Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
30/05/2024, 10:12
General
- Target 83dd66839df977f5e2991ba9c2263c6d_JaffaCakes118.exe
- Size 183KB
- Sample240530-l8tmcseh52
- SHA256 e114e6792f3cbef8396704e9aa5a95d5b391ffe515a4c587184b67d5408e8c9a
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies firewall policy service 2 TTPs 3 IoCs
- Modifies security service 2 TTPs 3 IoCs
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- Drops startup file 2 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83dd66839df977f5e2991ba9c2263c6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\83dd66839df977f5e2991ba9c2263c6d_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
memory/1648-0-0x0000000015190000-0x00000000151CD000-memory.dmp
memory/1648-1-0x0000000015190000-0x00000000151CD000-memory.dmp
memory/1648-5-0x0000000015190000-0x00000000151CD000-memory.dmp
memory/1648-4-0x00000000151B5000-0x00000000151CC000-memory.dmp
memory/1648-3-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/1648-2-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/1648-9-0x0000000015190000-0x00000000151CD000-memory.dmp
memory/1648-11-0x00000000151B5000-0x00000000151CC000-memory.dmp