Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 15:01
Static task
static1
Behavioral task
behavioral1
Sample
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
05749f070af05abf81f45e602fcdbef4
-
SHA1
5e3f92fa742f32a9e444ab9f02cf027e67bca5d4
-
SHA256
cebc864d02d959fcde4378b8d9c34d0ec140f1347b6323977a36c7d4f4da42fe
-
SHA512
62048bdb51e6009de1c73be5f8763238245ebbd73348a1641c95dd3ed58a0f627625e7fb9542577c604e2a5444b5773344244418ad165763af768a9220ed6242
-
SSDEEP
49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97U:ZXRO0hkr2Rxt+e9
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
wininit.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
wininit.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Processes:
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exewininit.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
wininit.exesvchost.exepid process 3068 wininit.exe 2512 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exepid process 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exewininit.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Drops file in Windows directory 4 IoCs
Processes:
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exewininit.exedescription ioc process File created \??\c:\windows\wininit.exe 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe File opened for modification \??\c:\windows\RCX28B6.tmp 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exewininit.exesvchost.exepid process 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe 3068 wininit.exe 2512 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
wininit.exesvchost.exepid process 3068 wininit.exe 2512 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wininit.exepid process 3068 wininit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exedescription pid process target process PID 2836 wrote to memory of 3068 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe wininit.exe PID 2836 wrote to memory of 3068 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe wininit.exe PID 2836 wrote to memory of 3068 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe wininit.exe PID 2836 wrote to memory of 3068 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe wininit.exe PID 2836 wrote to memory of 2512 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe svchost.exe PID 2836 wrote to memory of 2512 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe svchost.exe PID 2836 wrote to memory of 2512 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe svchost.exe PID 2836 wrote to memory of 2512 2836 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 9 IoCs
Processes:
svchost.exe05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exewininit.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05749f070af05abf81f45e602fcdbef4_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\RCX28B6.tmpFilesize
3.1MB
MD5d246c44f8b8f4ad23b849bd68df1d8ba
SHA125013faddc2c160f32a9fae5c8118a9254b8c27a
SHA2564a57bc3dbaf040162b009a324a0718eb06a8fc7365aa86fb6b2d9118b584d9fe
SHA51299f3e96c14fc3be41cf9ac822d5cb6192fe3cc0e4ae26f95d9826817cba9796cb0a699abee73601bcbfbc6545734212ff294ddbae1a178a50a156511164c04e7
-
C:\Windows\wininit.exeFilesize
3.1MB
MD505749f070af05abf81f45e602fcdbef4
SHA15e3f92fa742f32a9e444ab9f02cf027e67bca5d4
SHA256cebc864d02d959fcde4378b8d9c34d0ec140f1347b6323977a36c7d4f4da42fe
SHA51262048bdb51e6009de1c73be5f8763238245ebbd73348a1641c95dd3ed58a0f627625e7fb9542577c604e2a5444b5773344244418ad165763af768a9220ed6242
-
memory/2512-43-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/2512-53-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/2836-0-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2836-39-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3068-42-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3068-52-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3068-64-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB