Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 23:00
Static task
static1
Behavioral task
behavioral1
Sample
f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe
-
Size
13.1MB
-
MD5
f21f4614358cdb18bcc75489077f6e50
-
SHA1
3fbcc2f1bd4dce604cfb468ef882ce93388f1015
-
SHA256
7a975f0197744ff65ed0c6ab56576c5b40bf11176e6f43f9945072a9bb3660e0
-
SHA512
95f8f87568983cc69a13b4d023520364e52ceb241474aeb1bd4a91b59d483b002653c15b0bb6b9b8aff76f363a305aabc03872696440f76f0e2e1e71431583c5
-
SSDEEP
49152:Yjrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrj:e
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4124 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\smacvtjr\ImagePath = "C:\\Windows\\SysWOW64\\smacvtjr\\vhicxtur.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 4336 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
vhicxtur.exepid process 2120 vhicxtur.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
vhicxtur.exedescription pid process target process PID 2120 set thread context of 4336 2120 vhicxtur.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1456 sc.exe 3800 sc.exe 1604 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exevhicxtur.exedescription pid process target process PID 1616 wrote to memory of 3972 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe cmd.exe PID 1616 wrote to memory of 3972 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe cmd.exe PID 1616 wrote to memory of 3972 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe cmd.exe PID 1616 wrote to memory of 2892 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe cmd.exe PID 1616 wrote to memory of 2892 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe cmd.exe PID 1616 wrote to memory of 2892 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe cmd.exe PID 1616 wrote to memory of 1456 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 1456 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 1456 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 3800 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 3800 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 3800 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 1604 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 1604 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 1604 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe sc.exe PID 1616 wrote to memory of 4124 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe netsh.exe PID 1616 wrote to memory of 4124 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe netsh.exe PID 1616 wrote to memory of 4124 1616 f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe netsh.exe PID 2120 wrote to memory of 4336 2120 vhicxtur.exe svchost.exe PID 2120 wrote to memory of 4336 2120 vhicxtur.exe svchost.exe PID 2120 wrote to memory of 4336 2120 vhicxtur.exe svchost.exe PID 2120 wrote to memory of 4336 2120 vhicxtur.exe svchost.exe PID 2120 wrote to memory of 4336 2120 vhicxtur.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\smacvtjr\2⤵PID:3972
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vhicxtur.exe" C:\Windows\SysWOW64\smacvtjr\2⤵PID:2892
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create smacvtjr binPath= "C:\Windows\SysWOW64\smacvtjr\vhicxtur.exe /d\"C:\Users\Admin\AppData\Local\Temp\f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1456 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description smacvtjr "wifi internet conection"2⤵
- Launches sc.exe
PID:3800 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start smacvtjr2⤵
- Launches sc.exe
PID:1604 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4124
-
C:\Windows\SysWOW64\smacvtjr\vhicxtur.exeC:\Windows\SysWOW64\smacvtjr\vhicxtur.exe /d"C:\Users\Admin\AppData\Local\Temp\f21f4614358cdb18bcc75489077f6e50_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:4336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4396 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:4468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.0MB
MD5494d6c5871990741477b194be024793d
SHA146f311ec27da687404ee0e1fdd16f422983992bb
SHA2560b3518a5cf0c37ac2aa85ce62306dfcc375fffe217c7760ae254a0fe3e8ccae1
SHA512f00d670fed31c6967a186592e1e82222abbe9c13d88a97fc2e8ad6a969ad96d4d5af8703944120ad2015cbb6f2ecd3b7509812ae28eebe2eb474c98320ec96e6