743a7d9820850e9ff7eff805423095a992c79e98a23cd5f020d15d83de601e6d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe
Size

518KB
MD5

84ae6b1842684e97a8dbc19706244bee
SHA1

d3375405eab22ba6d19afde0bf4ad034d59f4e7b
SHA256

743a7d9820850e9ff7eff805423095a992c79e98a23cd5f020d15d83de601e6d
SHA512

f0f785e1fac699239b85670ff5ab3cc57cd9a77c036007fd0347ee512bd6e8dddf52cf7e8c4fe769f3ca50e37a0cd05f73b751012b121c3ba62485e36417463d
SSDEEP

3072:TQY+qH9KMcdmS9zVb2i+rJcpBBtTzEj21LgQthhJqH9KMcdmS9zVb2i+rJ:eEY9d1jyBJcpBBtrVtpEY9d1jyBJ

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "azrkrnl.exe"	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2512	drzkrnl.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\azrkrnl.exe	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe
File created	C:\Windows\drzkrnl.exe	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe
File opened for modification	C:\Windows\drzkrnl.exe	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe
File created	C:\Windows\azrkrnl.exe	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drzkrnl.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2512	2064	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2512	2064	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2512	2064	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2512	2064	84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84ae6b1842684e97a8dbc19706244bee_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\drzkrnl.exe
  C:\Windows\drzkrnl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\drzkrnl.exe

Filesize
54KB

MD5
7510c0c873f3c0f73e82cc0f69ecdcd1

SHA1
ec7d27ac8305a3a6c082e4a5a50e564eac05c818

SHA256
1c551ea5cae8b10a76fe75f03a87cea1ab04dff84729e30d540a89a9a0c6703e

SHA512
0f0e835c20c4017d3789891bca8a16a971cd5e16eb34a351d761bd0b151ac004b0f2fe0c3c1cb58904893127c34eccfba9b14ac6cd50e2532c00bfc8e132c66e

Download Submit
memory/2064-4-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2064-3-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2064-11-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2512-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads