Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 05:46
General
-
Target
2bee9df1419903f140ff65c7703c874e_JaffaCakes118.exe
-
Size
838KB
-
MD5
2bee9df1419903f140ff65c7703c874e
-
SHA1
bfacd5769eeadd2e23338f0940ac90e4bc9aec7c
-
SHA256
f55becb79884a973b1119216aeb951fb088cc8abf41a8e31550eccbde3ba78d3
-
SHA512
67421befb7337b6959b58e4f6dd906e32330d03b361645e365fc8c52dfd282af353e43fb0152285d462356a352232aec5d454826fe6745341b3d62fab1fa7694
-
SSDEEP
24576:hnJi0+xxQCj7Kc2ckATjAC+HpFkSJVv1t/2JrbEO0L4lnfjZmR:FJi0+xxQCfHhkATjAC+HpFkSJVv1ZE/8
Malware Config
Signatures
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 51 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bee9df1419903f140ff65c7703c874e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2bee9df1419903f140ff65c7703c874e_JaffaCakes118.exe"1⤵
- Disables RegEdit via registry modification
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"netsh.exe" firewall set opmode disable2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\lostsaga.exeC:\lostsaga.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\lostsagamgr.exeC:\lostsagamgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2046⤵
- Program crash
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3696 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Application.exe"C:\Users\Admin\AppData\Roaming\Application.exe"2⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3008 -ip 30081⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD56f31433af94ce805667c5f3032702ab4
SHA143f7c836d0d12d1a29c0c32715bc148e997bab8a
SHA256becac18ab8b1c50a73a1d69566eb5ca1a3c8c7f4000029232ec5526e211e8ea4
SHA512f1300da1bd8bc7d00e54cad85d4bb0b6fd587650777238f4b1950362c2b5e5a56cc158e9a2d9f565821b266220a197c21e44c866c0c5be2428af5d5218a6b655
-
Filesize
3KB
MD5b9db8b1ae34938714092d07dd36fb8c0
SHA1afddf469d2c814c2906a8d085ce30e1a50d4e154
SHA25617c1dfd4eed1ee5a31872192db2d25d00393e91c8c13f9dc5051e0bb7fb3e99d
SHA512ccd5434af34664c986a4fe117cc8d05efda20c618b4f46ce05c57976d919a5545e474dc14429442dc953f5057bad82f45fc1510d0631c04ecc59e9dc31803b9d
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
154KB
MD5c2004abcda1a230cf75da74a8b56a276
SHA162f8de3e2f270ffe96518ccf0e5bfbb444733031
SHA256e9945c6721d022e33508ad1326063bcdd12c67bc9d062db0f160ac058bc5e6cb
SHA512db31f45e604dce12e4010879475bccc094e4b215d30e329f8f1460d724a37ec649319006b0aa70a8e05d6779f2b184fcd31750e5ca784829338b2609df81a7e8
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
2KB
MD54428c969f83fe0fb6bb2a635fe605bce
SHA115efa531bc399c5e92d72cf266f8e18b4ec78bb0
SHA256458b17876c0ea9ce182b9966f97d7617600ac6cb95c363cc7f33aec420424151
SHA5124896c3e06391a7caca83ae36fd2a093af81ad6165979ed23232fb35a4d85a7188ecbbc66e720c4cd3d86e4c5546848ce7b02e5d8e28cd02ca0c246b091e9d809
-
Filesize
92KB
MD5e015c13f29b01ce78e2c066674362ee5
SHA137ad4196953a2741d1bd52aed19f82f9947f119d
SHA256c062802dfa0fcd5fdba4feef534d80e8686a3a5de9fe441848d0a08433bf07d9
SHA512c5da6b6424d713df43e5c6dad91d21a74db3a6c5adbbee48d6d9238cbf7d554ecbaf46a37aa9e38db583ede5c2c295c82e5703e17b35fc3a5c0dcf504544bc36
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
160KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
4.8MB
-
Filesize
664KB
-
Filesize
32KB
-
Filesize
624KB