Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    25-06-2024 20:08

General

  • Target

    0f5dd209d4b48ac36c9d100d4e9c4bb1_JaffaCakes118.dll

  • Size

    189KB

  • MD5

    0f5dd209d4b48ac36c9d100d4e9c4bb1

  • SHA1

    95cffc889960b5d4db51e27833cb650c8c7ac933

  • SHA256

    73f0f24f6324ec5076968e1a02c8c71a8b7653272cb608df94675176333728fc

  • SHA512

    39738069333286369c2eedfc3713948c58d5c815f178ff50048154bf70766cd13a4ecfd47b4dd3963cd1e8bcccab04b8f39fd64cb82975904f0b5d61951e3ce8

  • SSDEEP

    3072:Rt5Gf4bwPdy5XMxJZID/RlovuTyB9yyo7GcXABr:RCIpJJTEV

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5dd209d4b48ac36c9d100d4e9c4bb1_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5dd209d4b48ac36c9d100d4e9c4bb1_JaffaCakes118.dll,#1
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:804
      • C:\Users\Admin\AppData\Local\Temp\fxvVpP6P
        "fxvVpP6P"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2660
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks BIOS information in registry
          • Drops startup file
          • Impair Defenses: Safe Mode Boot
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2904
        • C:\Users\Admin\AppData\Local\Temp\ytdcbxnkwcghdkjt.exe
          "C:\Users\Admin\AppData\Local\Temp\ytdcbxnkwcghdkjt.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2892
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 232
        3⤵
        • Program crash
        PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\fxvVpP6P

    Filesize

    96KB

    MD5

    74f37fe4cd2c65109465b9998183a657

    SHA1

    9419ff643ebd890e108c2732a40f9b3628b35a71

    SHA256

    4e84e2831364f0a0b9c7d552e58b9706d0de6fae139942207af33f515dcae40b

    SHA512

    95651b579b497f8a3f4b0eb42f90bd8a722a50b38e3b6c22133ae2390e68bad21d74f7fdc4a45fc43c8aa798c5775e87bf6cb20a6e1ed9c7e80ecb9b302b4a81

  • memory/804-2-0x0000000010000000-0x0000000010034000-memory.dmp

    Filesize

    208KB

  • memory/804-3-0x0000000010000000-0x0000000010034000-memory.dmp

    Filesize

    208KB

  • memory/804-1-0x0000000010000000-0x0000000010034000-memory.dmp

    Filesize

    208KB

  • memory/804-0-0x0000000010000000-0x0000000010034000-memory.dmp

    Filesize

    208KB

  • memory/804-6-0x0000000000130000-0x000000000016B000-memory.dmp

    Filesize

    236KB

  • memory/2640-96-0x0000000002A80000-0x0000000002ABB000-memory.dmp

    Filesize

    236KB

  • memory/2640-87-0x0000000000400000-0x000000000043A1A8-memory.dmp

    Filesize

    232KB

  • memory/2640-15-0x0000000000400000-0x000000000043A1A8-memory.dmp

    Filesize

    232KB

  • memory/2640-18-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2640-19-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2640-27-0x0000000000400000-0x000000000043A1A8-memory.dmp

    Filesize

    232KB

  • memory/2640-20-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2640-48-0x000000007717F000-0x0000000077180000-memory.dmp

    Filesize

    4KB

  • memory/2640-82-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2640-88-0x0000000002900000-0x000000000293B000-memory.dmp

    Filesize

    236KB

  • memory/2640-40-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2640-14-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2640-67-0x0000000077180000-0x0000000077181000-memory.dmp

    Filesize

    4KB

  • memory/2640-95-0x0000000002A80000-0x0000000002ABB000-memory.dmp

    Filesize

    236KB

  • memory/2640-13-0x0000000000400000-0x000000000043A1A8-memory.dmp

    Filesize

    232KB

  • memory/2640-47-0x0000000077180000-0x0000000077181000-memory.dmp

    Filesize

    4KB

  • memory/2660-23-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2660-33-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2660-32-0x00000000000B0000-0x00000000000B1000-memory.dmp

    Filesize

    4KB

  • memory/2660-34-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2660-36-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2660-35-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2660-37-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2660-28-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2660-21-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2892-102-0x0000000000400000-0x000000000043A1A8-memory.dmp

    Filesize

    232KB

  • memory/2892-99-0x0000000000400000-0x000000000043A1A8-memory.dmp

    Filesize

    232KB

  • memory/2904-41-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-69-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-65-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-59-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-58-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-49-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-104-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-105-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-106-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-107-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-108-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-109-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-110-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-111-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2904-112-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB