Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 08:41
Static task
static1
Behavioral task
behavioral1
Sample
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
04cc88eaa4c768221e1089a76b7db6e3
-
SHA1
345aa4c1a906c149d2546bdadc881366b1cf5e9f
-
SHA256
66ff22370f9b958f52052b0762a2f34f63b84e19dc251628517cb51f3254b88a
-
SHA512
e6386e860fe856e831e96ab804e49eeddab6710c41eea372b424fd7df5239bde5727b9ba70695e287e8b94ca1869baf5483a307d0ccd3f05a4741a5aaad23984
-
SSDEEP
49152:+UJ6ZNXox4SgJhBsfHJq/nCFT4Mv0Pt97f:+tR4xGnCtvwD
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
wininit.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exewininit.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe -
Processes:
wininit.exesvchost.exe04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
wininit.exesvchost.exepid process 2504 wininit.exe 2624 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exepid process 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exewininit.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Drops file in Windows directory 4 IoCs
Processes:
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exewininit.exedescription ioc process File created \??\c:\windows\wininit.exe 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe File opened for modification \??\c:\windows\RCX10E2.tmp 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exewininit.exesvchost.exepid process 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe 2504 wininit.exe 2504 wininit.exe 2504 wininit.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2504 wininit.exe 2624 svchost.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe 2624 svchost.exe 2504 wininit.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
wininit.exesvchost.exepid process 2504 wininit.exe 2624 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wininit.exepid process 2504 wininit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exedescription pid process target process PID 2004 wrote to memory of 2504 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe wininit.exe PID 2004 wrote to memory of 2504 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe wininit.exe PID 2004 wrote to memory of 2504 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe wininit.exe PID 2004 wrote to memory of 2504 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe wininit.exe PID 2004 wrote to memory of 2624 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe svchost.exe PID 2004 wrote to memory of 2624 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe svchost.exe PID 2004 wrote to memory of 2624 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe svchost.exe PID 2004 wrote to memory of 2624 2004 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 9 IoCs
Processes:
svchost.exe04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exewininit.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04cc88eaa4c768221e1089a76b7db6e3_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\RCX10E2.tmpFilesize
3.1MB
MD5ac514b7f272377ad36f233e0e2c2a08f
SHA179ab34745da9261e0d213b1190d16ab93f7d4802
SHA25656cdc38e50cc6fadd4a8b4a35c3ec1adc956f00d3aeeb1b2decb3990bc3a5010
SHA51224c323d7a199f3ed30531d6d93e0c25c5b6e2dbea84667963853e3fd9028786f647dac3d61b76b2b574016f556320e814e40008776488e6cd47a4dfab1225158
-
C:\Windows\wininit.exeFilesize
3.1MB
MD504cc88eaa4c768221e1089a76b7db6e3
SHA1345aa4c1a906c149d2546bdadc881366b1cf5e9f
SHA25666ff22370f9b958f52052b0762a2f34f63b84e19dc251628517cb51f3254b88a
SHA512e6386e860fe856e831e96ab804e49eeddab6710c41eea372b424fd7df5239bde5727b9ba70695e287e8b94ca1869baf5483a307d0ccd3f05a4741a5aaad23984
-
memory/2004-0-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2004-40-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/2504-42-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/2504-52-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/2504-64-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/2624-43-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/2624-53-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB