Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 21:16
Static task
static1
Behavioral task
behavioral1
Sample
0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
0616bd87413ee4f31e8ff45aaf816149
-
SHA1
74f95ddbd7b4c7ebb165ac600a7e0f18c1f9906e
-
SHA256
bfaef5ebd7fa9ea692bbde3010611e3f338b6a119f4b8bd0a60b54dbada7a53e
-
SHA512
63e666d72e25239188b1a9ce51ae45368dda8214cb819e52e5504b70e5a80831a8c3c1db53f87f3ae5b72b45a70a7f238213feba163a604208e3982ee4c4511b
-
SSDEEP
49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG976:ZXRO0hkr2Rxt+ev
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
wininit.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
wininit.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Processes:
wininit.exesvchost.exe0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
wininit.exesvchost.exepid process 4604 wininit.exe 3780 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
svchost.exe0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exewininit.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe -
Drops file in Windows directory 4 IoCs
Processes:
0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exewininit.exedescription ioc process File created \??\c:\windows\wininit.exe 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe File opened for modification \??\c:\windows\RCX3FF7.tmp 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exewininit.exesvchost.exepid process 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe 4604 wininit.exe 4604 wininit.exe 4604 wininit.exe 4604 wininit.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 4604 wininit.exe 3780 svchost.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 3780 svchost.exe 3780 svchost.exe 4604 wininit.exe 4604 wininit.exe 4604 wininit.exe 4604 wininit.exe 3780 svchost.exe 3780 svchost.exe 3780 svchost.exe 3780 svchost.exe 4604 wininit.exe 4604 wininit.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 3780 svchost.exe 3780 svchost.exe 4604 wininit.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 4604 wininit.exe 3780 svchost.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 4604 wininit.exe 3780 svchost.exe 4604 wininit.exe 3780 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
wininit.exesvchost.exepid process 4604 wininit.exe 3780 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wininit.exepid process 4604 wininit.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exedescription pid process target process PID 1004 wrote to memory of 4604 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe wininit.exe PID 1004 wrote to memory of 4604 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe wininit.exe PID 1004 wrote to memory of 4604 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe wininit.exe PID 1004 wrote to memory of 3780 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe svchost.exe PID 1004 wrote to memory of 3780 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe svchost.exe PID 1004 wrote to memory of 3780 1004 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 9 IoCs
Processes:
0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exewininit.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0616bd87413ee4f31e8ff45aaf816149_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1004 -
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4604 -
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:3780
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\RCX3FF7.tmpFilesize
3.1MB
MD5cfa8e4c2a8be38cd7eb3f12344ed771f
SHA113bef75ca1f550db86820d31f4ff234108b75b3c
SHA256f98c9a40b559438b3eb63c750d8f345d88233dfec6a399928a66a20adf9d8e09
SHA5127349bec73c36821193bdf38fe3fa5c5ca8933a78ea8440816594af74f0c39638e905e6da327e08e4a29a53d0f437d645d9316f1c418dde01bd166a38ef5cc1ef
-
C:\Windows\wininit.exeFilesize
3.1MB
MD50616bd87413ee4f31e8ff45aaf816149
SHA174f95ddbd7b4c7ebb165ac600a7e0f18c1f9906e
SHA256bfaef5ebd7fa9ea692bbde3010611e3f338b6a119f4b8bd0a60b54dbada7a53e
SHA51263e666d72e25239188b1a9ce51ae45368dda8214cb819e52e5504b70e5a80831a8c3c1db53f87f3ae5b72b45a70a7f238213feba163a604208e3982ee4c4511b
-
memory/1004-40-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/1004-0-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/3780-48-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3780-54-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3780-39-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/3780-43-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/3780-46-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/4604-42-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/4604-47-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/4604-53-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/4604-38-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/4604-57-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB
-
memory/4604-65-0x0000000000400000-0x00000000007B5000-memory.dmpFilesize
3.7MB