Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
26/04/2024, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe
- Size 3.1MB
- Sample240426-hmsw6abb85
- SHA256 e13235a2a00da8acedb17e9838f6299ded817099f29e54073ccd4c8b5b3e1012
- MD5 0038ef3ee742be4feb22696899c43a81
- SHA1 cdf541093b9219e93d1b56a04b89aaa0f816701c
- SHA512 3e7730b9babdef44c6b48459c5f8dec5a2cbb8361c90fdd44261e51eb6e48a829448d54b2b83a23aa1f900c414951106789657135c730ed6bdb5ac6b167b1734
- SSDEEP 49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97v:ZXRO0hkr2Rxt+e6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe - Executes dropped EXE 2 IoCs
pid Process 4688 wininit.exe 2320 svchost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\wininit.exe wininit.exe File created \??\c:\windows\wininit.exe 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe File opened for modification \??\c:\windows\RCX372D.tmp 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 4688 wininit.exe 4688 wininit.exe 4688 wininit.exe 4688 wininit.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 2320 svchost.exe 2320 svchost.exe 4688 wininit.exe 4688 wininit.exe 4688 wininit.exe 2320 svchost.exe 4688 wininit.exe 2320 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4688 wininit.exe 2320 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4688 wininit.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4688 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 84 PID 5052 wrote to memory of 4688 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 84 PID 5052 wrote to memory of 4688 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 84 PID 5052 wrote to memory of 2320 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 86 PID 5052 wrote to memory of 2320 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 86 PID 5052 wrote to memory of 2320 5052 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe 86 - System policy modification 1 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0038ef3ee742be4feb22696899c43a81_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5052 -
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4688
-
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\RCX372D.tmp
- Size 3.1MB
- SHA256 f98c9a40b559438b3eb63c750d8f345d88233dfec6a399928a66a20adf9d8e09
- MD5 cfa8e4c2a8be38cd7eb3f12344ed771f
- SHA1 13bef75ca1f550db86820d31f4ff234108b75b3c
- SHA512 7349bec73c36821193bdf38fe3fa5c5ca8933a78ea8440816594af74f0c39638e905e6da327e08e4a29a53d0f437d645d9316f1c418dde01bd166a38ef5cc1ef
- SSDEEP 49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97s:ZXRO0hkr2Rxt+eh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\wininit.exe
- Size 3.1MB
- SHA256 e13235a2a00da8acedb17e9838f6299ded817099f29e54073ccd4c8b5b3e1012
- MD5 0038ef3ee742be4feb22696899c43a81
- SHA1 cdf541093b9219e93d1b56a04b89aaa0f816701c
- SHA512 3e7730b9babdef44c6b48459c5f8dec5a2cbb8361c90fdd44261e51eb6e48a829448d54b2b83a23aa1f900c414951106789657135c730ed6bdb5ac6b167b1734
- SSDEEP 49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97v:ZXRO0hkr2Rxt+e6
- MD5 SHA1 SHA512 SSDEEP