Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe
-
Size
468KB
-
MD5
186018245413fe2e77c4747b07e8dae2
-
SHA1
f8aaf00d59d47da7d8aea28d3ce26a47cadb5d8b
-
SHA256
bc25375612eda4ca1cdae0e0a48594a2d8f0c9ec307971da3dd26d520a658664
-
SHA512
c6bfd43f6478ffa424ca79c405f3ba503b7f9599531578ed1309b46d0782c5059266016770105bbbee26b2257e5c1c5b1a7f45ff15bccd431b609c4a269c1aa3
-
SSDEEP
12288:Y9Bnaprb8UPG8vQkGlALvJOl/7bnjImwYAOxjpG:Y9JahVPXQtm8l/XjIFY4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\mcjdbmmq\\uibplpvh.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uibplpvh.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uibplpvh.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exemnynnrunxvaaojts.exepid process 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe 2940 mnynnrunxvaaojts.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exepid process 2088 186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe 2088 186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\RealPlayer_update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe restart" 186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\UibPlpvh = "C:\\Users\\Admin\\AppData\\Local\\mcjdbmmq\\uibplpvh.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe 2240 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 484 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exesvchost.exesvchost.exemnynnrunxvaaojts.exedescription pid process Token: SeSecurityPrivilege 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe Token: SeDebugPrivilege 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe Token: SeSecurityPrivilege 2616 svchost.exe Token: SeSecurityPrivilege 2240 svchost.exe Token: SeDebugPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeSecurityPrivilege 2940 mnynnrunxvaaojts.exe Token: SeLoadDriverPrivilege 2940 mnynnrunxvaaojts.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exedescription pid process target process PID 2088 wrote to memory of 2308 2088 186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe PID 2088 wrote to memory of 2308 2088 186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe PID 2088 wrote to memory of 2308 2088 186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe PID 2088 wrote to memory of 2308 2088 186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2616 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2240 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe svchost.exe PID 2308 wrote to memory of 2940 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe mnynnrunxvaaojts.exe PID 2308 wrote to memory of 2940 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe mnynnrunxvaaojts.exe PID 2308 wrote to memory of 2940 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe mnynnrunxvaaojts.exe PID 2308 wrote to memory of 2940 2308 186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe mnynnrunxvaaojts.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\mnynnrunxvaaojts.exe"C:\Users\Admin\AppData\Local\Temp\mnynnrunxvaaojts.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\186018245413fe2e77c4747b07e8dae2_JaffaCakes118mgr.exeFilesize
110KB
MD5a06539e080f0796c507ea485effbc8b0
SHA1c31d586000b50ec398b1e1dcfecbc31382449db4
SHA256f5204dc271e72770b75fff3703d4c3f48011807a21816a8b2f82efe69ab28626
SHA51230c4250ccdf2a5df73688285253f9f476da9f9d6517539e6db951c8cd3de9819b2fa040093fc36d24aaf0a5e23c78abfce1cb693c21bcfb3ab9e4fd0385e1b59
-
memory/2088-9-0x0000000001BB0000-0x0000000001BE8000-memory.dmpFilesize
224KB
-
memory/2088-4-0x0000000001BB0000-0x0000000001BE8000-memory.dmpFilesize
224KB
-
memory/2088-10-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2088-0-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2240-38-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-54-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-102-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-63-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-103-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-110-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-101-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-109-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-108-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-107-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-106-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-105-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-104-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-45-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-61-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-58-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2240-55-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2308-51-0x0000000077C8F000-0x0000000077C90000-memory.dmpFilesize
4KB
-
memory/2308-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-12-0x0000000000400000-0x0000000000437D4C-memory.dmpFilesize
223KB
-
memory/2308-18-0x0000000000400000-0x0000000000437D4C-memory.dmpFilesize
223KB
-
memory/2308-17-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2308-80-0x0000000002670000-0x00000000026A8000-memory.dmpFilesize
224KB
-
memory/2308-82-0x0000000002670000-0x00000000026A8000-memory.dmpFilesize
224KB
-
memory/2308-88-0x0000000002670000-0x00000000026A8000-memory.dmpFilesize
224KB
-
memory/2308-92-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-91-0x0000000000400000-0x0000000000437D4C-memory.dmpFilesize
223KB
-
memory/2308-15-0x0000000000400000-0x0000000000437D4C-memory.dmpFilesize
223KB
-
memory/2616-20-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2616-34-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2616-35-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2616-33-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2616-26-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2616-31-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2616-32-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2616-27-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2616-22-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2940-99-0x0000000000400000-0x0000000000437D4C-memory.dmpFilesize
223KB
-
memory/2940-100-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2940-95-0x0000000000400000-0x0000000000437D4C-memory.dmpFilesize
223KB
-
memory/2940-93-0x0000000000400000-0x0000000000437D4C-memory.dmpFilesize
223KB