Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 08:00

General

  • Target

    114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll

  • Size

    239KB

  • MD5

    114626620c1c7ac58aa6198abb61d688

  • SHA1

    f77b1b7efa307797325274b979ffb7b5e26a868e

  • SHA256

    538cf6f7120ccfb4b3a46cef0d8b4038ad18fd701fa440a352c6a3985b5ed175

  • SHA512

    d69d9a1e98257b54770e044609730e72fc61b0010adbb3946348db9830ae4670cf8695d197ce026f80d1eabc181569cc7dff2736556a84dd7b7301e11ed71a03

  • SSDEEP

    3072:tM25gs+jNAFBHZkZ/p20fryPDfMAS3uhpK4mMn3oTiaMYk9y2IF9Mn8YuosT//dD:bCRhsBHyr2HjVn36Zk9y2/n8Yuoe5P

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Windows\SysWOW64\regsvr32mgr.exe
        C:\Windows\SysWOW64\regsvr32mgr.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2556
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks BIOS information in registry
          • Drops startup file
          • Impair Defenses: Safe Mode Boot
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2704
        • C:\Users\Admin\AppData\Local\Temp\odshuwkpvnbyejnk.exe
          "C:\Users\Admin\AppData\Local\Temp\odshuwkpvnbyejnk.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\regsvr32mgr.exe

    Filesize

    109KB

    MD5

    23dcf284359d24e3fbee7741c80f246d

    SHA1

    da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

    SHA256

    989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

    SHA512

    4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

  • memory/1484-92-0x0000000000400000-0x0000000000437A70-memory.dmp

    Filesize

    222KB

  • memory/1484-96-0x0000000000400000-0x0000000000437A70-memory.dmp

    Filesize

    222KB

  • memory/2556-31-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2556-33-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2556-34-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2556-32-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2556-29-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2556-30-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2556-21-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2556-19-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2556-25-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2704-103-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-54-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-104-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-105-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-43-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-37-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-97-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-106-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-98-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-101-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-60-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-53-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-62-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-100-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2704-99-0x0000000020010000-0x0000000020023000-memory.dmp

    Filesize

    76KB

  • memory/2732-1-0x0000000010000000-0x0000000010041000-memory.dmp

    Filesize

    260KB

  • memory/2732-10-0x0000000000200000-0x0000000000238000-memory.dmp

    Filesize

    224KB

  • memory/2732-3-0x0000000000200000-0x0000000000238000-memory.dmp

    Filesize

    224KB

  • memory/2988-47-0x0000000077DFF000-0x0000000077E00000-memory.dmp

    Filesize

    4KB

  • memory/2988-90-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2988-91-0x0000000000400000-0x0000000000437A70-memory.dmp

    Filesize

    222KB

  • memory/2988-87-0x0000000002690000-0x00000000026C8000-memory.dmp

    Filesize

    224KB

  • memory/2988-79-0x0000000002680000-0x00000000026B8000-memory.dmp

    Filesize

    224KB

  • memory/2988-80-0x0000000002680000-0x00000000026B8000-memory.dmp

    Filesize

    224KB

  • memory/2988-17-0x0000000000400000-0x0000000000437A70-memory.dmp

    Filesize

    222KB

  • memory/2988-16-0x00000000005D0000-0x00000000005D1000-memory.dmp

    Filesize

    4KB

  • memory/2988-14-0x0000000000400000-0x0000000000437A70-memory.dmp

    Filesize

    222KB

  • memory/2988-13-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2988-11-0x0000000000400000-0x0000000000437A70-memory.dmp

    Filesize

    222KB