639829dddbfd8ceddbf254eb9f20a597aed19c57f97b1ebc2d4b039cfa84f922

Analysis

max time kernel
95s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 18:22

Target

ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe
Size

23KB
MD5

ebef08a17dd9959ee5ebdbf46ec97136
SHA1

fd20533992fa1eb419a1a4d8a9b8c26a9ca3f1bb
SHA256

639829dddbfd8ceddbf254eb9f20a597aed19c57f97b1ebc2d4b039cfa84f922
SHA512

21aec4ff5628cb7beefc3365b6d50edca14387e92c222712e11398048ae919f3f1efc303b49d60cf961d9c1851eaee8acb44baaa0d1c64e91e5e44c58e69393f
SSDEEP

384:CWVSNWmDRNQo2HzhRBxp26Q5VKsQ6arrIp9AClQ5ceBm3Tawro7xoC+JhlH1SpY:opRio2hrP26QuMacTH+wuoCoh1SpY

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\Userinit.exe"	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\usbine.sys	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

description	ioc	Process
File opened for modification	\??\d:\autorun.inf	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Winlogon.exe	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3852	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2764	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe
2764	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe
2764	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe
2764	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 800	2764	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe	10
PID 2764 wrote to memory of 800	2764	ebef08a17dd9959ee5ebdbf46ec97136_JaffaCakes118.exe	10

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:3852