Analysis

  • max time kernel
    66s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    12-04-2024 01:07

General

  • Target

    eec53049ea776e7110f52d3022a32af4_JaffaCakes118.exe

  • Size

    251KB

  • MD5

    eec53049ea776e7110f52d3022a32af4

  • SHA1

    bf2f55ae94eee0b44957e07406e719f4337778c6

  • SHA256

    6cbb653a59a6331889e25db12e52502526f32f85bb49a38bf69dd7f507e66212

  • SHA512

    38a8b1c722c7c6ddb8476c27cac8a59b09f55cf689fa02132b5f3afbf7c4355056d8702385347857b74b348ce096f11942757279ec208d81a07ccc242b109a2f

  • SSDEEP

    6144:7WEc4VrT48FPV1Avvt+j+P2xIe9jsLexZPkLDAr+:7WirT4yPV1Avvt+6KjsLeTcLC+

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\eec53049ea776e7110f52d3022a32af4_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\eec53049ea776e7110f52d3022a32af4_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Users\Admin\AppData\Local\3de3cb1f\X
        *0*32*c0dcf0c0*69.64.52.10:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        PID:2516
  • C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    1⤵
      PID:2468
    • C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      1⤵
        PID:2456

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\3de3cb1f\X
        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

      • \Windows\System32\consrv.dll
        Filesize

        29KB

        MD5

        1149c1bd71248a9d170e4568fb08df30

        SHA1

        6f77f183d65709901f476c5d6eebaed060a495f9

        SHA256

        c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

        SHA512

        9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
        Filesize

        2KB

        MD5

        76e8adff4df8b9d23d9a4797879370f3

        SHA1

        96d0f6c2222ab2c011043aeb87a840267f78e412

        SHA256

        b49ff9a3dab363005727a52d5bd64904dab0e94b07b33607599f9839f7875362

        SHA512

        f64ab2cdbe898ec0334192c03f9921bf358da6edc23278db16bbb186ef6f9cf737fb4d6dec5e947c621e80d3e263ab7ed55d984a9f6f86a8b52f0b2c1bc4572b

      • memory/336-16-0x0000000000820000-0x0000000000821000-memory.dmp
        Filesize

        4KB

      • memory/336-21-0x0000000000A40000-0x0000000000A4B000-memory.dmp
        Filesize

        44KB

      • memory/336-20-0x0000000000A40000-0x0000000000A4B000-memory.dmp
        Filesize

        44KB

      • memory/1304-12-0x0000000002A70000-0x0000000002A72000-memory.dmp
        Filesize

        8KB

      • memory/1304-33-0x0000000002AA0000-0x0000000002AAB000-memory.dmp
        Filesize

        44KB

      • memory/1304-3-0x0000000002A80000-0x0000000002A86000-memory.dmp
        Filesize

        24KB

      • memory/1304-7-0x0000000002A80000-0x0000000002A86000-memory.dmp
        Filesize

        24KB

      • memory/1304-11-0x0000000002A80000-0x0000000002A86000-memory.dmp
        Filesize

        24KB

      • memory/1304-28-0x0000000002AA0000-0x0000000002AAB000-memory.dmp
        Filesize

        44KB

      • memory/1304-30-0x0000000002A80000-0x0000000002A88000-memory.dmp
        Filesize

        32KB

      • memory/1304-39-0x0000000002AB0000-0x0000000002ABB000-memory.dmp
        Filesize

        44KB

      • memory/1304-37-0x0000000002AA0000-0x0000000002AAB000-memory.dmp
        Filesize

        44KB

      • memory/1304-38-0x0000000002AB0000-0x0000000002ABB000-memory.dmp
        Filesize

        44KB

      • memory/2840-1-0x0000000030670000-0x00000000306BE000-memory.dmp
        Filesize

        312KB

      • memory/2840-40-0x0000000030670000-0x00000000306BE000-memory.dmp
        Filesize

        312KB

      • memory/2840-41-0x00000000002D0000-0x00000000003D0000-memory.dmp
        Filesize

        1024KB

      • memory/2840-43-0x0000000030670000-0x00000000306BE000-memory.dmp
        Filesize

        312KB

      • memory/2840-2-0x00000000002D0000-0x00000000003D0000-memory.dmp
        Filesize

        1024KB