87bd585ff6e5e74f0932b72a081e11ac34b3740021ffae8acb73062625205352

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe
Size

64KB
MD5

ecef94d5edcf0e942786c2ce9a51c0f1
SHA1

4e207975c6d40420292bfa248d142c31ad9a1c11
SHA256

87bd585ff6e5e74f0932b72a081e11ac34b3740021ffae8acb73062625205352
SHA512

3ac35d5f43ab77fba05967014838d2ef230081bc135395161b8698bf7e3a51cb61b41fc0c931bb6db65144012786adf4bf495cde49711057cf5c1cbbc1a8d0c4
SSDEEP

1536:7e/opfX5/SHWR5XQAAZyYea2kUBVpK4+TMLM:76Q/YWR5XQAAZIjBVp7jo

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\neths.exe"	ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nethss.exe	ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\nethss.exe	ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1732	ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecef94d5edcf0e942786c2ce9a51c0f1_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1732-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1732-11-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads