e9cb2afeb478e727585163e20a73593923504addc37e9e21052de6042dbaba12

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

975f1e2cb5a3830e83bb4d0987c8a7b7_JaffaCakes118.exe
Size

12KB
MD5

975f1e2cb5a3830e83bb4d0987c8a7b7
SHA1

faadf068e07ae27551d276ab5424220215f44628
SHA256

e9cb2afeb478e727585163e20a73593923504addc37e9e21052de6042dbaba12
SHA512

36bb2375959d40a462652af218903d4368bf28df628733318ac70740bed93978f7df004b9dbcab81662d0d823f5a7c10cfc2bcfb45347e398c3d7b5e1944cb5b
SSDEEP

384:/T3DF4+gcD3QT8JmzAx/r6+S9Pfu7n5Q/:/zJVgcU2mExudeVQ/

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system\\NOD32.com"	975f1e2cb5a3830e83bb4d0987c8a7b7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	975f1e2cb5a3830e83bb4d0987c8a7b7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3016	975f1e2cb5a3830e83bb4d0987c8a7b7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\975f1e2cb5a3830e83bb4d0987c8a7b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\975f1e2cb5a3830e83bb4d0987c8a7b7_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3016-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads