Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 07:12

General

  • Target

    16ac4e206e38321d926e90f02147358a_JaffaCakes118.dll

  • Size

    262KB

  • MD5

    16ac4e206e38321d926e90f02147358a

  • SHA1

    b86863d688c5d044105ec0cfd6540568a5a2efa4

  • SHA256

    a122f535a1028e17de4bddd597e26c22edd0f5db8ac41d6ea9ff9ca878f6ade3

  • SHA512

    1408bb59117175dbdaa3605e734458a579bf033c0616b074ca2a5cc3adf86673c0374ac3d44729b8af7a5a37c1f458ae86aa5626d87de3d7331f433c89fe00b8

  • SSDEEP

    3072:ICuuNCRs/Pj03pJEEC9ti9pocimFFVW6E1fZim4v5TRRJBYeBTg4vRPW9vc/Bm6a:ICIGPj038tAgFMldWNX++eJknGe

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:336
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:384
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:476
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:612
                  • C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Windows\system32\wbem\wmiprvse.exe
                    4⤵
                      PID:1600
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      4⤵
                        PID:1020
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:692
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:776
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:824
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1164
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:852
                                • C:\Windows\system32\wbem\WMIADAP.EXE
                                  wmiadap.exe /F /T /R
                                  4⤵
                                    PID:2172
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService
                                  3⤵
                                    PID:976
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k NetworkService
                                    3⤵
                                      PID:296
                                    • C:\Windows\System32\spoolsv.exe
                                      C:\Windows\System32\spoolsv.exe
                                      3⤵
                                        PID:964
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                        3⤵
                                          PID:1084
                                        • C:\Windows\system32\taskhost.exe
                                          "taskhost.exe"
                                          3⤵
                                            PID:1100
                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                            3⤵
                                              PID:1416
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                              3⤵
                                                PID:2268
                                              • C:\Windows\system32\sppsvc.exe
                                                C:\Windows\system32\sppsvc.exe
                                                3⤵
                                                  PID:2304
                                              • C:\Windows\system32\lsass.exe
                                                C:\Windows\system32\lsass.exe
                                                2⤵
                                                  PID:492
                                                • C:\Windows\system32\lsm.exe
                                                  C:\Windows\system32\lsm.exe
                                                  2⤵
                                                    PID:500
                                                • C:\Windows\system32\csrss.exe
                                                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                  1⤵
                                                    PID:396
                                                  • C:\Windows\system32\winlogon.exe
                                                    winlogon.exe
                                                    1⤵
                                                      PID:432
                                                    • C:\Windows\Explorer.EXE
                                                      C:\Windows\Explorer.EXE
                                                      1⤵
                                                        PID:1200
                                                        • C:\Windows\system32\rundll32.exe
                                                          rundll32.exe C:\Users\Admin\AppData\Local\Temp\16ac4e206e38321d926e90f02147358a_JaffaCakes118.dll,#1
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1676
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            rundll32.exe C:\Users\Admin\AppData\Local\Temp\16ac4e206e38321d926e90f02147358a_JaffaCakes118.dll,#1
                                                            3⤵
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1792
                                                            • C:\Windows\SysWOW64\rundll32mgr.exe
                                                              C:\Windows\SysWOW64\rundll32mgr.exe
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of UnmapMainImage
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1868
                                                              • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                                "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of UnmapMainImage
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1448
                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                  C:\Windows\system32\svchost.exe
                                                                  6⤵
                                                                  • Modifies WinLogon for persistence
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Program Files directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2808
                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                  C:\Windows\system32\svchost.exe
                                                                  6⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2680
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 224
                                                              4⤵
                                                              • Program crash
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2384

                                                      Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

                                                              Filesize

                                                              204KB

                                                              MD5

                                                              4fbe7ed2b11e34c55553d7a02065ea12

                                                              SHA1

                                                              39c904989860abff1c9d0f0de80d008b45e47282

                                                              SHA256

                                                              4bb0403f50541826350298045897b8acc8248b6bc4fe44df611201ed435f0923

                                                              SHA512

                                                              45505e795c69a13d82b15fa5b1d225a1862e6076ff120d19d4b69a02241adf6fdc94c97ecfc58bc4e54e71fca7189bdcf609ba76d3149cfde770420a2432cd12

                                                            • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

                                                              Filesize

                                                              200KB

                                                              MD5

                                                              7b4e620b8ee80762b7ce649cd9785703

                                                              SHA1

                                                              35b235c45f8d7d9e7f76c61c14e3fb060dc52bd5

                                                              SHA256

                                                              4767d400e5da61236583851564cfe34307c9796a8382836ec3f75b7cbffcc5d6

                                                              SHA512

                                                              9e2f718a53ba99083d7b707ff7d58e823a8c0c79e63bca36a3ead922367e4b33339400a68e1018c6c100250ba9622624a64cd69a19e00b32bf9512f549ae29a0

                                                            • \Windows\SysWOW64\rundll32mgr.exe

                                                              Filesize

                                                              95KB

                                                              MD5

                                                              f9caa37eabeb36f1a220d2840767367a

                                                              SHA1

                                                              77a49bd0a22933e65ab3749a7177459b303cd73c

                                                              SHA256

                                                              6f690538c457090d41b830c2863bff404f76057d45a7b0531cb1058fe9ea1e9f

                                                              SHA512

                                                              1a3508c167d29857720fbefdc38be4c5bf3518d543139c4e103ba9b660facc3a22ca600ed54c42892b337a07ef4ad5770d2705802a4201c6e2255baf29e767b2

                                                            • memory/1448-668-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1448-36-0x0000000000400000-0x000000000044D000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/1448-71-0x0000000000060000-0x0000000000061000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1448-408-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1448-409-0x0000000077CBF000-0x0000000077CC0000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1448-40-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1448-42-0x0000000077CBF000-0x0000000077CC0000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1448-41-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1792-415-0x0000000010000000-0x0000000010046000-memory.dmp

                                                              Filesize

                                                              280KB

                                                            • memory/1792-0-0x0000000010000000-0x0000000010046000-memory.dmp

                                                              Filesize

                                                              280KB

                                                            • memory/1792-5-0x0000000000190000-0x00000000001DD000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/1792-2-0x0000000010000000-0x0000000010046000-memory.dmp

                                                              Filesize

                                                              280KB

                                                            • memory/1868-30-0x0000000000700000-0x000000000074D000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/1868-16-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1868-14-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1868-12-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1868-11-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1868-17-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1868-19-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1868-13-0x0000000000400000-0x0000000000421000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/1868-15-0x0000000000140000-0x0000000000141000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1868-25-0x0000000000700000-0x000000000074D000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/2680-90-0x0000000000170000-0x0000000000171000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2680-88-0x0000000020010000-0x000000002001B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/2680-112-0x0000000077CC0000-0x0000000077CC1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2680-73-0x0000000020010000-0x000000002001B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/2680-86-0x0000000020010000-0x000000002001B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/2680-82-0x0000000020010000-0x000000002001B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/2680-89-0x0000000020010000-0x000000002001B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/2680-91-0x0000000020010000-0x000000002001B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/2680-87-0x0000000000160000-0x0000000000161000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2808-44-0x0000000020010000-0x0000000020022000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/2808-53-0x0000000020010000-0x0000000020022000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/2808-46-0x0000000000080000-0x0000000000081000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2808-63-0x0000000020010000-0x0000000020022000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/2808-65-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2808-412-0x0000000020010000-0x0000000020022000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/2808-66-0x0000000000080000-0x0000000000081000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2808-67-0x0000000000090000-0x0000000000091000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2808-68-0x0000000020010000-0x0000000020022000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/2808-58-0x0000000020010000-0x0000000020022000-memory.dmp

                                                              Filesize

                                                              72KB