d2aaa75e24e3e9555f6b42c15f45d07bc79259ee5faca7d3959327da6e196d44

Analysis

max time kernel
149s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
Size

125KB
MD5

74bafc6ab4b3de3ef2a917280cde1d14
SHA1

90ee37ee26c8c526ece7a8957079f975572842d1
SHA256

d2aaa75e24e3e9555f6b42c15f45d07bc79259ee5faca7d3959327da6e196d44
SHA512

31639ec5e8b79e9ac685a20ff9c0bd058e9661f64447a31c5d9c122731ed77c7e38db0224d4ff159316208bea46e1dc0b15f0ae15967c4f4f092ffe2978684f6
SSDEEP

3072:r20DaedBsMmU2K9/XgzOTDTp3CTbYsKRk:r20Gednm6azOTFEPKRk

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\explorer.exe,"	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\explorer.exe	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dab1.dll	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
3316	74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74bafc6ab4b3de3ef2a917280cde1d14_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dab1.dll

Filesize
44KB

MD5
ece442e02a216a3e74e3b0694f54d9fd

SHA1
7b6b76dec2a64600737d512813b8f55c966c32ed

SHA256
5509707bec627bca30439ce43f0d899664535cecbad1afda8611a4e5350c7107

SHA512
8cd2575e29e6307b15dd8224bb92f6351c3a1c133bc5346f8dd2c5c13133827888dbb6d4e9262e5f68c9a43c37facd559fab7990605ffe2238a6296f6176faf1

Download Submit
memory/3316-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3316-1-0x0000000000460000-0x0000000000480000-memory.dmp

Filesize
128KB

Download
memory/3316-9-0x00000000022F0000-0x0000000002310000-memory.dmp

Filesize
128KB

Download
memory/3316-8-0x00000000022D0000-0x00000000022EA000-memory.dmp

Filesize
104KB

Download
memory/3316-10-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3316-11-0x0000000000460000-0x0000000000480000-memory.dmp

Filesize
128KB

Download
memory/3316-12-0x00000000022D0000-0x00000000022EA000-memory.dmp

Filesize
104KB

Download
memory/3316-13-0x00000000022F0000-0x0000000002310000-memory.dmp

Filesize
128KB

Download