Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 10:43

General

  • Target

    602911382683dfd6d644cbf52afb8357_JaffaCakes118.dll

  • Size

    120KB

  • MD5

    602911382683dfd6d644cbf52afb8357

  • SHA1

    d515aa2cedde06482c0416e8bdc0d7d4da0c6c92

  • SHA256

    580a75b7a2ce3e9cae6cbb3bdaebd4bb605d9d622da0380cc7f980b4d4974867

  • SHA512

    391b4528cf81d56218d4d42c99eeecf24312f552153f25b50061e141bf13ad1fd34c95aeeb3e837452599bc266725a254c7d871a45db9ae63d3bb453392176bc

  • SSDEEP

    3072:PNPOLRlJrouG0jkH8cfulafTsMGp6zuUBrdCig:PwlmXmlaLsMGnUBo

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\602911382683dfd6d644cbf52afb8357_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\602911382683dfd6d644cbf52afb8357_JaffaCakes118.dll,#1
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Users\Admin\AppData\Local\Temp\jFVnPayM4
        "jFVnPayM4"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2416
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks BIOS information in registry
          • Drops startup file
          • Impair Defenses: Safe Mode Boot
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2192
        • C:\Users\Admin\AppData\Local\Temp\qfgbvhlahuuuxqok.exe
          "C:\Users\Admin\AppData\Local\Temp\qfgbvhlahuuuxqok.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1844

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\jFVnPayM4

          Filesize

          95KB

          MD5

          728a53df2a3d2f5307fe1cc77179d2a5

          SHA1

          a3c9de63748878de218c872e97eef0de767df853

          SHA256

          d9ee5d0e2dd387be3a501cc88cb2b2b310016cdedd7a83be402c203e4dc76e9e

          SHA512

          7496a435296ca0b08b554fb779ab3eb6709064a480a93e6f948f14a072cfbc1fe7e7ac8a31ea572b7a9910ad6b3d6e2019993bfd609d199cefd61c609c7fe893

        • memory/1844-99-0x0000000000400000-0x0000000000439F6C-memory.dmp

          Filesize

          231KB

        • memory/1844-101-0x0000000000400000-0x0000000000439F6C-memory.dmp

          Filesize

          231KB

        • memory/2192-103-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-102-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-110-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-109-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-108-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-107-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-106-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-105-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-104-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-64-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-56-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-111-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-47-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-59-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-76-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-75-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-67-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-39-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-73-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2192-57-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2260-2-0x0000000061D70000-0x0000000061D92000-memory.dmp

          Filesize

          136KB

        • memory/2260-1-0x0000000061D70000-0x0000000061D92000-memory.dmp

          Filesize

          136KB

        • memory/2260-3-0x0000000061D71000-0x0000000061D72000-memory.dmp

          Filesize

          4KB

        • memory/2416-26-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2416-30-0x0000000000070000-0x0000000000071000-memory.dmp

          Filesize

          4KB

        • memory/2416-20-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2416-22-0x0000000000050000-0x0000000000051000-memory.dmp

          Filesize

          4KB

        • memory/2416-33-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2416-32-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/2416-34-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2416-35-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2416-31-0x0000000000050000-0x0000000000051000-memory.dmp

          Filesize

          4KB

        • memory/2832-94-0x0000000002D90000-0x0000000002DCA000-memory.dmp

          Filesize

          232KB

        • memory/2832-41-0x0000000077D80000-0x0000000077D81000-memory.dmp

          Filesize

          4KB

        • memory/2832-93-0x0000000002D90000-0x0000000002DCA000-memory.dmp

          Filesize

          232KB

        • memory/2832-80-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

        • memory/2832-66-0x0000000077D80000-0x0000000077D81000-memory.dmp

          Filesize

          4KB

        • memory/2832-81-0x0000000002D80000-0x0000000002DBA000-memory.dmp

          Filesize

          232KB

        • memory/2832-38-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2832-92-0x0000000000400000-0x0000000000439F6C-memory.dmp

          Filesize

          231KB

        • memory/2832-19-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2832-42-0x0000000077D7F000-0x0000000077D80000-memory.dmp

          Filesize

          4KB

        • memory/2832-18-0x0000000000400000-0x0000000000439F6C-memory.dmp

          Filesize

          231KB

        • memory/2832-16-0x0000000000290000-0x0000000000291000-memory.dmp

          Filesize

          4KB

        • memory/2832-17-0x00000000002A0000-0x00000000002A1000-memory.dmp

          Filesize

          4KB

        • memory/2832-14-0x0000000000400000-0x0000000000439F6C-memory.dmp

          Filesize

          231KB

        • memory/2832-13-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

        • memory/2832-11-0x0000000000400000-0x0000000000439F6C-memory.dmp

          Filesize

          231KB