e5609d397f5af9717b69c8dc36462f75f8fc2fc614031855efeed51908753651

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
Size

108KB
MD5

ab7390965d26c05ac60944efdfc6da75
SHA1

6f50bee3e3f102da45d709a462262ba2aacbac8d
SHA256

e5609d397f5af9717b69c8dc36462f75f8fc2fc614031855efeed51908753651
SHA512

f4d0a3b8c83f84e7f7e357f549e35e18eaaadf6717c8d4425107852589e7c074e1f068d7dc15e676e0442cf31405788d85ce8833485ba50fa280a61e40cf2cc4
SSDEEP

3072:BEAyirb4V9GBuEvNwVM4AzufHHRt5IWflcbJld+VGo/Oi:BEA7rW9GBuEvNwVjNnRtSkO4Io/O

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\Userinit.exe,C:\\Program Files\\Windows Media Player\\lsasss.exe,C:\\Program Files\\Windows Media Player\\system32.exe"	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\system32.exe	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\system32.exe	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\ado\msador15.ps0	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msador15.ps0	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
848	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
848	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
848	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
848	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\ado\msador15.ps0

Filesize
52KB

MD5
c177a5948c7eca2873b88af875602149

SHA1
ca583ed790dab61bd181517a27bf13763b490d0d

SHA256
6bf7520c1bcb4aea556794d6bb369eb1882bda1e8de7f82cc23853f920c40d84

SHA512
ebb644a44c1560e43802f6af672febb7b1277cb5aee2bf20f6a4671912a1e899f27dbf26420e0a7941d218746b760b099d421e46368067507e990eafef58b94c

Download Submit