Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 04:17

General

  • Target

    10b145cfb95a3ba1a16460cbae99e607_JaffaCakes118.exe

  • Size

    148KB

  • MD5

    10b145cfb95a3ba1a16460cbae99e607

  • SHA1

    fe5bdb1ca76fb0a29b72a15856f356ddbe5fff9f

  • SHA256

    280b9d8bb4ec80336b10766fff7ab363fcde1524963910a45d95d8ec46183ede

  • SHA512

    12309ee46b8fc8877779da60d721cda25d7e8bafa80cccb5e9a8d489acaa60b407395ea7be84750997106ed8572859ccb632f529ec64ca8a266a3936a80d9f21

  • SSDEEP

    3072:ZwH1uIIPhvpE6cXjA8iVUAWGaqqqBSpXuWMfujoMITjWR:O/EFpkXsDePGaqqqBmMfujPB

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10b145cfb95a3ba1a16460cbae99e607_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\10b145cfb95a3ba1a16460cbae99e607_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\10b145cfb95a3ba1a16460cbae99e607_JaffaCakes118mgr.exe
      C:\Users\Admin\AppData\Local\Temp\10b145cfb95a3ba1a16460cbae99e607_JaffaCakes118mgr.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2216
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2980
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Checks BIOS information in registry
        • Drops startup file
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2812
      • C:\Users\Admin\AppData\Local\Temp\hoevvlbyvucsqxbu.exe
        "C:\Users\Admin\AppData\Local\Temp\hoevvlbyvucsqxbu.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\win.ini

    Filesize

    766B

    MD5

    a48a1f91793fc0a25cbe407a0d61a38a

    SHA1

    27f2a8f391b79e579d96f74186a0bc786dace7c7

    SHA256

    2fe43948764da6556d01929f08620ba06f38f858f2cd9bb53cb289c6c9c04be8

    SHA512

    5f55e6408515e5c1d767c0f07154bf6be0f855f29b3d1ef7c633ec1fa0d0855fdb5bffa9e0150d505814ff3f4218859e94122d1432c52cd2ef6d1140240cce3e

  • \Users\Admin\AppData\Local\Temp\10b145cfb95a3ba1a16460cbae99e607_JaffaCakes118mgr.exe

    Filesize

    111KB

    MD5

    10d2e087710c80d11a2e482cd3a13731

    SHA1

    5623e43b4ac7c528449e67bc11cedabe369df54c

    SHA256

    607b206b4baecc7a0be6c0518b8733fb5c4364b7098a262a03befbbfd0d30335

    SHA512

    68b991baad83dc781e8a5ba69d0edfad7e90122618b5c1f178a01a0481a8f43e200cbd7f5702449ec758361ac8f1a1596e7400bd9561a86cbeff31a876a2f65a

  • memory/1960-19-0x0000000000220000-0x0000000000258000-memory.dmp

    Filesize

    224KB

  • memory/1960-3-0x0000000000220000-0x0000000000258000-memory.dmp

    Filesize

    224KB

  • memory/2164-99-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2164-102-0x0000000000400000-0x0000000000437E08-memory.dmp

    Filesize

    223KB

  • memory/2164-103-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2216-25-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2216-20-0x0000000000400000-0x0000000000437E08-memory.dmp

    Filesize

    223KB

  • memory/2216-22-0x0000000000240000-0x0000000000242000-memory.dmp

    Filesize

    8KB

  • memory/2216-23-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2216-52-0x0000000076F4F000-0x0000000076F50000-memory.dmp

    Filesize

    4KB

  • memory/2216-26-0x0000000000400000-0x0000000000437E08-memory.dmp

    Filesize

    223KB

  • memory/2216-95-0x0000000000400000-0x0000000000437E08-memory.dmp

    Filesize

    223KB

  • memory/2216-96-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2812-104-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-108-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-113-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-112-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-111-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-53-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-62-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-69-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-63-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-71-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-110-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-43-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-109-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-107-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-106-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2812-105-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2980-30-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2980-28-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2980-34-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2980-51-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2980-40-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2980-38-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2980-39-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2980-49-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2980-50-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB