Analysis
-
max time kernel
150s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 18:55
Static task
static1
Behavioral task
behavioral1
Sample
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
05db9d80663ab7f4a90e8cc6ce70ca34
-
SHA1
384ab2f093aad344b20cb57ea8dcde8a4894d6be
-
SHA256
d8750ac90a1c1ac124977c1f1ee9bb890357e589a3a748ba8b281abf9f6c0df7
-
SHA512
b48662ad33c2fa5f70e7c5276460c3cc85627b57e81e5523ae5b17779baf795fef9883c2ef933707dbd96f285a8096e85e13224e21c40646460ff9f12be5b6d3
-
SSDEEP
49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97+:ZXRO0hkr2Rxt+eD
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
wininit.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
wininit.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Processes:
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exewininit.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe -
Executes dropped EXE 2 IoCs
Processes:
wininit.exesvchost.exepid process 1140 wininit.exe 3220 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
svchost.exe05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exewininit.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe -
Drops file in Windows directory 4 IoCs
Processes:
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exewininit.exedescription ioc process File opened for modification \??\c:\windows\wininit.exe 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe File opened for modification \??\c:\windows\RCX395F.tmp 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe File created \??\c:\windows\wininit.exe 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exewininit.exesvchost.exepid process 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe 1140 wininit.exe 1140 wininit.exe 1140 wininit.exe 1140 wininit.exe 1140 wininit.exe 1140 wininit.exe 3220 svchost.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 3220 svchost.exe 3220 svchost.exe 1140 wininit.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 1140 wininit.exe 3220 svchost.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 1140 wininit.exe 3220 svchost.exe 3220 svchost.exe 3220 svchost.exe 1140 wininit.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe 1140 wininit.exe 3220 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
wininit.exesvchost.exepid process 1140 wininit.exe 3220 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wininit.exepid process 1140 wininit.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exedescription pid process target process PID 1124 wrote to memory of 1140 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe wininit.exe PID 1124 wrote to memory of 1140 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe wininit.exe PID 1124 wrote to memory of 1140 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe wininit.exe PID 1124 wrote to memory of 3220 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe svchost.exe PID 1124 wrote to memory of 3220 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe svchost.exe PID 1124 wrote to memory of 3220 1124 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 9 IoCs
Processes:
05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exewininit.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05db9d80663ab7f4a90e8cc6ce70ca34_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1124 -
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1140 -
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:3220
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\RCX395F.tmpFilesize
3.1MB
MD5cfa8e4c2a8be38cd7eb3f12344ed771f
SHA113bef75ca1f550db86820d31f4ff234108b75b3c
SHA256f98c9a40b559438b3eb63c750d8f345d88233dfec6a399928a66a20adf9d8e09
SHA5127349bec73c36821193bdf38fe3fa5c5ca8933a78ea8440816594af74f0c39638e905e6da327e08e4a29a53d0f437d645d9316f1c418dde01bd166a38ef5cc1ef
-
C:\Windows\wininit.exeFilesize
3.1MB
MD505db9d80663ab7f4a90e8cc6ce70ca34
SHA1384ab2f093aad344b20cb57ea8dcde8a4894d6be
SHA256d8750ac90a1c1ac124977c1f1ee9bb890357e589a3a748ba8b281abf9f6c0df7
SHA512b48662ad33c2fa5f70e7c5276460c3cc85627b57e81e5523ae5b17779baf795fef9883c2ef933707dbd96f285a8096e85e13224e21c40646460ff9f12be5b6d3
-
memory/1124-40-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/1124-0-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/1140-42-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/1140-35-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/1140-46-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/1140-54-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/1140-66-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3220-39-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/3220-43-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3220-47-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/3220-55-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB