Analysis
- max time kernel
140s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
27/04/2024, 01:48
General
- Target 022392e5a18655eb36d27f34a0bf3366_JaffaCakes118.exe
- Size 1.0MB
- Sample240427-b79bbage89
- SHA256 413d437af5e6401d2585907578e5f69b14f34172e1f0a734aebeb85d76038669
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\022392e5a18655eb36d27f34a0bf3366_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\022392e5a18655eb36d27f34a0bf3366_JaffaCakes118.exe"1⤵
- UAC bypass
- Identifies Wine through registry keys
- Installs/modifies Browser Helper Object
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/2816-0-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-1-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-23-0x0000000004810000-0x0000000004811000-memory.dmp
memory/2816-22-0x0000000004830000-0x0000000004831000-memory.dmp
memory/2816-21-0x00000000047B0000-0x00000000047B1000-memory.dmp
memory/2816-20-0x00000000048C0000-0x00000000048C1000-memory.dmp
memory/2816-19-0x00000000046A0000-0x00000000046A1000-memory.dmp
memory/2816-17-0x0000000004A00000-0x0000000004A02000-memory.dmp
memory/2816-18-0x0000000004840000-0x0000000004841000-memory.dmp
memory/2816-16-0x0000000004890000-0x0000000004891000-memory.dmp
memory/2816-15-0x0000000004800000-0x0000000004801000-memory.dmp
memory/2816-14-0x0000000004860000-0x0000000004861000-memory.dmp
memory/2816-13-0x0000000004740000-0x0000000004741000-memory.dmp
memory/2816-12-0x00000000048B0000-0x00000000048B1000-memory.dmp
memory/2816-11-0x0000000004850000-0x0000000004851000-memory.dmp
memory/2816-10-0x00000000047D0000-0x00000000047D1000-memory.dmp
memory/2816-9-0x0000000004750000-0x0000000004751000-memory.dmp
memory/2816-8-0x0000000004790000-0x0000000004791000-memory.dmp
memory/2816-7-0x00000000046F0000-0x00000000046F1000-memory.dmp
memory/2816-6-0x0000000004720000-0x0000000004721000-memory.dmp
memory/2816-5-0x00000000046E0000-0x00000000046E1000-memory.dmp
memory/2816-4-0x0000000004700000-0x0000000004702000-memory.dmp
memory/2816-3-0x0000000004710000-0x0000000004711000-memory.dmp
memory/2816-2-0x0000000004730000-0x0000000004731000-memory.dmp
memory/2816-24-0x00000000047A0000-0x00000000047A1000-memory.dmp
memory/2816-25-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-26-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-27-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-28-0x0000000004870000-0x0000000004871000-memory.dmp
memory/2816-31-0x00000000047E0000-0x00000000047E1000-memory.dmp
memory/2816-30-0x00000000047F0000-0x00000000047F1000-memory.dmp
memory/2816-29-0x0000000004880000-0x0000000004881000-memory.dmp
memory/2816-32-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-33-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-34-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-35-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-36-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-37-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-38-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-39-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-40-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-41-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-42-0x0000000000400000-0x000000000062D000-memory.dmp
memory/2816-43-0x0000000000400000-0x000000000062D000-memory.dmp