Resubmissions
10/04/2024, 03:05
240410-dld96afg4v1010/04/2024, 03:04
240410-dk1f1acd861010/04/2024, 03:04
240410-dkzvgacd851010/04/2024, 03:04
240410-dky8yafg3z1010/04/2024, 03:04
240410-dkyx6scd841001/04/2024, 07:13
240401-h17mgagf881031/03/2024, 20:35
240331-zc89tsbe8y10Analysis
- max time kernel
90s - max time network
148s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
01/04/2024, 07:13
Behavioral task
behavioral1
Sample
5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
- Target 5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118.exe
- Size 209KB
- Sample240401-h17mgagf88
- SHA256 dfe0c8f95bf96e2be4666d73ef9cd166e89eef631e975aa2e384d9f1af901d45
- MD5 5d7e265ed53bd43d40f6457318a0921d
- SHA1 08d676809ac123f9a42a7ad4c8b86a3f2237580d
- SHA512 3f1c65337295aefff9781e099a7d298f2308f5639ab0fc34cc1e716b68991b6abdac195964083bb7d3bdc36ca25a4652ab482fd943ca1f4190c71222b60d7a43
- SSDEEP 6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1UW:cnLh9yn52rpUR5vHuRYpM+W
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
systembc
C2
-
yan0212.com:4039
-
yan0212.net:4039
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2404 vulxdk.exe -
resource yara_rule behavioral1/files/0x000d000000012331-6.dat upx - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip4.seeip.org 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org - Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\vulxdk.job 5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118.exe File created C:\Windows\Tasks\vulxdk.job 5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2152 5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118.exe 2460 chrome.exe 2460 chrome.exe - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe Token: SeShutdownPrivilege 2460 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe 2460 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2404 3048 taskeng.exe 29 PID 3048 wrote to memory of 2404 3048 taskeng.exe 29 PID 3048 wrote to memory of 2404 3048 taskeng.exe 29 PID 3048 wrote to memory of 2404 3048 taskeng.exe 29 PID 2460 wrote to memory of 2472 2460 chrome.exe 33 PID 2460 wrote to memory of 2472 2460 chrome.exe 33 PID 2460 wrote to memory of 2472 2460 chrome.exe 33 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2972 2460 chrome.exe 35 PID 2460 wrote to memory of 2768 2460 chrome.exe 36 PID 2460 wrote to memory of 2768 2460 chrome.exe 36 PID 2460 wrote to memory of 2768 2460 chrome.exe 36 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37 PID 2460 wrote to memory of 2800 2460 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
C:\Windows\system32\taskeng.exetaskeng.exe {D1B2B17F-86D3-41C1-B3FC-E1DA81D78C25} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\ProgramData\fqlhc\vulxdk.exeC:\ProgramData\fqlhc\vulxdk.exe start2⤵
- Executes dropped EXE
PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6719758,0x7fef6719768,0x7fef67197782⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1276,i,14343702476343748745,18306957268604593129,131072 /prefetch:22⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1276,i,14343702476343748745,18306957268604593129,131072 /prefetch:82⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1276,i,14343702476343748745,18306957268604593129,131072 /prefetch:82⤵PID:2800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2232 --field-trial-handle=1276,i,14343702476343748745,18306957268604593129,131072 /prefetch:12⤵PID:636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1276,i,14343702476343748745,18306957268604593129,131072 /prefetch:12⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1308 --field-trial-handle=1276,i,14343702476343748745,18306957268604593129,131072 /prefetch:22⤵PID:816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1424 --field-trial-handle=1276,i,14343702476343748745,18306957268604593129,131072 /prefetch:12⤵PID:892
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\fqlhc\vulxdk.exe
- Size 209KB
- SHA256 dfe0c8f95bf96e2be4666d73ef9cd166e89eef631e975aa2e384d9f1af901d45
- MD5 5d7e265ed53bd43d40f6457318a0921d
- SHA1 08d676809ac123f9a42a7ad4c8b86a3f2237580d
- SHA512 3f1c65337295aefff9781e099a7d298f2308f5639ab0fc34cc1e716b68991b6abdac195964083bb7d3bdc36ca25a4652ab482fd943ca1f4190c71222b60d7a43
- SSDEEP 6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1UW:cnLh9yn52rpUR5vHuRYpM+W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 3e5fc879fc20299de9864e6ce524f2a9836d4fd6717be769b20b8087f71ca67a
- MD5 34b6846500365ec982a636a722af2f3e
- SHA1 9feb048a7f93ee384a560e788279657518b8aab8
- SHA512 73537ac44dfd9079ab9d7784644187823008ecaa97a25f0e239abc8205a66e0866ceb618f067b5e1b5dc25a2ee934282914f1a40ee6747f445fcb04e76b06133
- SSDEEP 96:35CuWKIhz51Ed8iZRy7Di+6Msmded0OBBg5DgBjVhYtjEsXt0/cg2Vup:357W7zy8syy+FSbG5EBotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 2e382b0a027f4cc12f1523cb79af415f1e8c9ef0635f4e09d278c4f27176085b
- MD5 5160912edb5502ea3a7427f38cb9e61c
- SHA1 d182744d0a4914adb224902f63e7f099492dd30a
- SHA512 12d563dcde37ec536d78a238cafbc4ecf9e7d902c04e8d28ec91c2a41b38a664d2681f41be2f001c679b5f1dceb10521ec71ae0f84a20aedaf0d862069683114
- SSDEEP 96:35CuWKIhz51Ed8iZRy7Di+6MsmdedLIOBBg5DgBjVhYtjEsXt0/cg2Vup:357W7zy8syy+FSLXG5EBotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512