e5609d397f5af9717b69c8dc36462f75f8fc2fc614031855efeed51908753651

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
Size

108KB
MD5

ab7390965d26c05ac60944efdfc6da75
SHA1

6f50bee3e3f102da45d709a462262ba2aacbac8d
SHA256

e5609d397f5af9717b69c8dc36462f75f8fc2fc614031855efeed51908753651
SHA512

f4d0a3b8c83f84e7f7e357f549e35e18eaaadf6717c8d4425107852589e7c074e1f068d7dc15e676e0442cf31405788d85ce8833485ba50fa280a61e40cf2cc4
SSDEEP

3072:BEAyirb4V9GBuEvNwVM4AzufHHRt5IWflcbJld+VGo/Oi:BEA7rW9GBuEvNwVjNnRtSkO4Io/O

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\Userinit.exe,C:\\Program Files\\Windows Media Player\\lsasss.exe,C:\\Program Files\\Windows Media Player\\system32.exe"	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msador15.ps0	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msador15.ps0	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\system32.exe	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\system32.exe	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4904	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
4904	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
4904	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
4904	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4904	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
4904	ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab7390965d26c05ac60944efdfc6da75_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\ado\msador15.ps0

Filesize
53KB

MD5
23d61e0e93b323317b02bbf3367a8d83

SHA1
394f3841be6ea62593315f60b7e7a7702f704778

SHA256
e096f537004de7984d55b35d6974413dd8f99e7c01db84670d76944492db1adf

SHA512
3940c9f54ba9807540ea1421e400022c5aebd78783bda6603c31c8d6d83a40c540a698633bf042634f39dd9e439f7427bcf70ed3a6d91865a112f3ad3ad50b3b

Download Submit