0fcc8ec62ab1ce7c7f7835da76eeb6a16554c3243dfeb760cbe72f4cef634015

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe
Size

30KB
MD5

6eed3bb731d7fafc6564a82d36e7d4f7
SHA1

94c4829454760bc7a84c3d1caec9c2a3c363554b
SHA256

0fcc8ec62ab1ce7c7f7835da76eeb6a16554c3243dfeb760cbe72f4cef634015
SHA512

76d0e33200799807593cb9bf803fbedd6d4ef765cbe19a12048f5f5472edff0f2fc6286435b73f5a6d0da21c0b9c19788668c3caf24bb6cce0d0c49fdabc264b
SSDEEP

768:o9wUMrsubOJVj4TYHVjSvht8eFGUMo74e3qs134moEilu0:okOJVj4TYAGUB4F23Pp

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1170\\ufive17.exe"	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\uzfive172 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1170\\ufive17.exe"	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1170\Desktop.ini	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1170\\ufive17.exe"	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1700	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1200	1700	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe	21
PID 1700 wrote to memory of 1200	1700	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe	21
PID 1700 wrote to memory of 1200	1700	6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-4-0x0000000002990000-0x0000000002992000-memory.dmp

Filesize
8KB

Download
memory/1200-3-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/1700-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1700-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1700-8-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download