673d0e1b9ab
SHA1d5b0957095904c3e720a8fdf004b3276fdd21a4a
SHA256cc85a7b90afbbf967c99f7cb1737e9ad0c7924b03859e4d569c903e2d403a24c
SHA5127bc118736bb2e63161b01d49c7325565411b7a04690145a0b7d2fde308e1dcdfd0f5412a7a895768a249de0f61cd19cf4abce19289705f34123f319e41f9a6c7
-
Filesize
942KB
MD561a8f02536ab07e430715b98bad49cab
SHA1e28de42fc3a993305178f8eb422f5ace9ea8b175
SHA2564f5ce43a424f1970c3a4d53ebd57c158180f30d60c71db329ee9eac772ef3bfa
SHA512def5296894cacd6b6a86aa47d6fc33854ec4edb8d19a6800f02d6897e36ccc67769ce2fd81752a6b3091204f30747ff8cce6758b145cd115515dafaa0e9a14e0
-
Filesize
726KB
MD5986a191e95952c9e3fe6be112fb92026
SHA11e2a48f1088ca5ab78617a7eeb8aa5f62abd4846
SHA2568bd3c3d2a3e6285d004afd50262d80939fa588b39c5ecb404d12d364216e73b2
SHA512044294049fed0c5165d2c204d4dfef8ddc65cbc872d499531a2d4f179e3ae2345142510ffc9c12c32e0c316eac3250d60b0b316a74a3d7d31b0a9699dc8529f7
-
Filesize
1.9MB
MD5c63e6c17fa58deaef044b159566eb549
SHA1a5af9542c7f56cf98eaf01f1bbdc0bd528aee147
SHA25674de25834cbfeb41c3053bf976f958dbe27def7b2e4d1e11d7d7d05f3700529c
SHA512fd005b6d94192758ca136b638b0a78dd3e9f15aa1718eb43b5b42a63706523b83800151c56afa77d5a58b1bcb1e6cc4dc19d088cd38af45baac5c24b64d8be6e
-
Filesize
63KB
MD51841c44f0e9fb8aed2e0d50d2357d7e9
SHA1e1dfa90674cdb2aa43f9d75e8ecb7e4e8c218579
SHA256d74629433d64f600645c7d440b5746c7353b7c5ab26c0f986df89e30c82e5aec
SHA5123605222a6e7faedc107978064370865a5576780f90ba52c49c2ed83139718fd65ef63d09f90567791aff6430001d234d2c8632eab6266fc1d44cbe3b78c03ee7
-
Filesize
332KB
MD519d7285c744fe18326a665aa33eaba35
SHA148366a0ee4a3fbae86771a22a350941655190fcc
SHA256addb4e33a11d70f4add9744c95ee96f52b107ccd0f78b820e0e5d7fce95f2167
SHA512cafcf7b960d2b6e8a3b8915074f1a88334d396b9c8d0510fa2960635c38137dd2b0635c9d47c71968cea69e6744f4630b3f2b116f432ab53e9be949bc621836e
-
Filesize
136KB