cd3f9d23719231cd510b252746d34f798e6214132282b5d1c6107af281765fe1

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe
Size

304KB
MD5

eed545a854ece23d746a0e6a89bc72d9
SHA1

0a271ecc7db5f0bf3151a455bac335b43d350682
SHA256

cd3f9d23719231cd510b252746d34f798e6214132282b5d1c6107af281765fe1
SHA512

6dc49d713e317d1f91b6abd7d554cf611111629cc250ce909537333d99f778a56fede14b5a3a1a98d9ba9531618e596e4b8bb4c5d8f60d89ab51142e3bc0a47e
SSDEEP

6144:GA7TgGATIr4tccyvkhznX75wS5f8evpmu:b7ATIMbnwg4

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe,C:\\Arquivos de programas\\zFUXPMtc.exe"	eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	sites.google.com
10	sites.google.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\winlogn.ini	eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe
File created	C:\WINDOWS\system\log.ini	eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eed545a854ece23d746a0e6a89bc72d9_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\log.ini

Filesize
476KB

MD5
a8fc17684868e0b2e66b3dc3cd651481

SHA1
ecb258488657f4c208980043b56e23979483fbed

SHA256
ee26db27bdf46d58c0dfd363b511bf3d118c685ee36a9b508e47ee4710e2ad81

SHA512
6eb13387abc33d34e3c582bf0df31b66a61ef0a281cd205eed8f6f24547b31270502196f8f3794ecd653b9839661a03c9adb802258add01a06222bcd40927ec7

Download Submit
memory/2384-28-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-30-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-24-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-25-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-26-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-15-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2384-27-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-29-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-0-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2384-31-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-32-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-33-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-34-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-35-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2384-36-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads