Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 01:53

General

  • Target

    105471cd9d4eb09ec42bac2b0290f889_JaffaCakes118.dll

  • Size

    532KB

  • MD5

    105471cd9d4eb09ec42bac2b0290f889

  • SHA1

    eb25bc1ab8a97b3a2b4272938a009fef7de51c05

  • SHA256

    7e08634dac987ef53fb2fc692f6788221bde14b3b48cf28650539b0c24c89c41

  • SHA512

    32be63e092fc98dd035e385527b084ad49ddc1847e6208ceda8db4bcd19e4bee9b2b781b96c60ca85ff5ca50e14a8dcd7a9da86f654ebf3c56ce5cc4152c8658

  • SSDEEP

    6144:0ZLT3A5Dp0HvFIc5vBlcQGSgS62iiiiiSySYSGS+8c8c8AAANA/AA0fMGrgPhclc:0ZL7A5l0711g8onrOcWAqVvv/JYeiJI

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:332
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:384
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:476
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:592
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    4⤵
                      PID:2212
                    • C:\Windows\system32\wbem\wmiprvse.exe
                      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                      4⤵
                        PID:1128
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:672
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:736
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:804
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1160
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:832
                                • C:\Windows\system32\wbem\WMIADAP.EXE
                                  wmiadap.exe /F /T /R
                                  4⤵
                                    PID:1608
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService
                                  3⤵
                                    PID:964
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k NetworkService
                                    3⤵
                                      PID:236
                                    • C:\Windows\System32\spoolsv.exe
                                      C:\Windows\System32\spoolsv.exe
                                      3⤵
                                        PID:988
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                        3⤵
                                          PID:1060
                                        • C:\Windows\system32\taskhost.exe
                                          "taskhost.exe"
                                          3⤵
                                            PID:1096
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                            3⤵
                                              PID:3008
                                            • C:\Windows\system32\sppsvc.exe
                                              C:\Windows\system32\sppsvc.exe
                                              3⤵
                                                PID:1304
                                            • C:\Windows\system32\lsass.exe
                                              C:\Windows\system32\lsass.exe
                                              2⤵
                                                PID:488
                                              • C:\Windows\system32\lsm.exe
                                                C:\Windows\system32\lsm.exe
                                                2⤵
                                                  PID:496
                                              • C:\Windows\system32\csrss.exe
                                                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                1⤵
                                                  PID:392
                                                • C:\Windows\system32\winlogon.exe
                                                  winlogon.exe
                                                  1⤵
                                                    PID:432
                                                  • C:\Windows\Explorer.EXE
                                                    C:\Windows\Explorer.EXE
                                                    1⤵
                                                      PID:1204
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe C:\Users\Admin\AppData\Local\Temp\105471cd9d4eb09ec42bac2b0290f889_JaffaCakes118.dll,#1
                                                        2⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2244
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe C:\Users\Admin\AppData\Local\Temp\105471cd9d4eb09ec42bac2b0290f889_JaffaCakes118.dll,#1
                                                          3⤵
                                                          • Loads dropped DLL
                                                          • Drops file in System32 directory
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2824
                                                          • C:\Windows\SysWOW64\rundll32mgr.exe
                                                            C:\Windows\SysWOW64\rundll32mgr.exe
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of UnmapMainImage
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2104
                                                            • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                              "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of UnmapMainImage
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2872
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                C:\Windows\system32\svchost.exe
                                                                6⤵
                                                                • Modifies WinLogon for persistence
                                                                • Drops file in System32 directory
                                                                • Drops file in Program Files directory
                                                                PID:3032
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                C:\Windows\system32\svchost.exe
                                                                6⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2304
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 228
                                                            4⤵
                                                            • Program crash
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2092

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

                                                      Filesize

                                                      133KB

                                                      MD5

                                                      e373c5ef26d2c5f00e9edb4a222f2479

                                                      SHA1

                                                      0301cb41c5f06e71268a338ba9796017137e9739

                                                      SHA256

                                                      30bc44fc1cc5328a0e6141f3bf6322aa604854de32ff5e17a7d511cb736aa0f2

                                                      SHA512

                                                      a08617aa87ee6daa98c4d70a3a8dd3ef611098a3d4e5fcd08ce95b58a3313ca7d180fab0434f4a34f05f2ba40c6c610ecbf84a9f1ab39e22f46e0e5d327d91a7

                                                    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

                                                      Filesize

                                                      129KB

                                                      MD5

                                                      e5280b9b3d8e58f710b2fb9eb1a38c76

                                                      SHA1

                                                      8c2cc85b191c990f7c7cd48fed4801a621bc4b6f

                                                      SHA256

                                                      154a6203ec9bb095d031b03323195af43828abbb6a4d3e60114318c83b1f9873

                                                      SHA512

                                                      320e626ff7c1340a9d2997672034da636f73364ed9b1df113d6103cbc8ad0fbd6b24f39b0c329221c19af77a718d479cf7798395afb3e6bbe3285a8af7268433

                                                    • \Windows\SysWOW64\rundll32mgr.exe

                                                      Filesize

                                                      60KB

                                                      MD5

                                                      c27dc77f49f2be740e3bf1b64387882e

                                                      SHA1

                                                      82f4ce73d55f46e1ecccbf406f9420364a82872f

                                                      SHA256

                                                      a0bac67a54681dcc7ec8204eb959a540356568b06b1a03cec6ec42ed6e9f1715

                                                      SHA512

                                                      14880de329428973dbcc2c726fee09dcc3666ab7aab69e32864577e01216ca8a58ac901d261ad1a84e0d3d6926c328b53d92beb695cc3dd1d6f453a5d853314e

                                                    • memory/2104-11-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2104-10-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2104-17-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2104-21-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2104-18-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2104-16-0x0000000000140000-0x0000000000141000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2104-15-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2104-12-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2304-88-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2304-72-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2304-355-0x0000000077460000-0x0000000077461000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2304-89-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2304-90-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2304-91-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2304-87-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2304-81-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2304-85-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2824-3-0x0000000000140000-0x0000000000161000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2824-14-0x0000000000140000-0x0000000000161000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2824-0-0x0000000010000000-0x0000000010086000-memory.dmp

                                                      Filesize

                                                      536KB

                                                    • memory/2872-86-0x000000007745F000-0x0000000077460000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2872-620-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2872-41-0x000000007745F000-0x0000000077460000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2872-38-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2872-40-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2872-70-0x0000000000060000-0x0000000000061000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2872-617-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2872-42-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/3032-53-0x0000000000080000-0x0000000000081000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3032-52-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3032-43-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/3032-45-0x0000000000080000-0x0000000000081000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3032-54-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/3032-59-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/3032-851-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/3032-65-0x0000000000090000-0x0000000000091000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3032-66-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB