348fc36661a40d9a1e57b2f8d340d24c496634c7a35a4f704778231dd6f12e4c

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee0e4ea73bb1db835b27ae6abfc8b807_JaffaCakes118.exe
Size

17KB
MD5

ee0e4ea73bb1db835b27ae6abfc8b807
SHA1

5b433880bcce27bf7736b202cab0270049136f25
SHA256

348fc36661a40d9a1e57b2f8d340d24c496634c7a35a4f704778231dd6f12e4c
SHA512

1baa9f9bd246f35c66fd7920019082750f710611bc62fbf7c22c8254bde48f79cb42d5493f4c43269f5be150b3de860976406f3955c0e3b4488e3dcdcdbb0e14
SSDEEP

384:rZbbzpLuaUNuIKACbE06Q+l9AU9jyCPt6DUi+wiU9/+CBKerCRYSsPNzHzanIW9i:NnzpLurMA106Qi/jrPt+Nn3eYflLzrSi

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\RECYCLER\\RECYCLER.com"	ee0e4ea73bb1db835b27ae6abfc8b807_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2508	ee0e4ea73bb1db835b27ae6abfc8b807_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee0e4ea73bb1db835b27ae6abfc8b807_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	ee0e4ea73bb1db835b27ae6abfc8b807_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ee0e4ea73bb1db835b27ae6abfc8b807_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee0e4ea73bb1db835b27ae6abfc8b807_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\RECYCLER\RECYCLER.dll

Filesize
24KB

MD5
516b72fefdbac3fa03bf57c55041f1df

SHA1
1a67792d439928be95db748098e128c881388d8a

SHA256
9d554c490498d6011c22f62a756b93f050c611177428c47071fd175694fddf4f

SHA512
dc15a2c58172aa3a040d3e595c209fc8a9beba1fa318a9393b17aca0658652ea60ccbe33717faadc907e7f4119d93e33ffa36a632d63f4b2ccf93bd680a3c45d

Download Submit
memory/2508-3-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download
memory/2508-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2508-6-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads