Analysis
- max time kernel
141s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
25/06/2024, 12:30
General
- Target 0e14483e34d2afc48dd917d01e03b810_JaffaCakes118.exe
- Size 141KB
- Sample240625-ppkrwssgpk
- SHA256 d6ea906ce6eaa974c11dbad9b237f69772ad8bf992ed5ac33b54f0e40f0ebee2
Malware Config
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 1 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in Windows directory 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 63 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0e14483e34d2afc48dd917d01e03b810_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e14483e34d2afc48dd917d01e03b810_JaffaCakes118.exe"2⤵
- UAC bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
~TM3D67.tmp
memory/4856-3-0x00000000030D0000-0x0000000004100000-memory.dmp
memory/4856-30-0x0000000000401000-0x0000000000418000-memory.dmp
memory/4856-13-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4856-9-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4856-8-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4856-0-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4856-10-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4856-14-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4856-29-0x0000000000418000-0x0000000000424000-memory.dmp
memory/4856-28-0x0000000000401000-0x0000000000404000-memory.dmp
memory/4856-21-0x00000000030D0000-0x0000000004100000-memory.dmp
memory/4856-19-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4856-7-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4856-23-0x00000000030D0000-0x0000000004100000-memory.dmp