Analysis

  • max time kernel
    144s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 07:51

General

  • Target

    16cf1b5fdb75b32737e162897992e252_JaffaCakes118.exe

  • Size

    105KB

  • MD5

    16cf1b5fdb75b32737e162897992e252

  • SHA1

    0770aab281b2b6c9ef1c422db33e9fcffc5a8189

  • SHA256

    3224d36db7a560fe8bedc982346e41c78c9704e00bf9085f0a3ef0b491710715

  • SHA512

    aec0a85790ffcaf93be518e0ae1982f3ce5b1d6b042dc2866d56a9b649ca8f43be7377d4a8fbb413e282935b9b926aa9ce70ea71a1319c5a4a1598eeb264ad17

  • SSDEEP

    3072:zAK0CBezOU+8isBve4bF3u5jwaaHw7Koj4rIed:83z+svb1uze

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16cf1b5fdb75b32737e162897992e252_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\16cf1b5fdb75b32737e162897992e252_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2388
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Checks BIOS information in registry
      • Drops startup file
      • Impair Defenses: Safe Mode Boot
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1148
    • C:\Users\Admin\AppData\Local\Temp\qroulfrqyrwcfuls.exe
      "C:\Users\Admin\AppData\Local\Temp\qroulfrqyrwcfuls.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1716

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\tgykyajt\xbrydqmx.exe

          Filesize

          105KB

          MD5

          16cf1b5fdb75b32737e162897992e252

          SHA1

          0770aab281b2b6c9ef1c422db33e9fcffc5a8189

          SHA256

          3224d36db7a560fe8bedc982346e41c78c9704e00bf9085f0a3ef0b491710715

          SHA512

          aec0a85790ffcaf93be518e0ae1982f3ce5b1d6b042dc2866d56a9b649ca8f43be7377d4a8fbb413e282935b9b926aa9ce70ea71a1319c5a4a1598eeb264ad17

        • memory/1148-97-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-44-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-98-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-29-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-95-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-50-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-91-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-54-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-99-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-43-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-94-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-100-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-92-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-23-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-93-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1148-63-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/1716-89-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

        • memory/1716-90-0x0000000000400000-0x0000000000439FE4-memory.dmp

          Filesize

          231KB

        • memory/2388-13-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2388-33-0x0000000000070000-0x0000000000071000-memory.dmp

          Filesize

          4KB

        • memory/2388-9-0x0000000000050000-0x0000000000051000-memory.dmp

          Filesize

          4KB

        • memory/2388-7-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2388-34-0x0000000000050000-0x0000000000051000-memory.dmp

          Filesize

          4KB

        • memory/2388-35-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/2388-17-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2388-18-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2388-19-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2908-52-0x0000000077080000-0x0000000077081000-memory.dmp

          Filesize

          4KB

        • memory/2908-81-0x0000000002650000-0x000000000268A000-memory.dmp

          Filesize

          232KB

        • memory/2908-74-0x0000000002640000-0x000000000267A000-memory.dmp

          Filesize

          232KB

        • memory/2908-73-0x0000000002640000-0x000000000267A000-memory.dmp

          Filesize

          232KB

        • memory/2908-82-0x0000000002650000-0x000000000268A000-memory.dmp

          Filesize

          232KB

        • memory/2908-83-0x000000007707F000-0x0000000077080000-memory.dmp

          Filesize

          4KB

        • memory/2908-65-0x0000000000400000-0x0000000000439FE4-memory.dmp

          Filesize

          231KB

        • memory/2908-64-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB

        • memory/2908-36-0x0000000077080000-0x0000000077081000-memory.dmp

          Filesize

          4KB

        • memory/2908-0-0x0000000000400000-0x0000000000439FE4-memory.dmp

          Filesize

          231KB

        • memory/2908-37-0x000000007707F000-0x0000000077080000-memory.dmp

          Filesize

          4KB

        • memory/2908-3-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2908-4-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2908-5-0x0000000000400000-0x0000000000439FE4-memory.dmp

          Filesize

          231KB

        • memory/2908-1-0x0000000000400000-0x000000000043A000-memory.dmp

          Filesize

          232KB