Analysis
-
max time kernel
96s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 00:10
General
-
Target
JaffaCakes118_4043e7a3ec462e9cfa8ff47f6f7c5af0.dll
-
Size
511KB
-
MD5
4043e7a3ec462e9cfa8ff47f6f7c5af0
-
SHA1
194394367effa041a33e213357921eb2400494aa
-
SHA256
79d32b9dedafb896a9d4e72931a1150bd636c4ede44e7d9b66a836870960dace
-
SHA512
82e12eebf0fbe561a60f4aa24b51839b4ce2296934ae56deaaf6b5077e7a5f6fd15724029a53d895ea02f66a7f3fd2c358bf08e790124815a7f4b792f840d87b
-
SSDEEP
6144:iSAshdo/MCRiVFAr5V2uG99GUc4Y5DDUXMfv0s9uivOc0mUTQx2iumBNTw:b4MM5V2uGvGUcdNDU8h9uim30xBtjTw
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies security service 2 TTPs 3 IoCs
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4043e7a3ec462e9cfa8ff47f6f7c5af0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4043e7a3ec462e9cfa8ff47f6f7c5af0.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\H2KdefKpT"H2KdefKpT"3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
287KB
MD58627249c7e93c76032132f399d0fee6f
SHA1db0d2006fe739d06298eae5586d99a864905b708
SHA2561edd96962de859f5752f2567aaabe8171d735265abe1ed3c2225c9d0c20de107
SHA512a256316f407257045260d9a73e2f30a66920bd26e14ffe1e527f1a0e77f4e0009e3b89318fba0c6a3e2e9a5c7b09fec43818bc8f930e9808f6680b1adc063227
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
564KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
564KB
-
Filesize
564KB