bc7c7a1e2c38ea01383058854a592e65e50af3aeba628fdd92737c9eb288e498

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe
Size

36KB
MD5

b2f3b8df8cef2ac8e5fa91fd528e4905
SHA1

5cd504199b6ea2d3edc16c8429f3dec385d6a62f
SHA256

bc7c7a1e2c38ea01383058854a592e65e50af3aeba628fdd92737c9eb288e498
SHA512

8509bf35d058ae0c4232542a0ae6ae8a3c0055a73a4b03449201cef553a66151d346c3fcc5ef0262cdf11ee4dd24849aa40e046685d60760bdef4d6bf54870e1
SSDEEP

768:CGExyBYZV+1pF8XTZCwGodZWJI3DeX6X8dYUMO:CGEEYZV+CZCwGoeJI3DeX6s4

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mswinlogon = "C:\\WINDOWS\\mswinlogon.exe"	b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mswinlogon = "C:\\Winnt\\mswinlogon.exe"	b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\MSWINSCK.OCX	b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1816	b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe
Token: SeBackupPrivilege	1816	b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1816	b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2f3b8df8cef2ac8e5fa91fd528e4905_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads