79a0f7aaaeb3b9192b3b17ed80cb459fdec5f59146428807805d79bf1856cb0b

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe
Size

28KB
MD5

eef3539a7e4b9c4c80fcfe1db34ce192
SHA1

0e8de6d2f09aa09c34b1b1e252bf15c9c75663f9
SHA256

79a0f7aaaeb3b9192b3b17ed80cb459fdec5f59146428807805d79bf1856cb0b
SHA512

737f8c4eb382e346c12efacf050dbf3ae417ed7e7d9b91337a8068934b5ed37fa44ce6ad8273b1868534cb1f9cc1379103629f6905f65e6166d98e4cb8a38481
SSDEEP

768:j7J+XtI2ZjLPl943WV+czLMTPMLGy9EFEcp:p+9blC6j4TELGUEFEcp

Score

10^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Windows\\Microst.exe,"	eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2380-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2380-4-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microst.exe	eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe
File opened for modification	C:\Windows\Microst.exe	eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe
File created	C:\Windows\dabc.dll	eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe
File opened for modification	C:\Windows\dabc.dll	eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eef3539a7e4b9c4c80fcfe1db34ce192_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2380-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads