Analysis

  • max time kernel
    80s
  • max time network
    90s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 03:21

General

  • Target

    108e9934b04e62f29361fa23c57023a2_JaffaCakes118.exe

  • Size

    240KB

  • MD5

    108e9934b04e62f29361fa23c57023a2

  • SHA1

    63b3ec1d09687a1051403e92f0f146e06e8eb7d5

  • SHA256

    8e7e171f1f84d83de0e174bca33baf72289a7d90645d2079c26238e0dbbf18f7

  • SHA512

    521be4c56a2a0fbde1cc87796bf267f9638fd2f7ef33caad482d1ae1a7a458f9c57e10ed7fe3632f18439c613701376da28fa2e27296107cdc7d0d96256461f9

  • SSDEEP

    6144:lhKKXGaHs5jiGVKkblgCEjocdK4kU5qhxdo:lhq8slTVKslgUqK41wDdo

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\108e9934b04e62f29361fa23c57023a2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\108e9934b04e62f29361fa23c57023a2_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Users\Admin\AppData\Local\Temp\108e9934b04e62f29361fa23c57023a2_JaffaCakes118mgr.exe
          C:\Users\Admin\AppData\Local\Temp\108e9934b04e62f29361fa23c57023a2_JaffaCakes118mgr.exe
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:1028
          • C:\Program Files (x86)\Microsoft\WaterMark.exe
            "C:\Program Files (x86)\Microsoft\WaterMark.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:1012
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\system32\svchost.exe
              5⤵
                PID:4176
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 204
                  6⤵
                  • Program crash
                  PID:3116
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                5⤵
                • Modifies Internet Explorer settings
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4580
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4580 CREDAT:17410 /prefetch:2
                  6⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of SetWindowsHookEx
                  PID:2224
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                5⤵
                • Modifies Internet Explorer settings
                PID:4092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 236
            3⤵
            • Program crash
            PID:1588
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 472
            3⤵
            • Program crash
            PID:856
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 516
            3⤵
            • Program crash
            PID:2360
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1368 -ip 1368
        1⤵
          PID:2772
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4176 -ip 4176
          1⤵
            PID:64
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1368 -ip 1368
            1⤵
              PID:1740
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1368 -ip 1368
              1⤵
                PID:2128

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\108e9934b04e62f29361fa23c57023a2_JaffaCakes118mgr.exe

                Filesize

                60KB

                MD5

                94f2f6ffbba8e7644668b51b39983916

                SHA1

                63357bbdf90101969117983dbc0d4ed0e713c4d7

                SHA256

                ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

                SHA512

                d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

              • C:\Windows\SysWOW64\mgking0.dll

                Filesize

                114KB

                MD5

                21c8f7083a59c407226363950804c4f8

                SHA1

                8a6b1d0942afa365ab4b7cd0e82c13bd9cae2524

                SHA256

                015fc0b2cdaf8c7f2fd3b0ee1a0e03e1c4589ef21c1781a60a8ce90a8e16bde5

                SHA512

                eb7253e85f77cc45c02bfbab25cd0324cc4b59d484bf8807561f69edfc69713330299308aace3ba3671b34bc9c852d42344d5f5c64181184f2f71bd7ced782f8

              • memory/1012-28-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1012-44-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1012-42-0x0000000000070000-0x0000000000071000-memory.dmp

                Filesize

                4KB

              • memory/1012-25-0x0000000000A20000-0x0000000000A21000-memory.dmp

                Filesize

                4KB

              • memory/1012-43-0x0000000077BB2000-0x0000000077BB3000-memory.dmp

                Filesize

                4KB

              • memory/1012-29-0x0000000077BB2000-0x0000000077BB3000-memory.dmp

                Filesize

                4KB

              • memory/1028-17-0x00000000008A0000-0x00000000008A1000-memory.dmp

                Filesize

                4KB

              • memory/1028-16-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1028-9-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1028-8-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1028-7-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1028-6-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1028-5-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1028-10-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1368-41-0x0000000010000000-0x0000000010084000-memory.dmp

                Filesize

                528KB

              • memory/1368-40-0x0000000000400000-0x000000000049E000-memory.dmp

                Filesize

                632KB

              • memory/1368-1-0x0000000000400000-0x000000000049E000-memory.dmp

                Filesize

                632KB

              • memory/1368-39-0x0000000010000000-0x0000000010084000-memory.dmp

                Filesize

                528KB

              • memory/4176-30-0x0000000000B90000-0x0000000000B91000-memory.dmp

                Filesize

                4KB

              • memory/4176-31-0x0000000000B70000-0x0000000000B71000-memory.dmp

                Filesize

                4KB