Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 10:00
Static task
static1
Behavioral task
behavioral1
Sample
eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe
-
Size
100KB
-
MD5
eacf4b7f8034890b3027188d63101a7a
-
SHA1
a29065ba9cc060581120a9654a8a17cfea0af547
-
SHA256
1496ef9cf3d0311bf111defeaabdec1006cca1177561715cd79ae2246e410d5e
-
SHA512
a8e7565717e5b52d6d4594dbf1d29ac564af588a5dc3998cc4f89877226883b9833c765464dd9acd0f148c9847274b02ed37ee2d8844ac04dd64cc970c21b40e
-
SSDEEP
3072:uWddijJxspyRcPXmdekp2GVk8jwaaHw7Koj4rDMxx:xddij7swMXqVuW
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\cptajgmw\\kvlmtgvn.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kvlmtgvn.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kvlmtgvn.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
cbghviutfwpuhlkc.exepid process 2500 cbghviutfwpuhlkc.exe -
Loads dropped DLL 5 IoCs
Processes:
eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exepid process 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\KvlMtgvn = "C:\\Users\\Admin\\AppData\\Local\\cptajgmw\\kvlmtgvn.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 468 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exesvchost.exesvchost.execbghviutfwpuhlkc.exedescription pid process Token: SeSecurityPrivilege 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe Token: SeDebugPrivilege 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe Token: SeSecurityPrivilege 2620 svchost.exe Token: SeSecurityPrivilege 2580 svchost.exe Token: SeDebugPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeSecurityPrivilege 2500 cbghviutfwpuhlkc.exe Token: SeLoadDriverPrivilege 2500 cbghviutfwpuhlkc.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe Token: SeBackupPrivilege 2580 svchost.exe Token: SeRestorePrivilege 2580 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exedescription pid process target process PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2620 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2580 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe svchost.exe PID 1680 wrote to memory of 2500 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe cbghviutfwpuhlkc.exe PID 1680 wrote to memory of 2500 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe cbghviutfwpuhlkc.exe PID 1680 wrote to memory of 2500 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe cbghviutfwpuhlkc.exe PID 1680 wrote to memory of 2500 1680 eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe cbghviutfwpuhlkc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\cbghviutfwpuhlkc.exe"C:\Users\Admin\AppData\Local\Temp\cbghviutfwpuhlkc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\cptajgmw\kvlmtgvn.exeFilesize
100KB
MD5eacf4b7f8034890b3027188d63101a7a
SHA1a29065ba9cc060581120a9654a8a17cfea0af547
SHA2561496ef9cf3d0311bf111defeaabdec1006cca1177561715cd79ae2246e410d5e
SHA512a8e7565717e5b52d6d4594dbf1d29ac564af588a5dc3998cc4f89877226883b9833c765464dd9acd0f148c9847274b02ed37ee2d8844ac04dd64cc970c21b40e
-
memory/1680-72-0x00000000027F0000-0x000000000282B000-memory.dmpFilesize
236KB
-
memory/1680-6-0x00000000770FF000-0x0000000077100000-memory.dmpFilesize
4KB
-
memory/1680-0-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/1680-5-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/1680-51-0x0000000077100000-0x0000000077101000-memory.dmpFilesize
4KB
-
memory/1680-7-0x0000000077100000-0x0000000077101000-memory.dmpFilesize
4KB
-
memory/1680-53-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/1680-57-0x00000000027F0000-0x000000000282B000-memory.dmpFilesize
236KB
-
memory/1680-4-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1680-2-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1680-62-0x00000000027F0000-0x000000000282B000-memory.dmpFilesize
236KB
-
memory/1680-1-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/1680-71-0x00000000770FF000-0x0000000077100000-memory.dmpFilesize
4KB
-
memory/2500-89-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2500-76-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2500-91-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2500-77-0x0000000000240000-0x0000000000242000-memory.dmpFilesize
8KB
-
memory/2580-88-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-52-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-34-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-28-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-80-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-79-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-82-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-84-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-83-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-86-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-43-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2580-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2620-9-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2620-11-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2620-16-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2620-18-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2620-20-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2620-15-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2620-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2620-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2620-24-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB