Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
0c056e6a7753178d956c2a3be769bad0
-
SHA1
c228b8c698f6332208963a0a5aa1e8f5e0adf962
-
SHA256
eaabb4ce1934ce5cb456275679f82a727f3ffa5318e83216379ca6c1a0134b51
-
SHA512
869a8e746b9291545a2ca2bb1f81c75cc9ef64ff6d82c6f66e4f5f0a6e060e8f4d5e19327ea8e9fc9979eded3348ecb9c854c2ef149252c550d454230e1c9d0b
-
SSDEEP
49152:+UJ6ZNXox4SgJhBsfHJq/nCFT4Mv0Pt97B:+tR4xGnCtvwV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2628 wininit.exe 2148 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created \??\c:\windows\wininit.exe 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe File opened for modification \??\c:\windows\RCXE62.tmp 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 2628 wininit.exe 2628 wininit.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe 2628 wininit.exe 2148 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2628 wininit.exe 2148 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2628 wininit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2628 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 28 PID 2232 wrote to memory of 2628 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 28 PID 2232 wrote to memory of 2628 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 28 PID 2232 wrote to memory of 2628 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 28 PID 2232 wrote to memory of 2148 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 29 PID 2232 wrote to memory of 2148 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 29 PID 2232 wrote to memory of 2148 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 29 PID 2232 wrote to memory of 2148 2232 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe 29 -
System policy modification 1 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c056e6a7753178d956c2a3be769bad0_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2232 -
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2628
-
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5ac514b7f272377ad36f233e0e2c2a08f
SHA179ab34745da9261e0d213b1190d16ab93f7d4802
SHA25656cdc38e50cc6fadd4a8b4a35c3ec1adc956f00d3aeeb1b2decb3990bc3a5010
SHA51224c323d7a199f3ed30531d6d93e0c25c5b6e2dbea84667963853e3fd9028786f647dac3d61b76b2b574016f556320e814e40008776488e6cd47a4dfab1225158
-
Filesize
3.1MB
MD50c056e6a7753178d956c2a3be769bad0
SHA1c228b8c698f6332208963a0a5aa1e8f5e0adf962
SHA256eaabb4ce1934ce5cb456275679f82a727f3ffa5318e83216379ca6c1a0134b51
SHA512869a8e746b9291545a2ca2bb1f81c75cc9ef64ff6d82c6f66e4f5f0a6e060e8f4d5e19327ea8e9fc9979eded3348ecb9c854c2ef149252c550d454230e1c9d0b