Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 17:55
Static task
static1
Behavioral task
behavioral1
Sample
f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe
-
Size
11.1MB
-
MD5
f1a4db415a4dd63a80f0b8cc7a2d2362
-
SHA1
d1287fa03a80d1626605431cd341e9d5049afba5
-
SHA256
87140618703529cf84c6e119ecde2b6faeabba17cd73a817ee17856b2692bb70
-
SHA512
15a8b53f82a86fabc1a84f52b4b2fe5e59bac869d18996465b355932f7c286250790e54dada414afef270b9c31d5bd9cbfe2fc3aa0e20badc35b3f7f658dfdf5
-
SSDEEP
12288:WiuYCjGjdPej7mB+DCXRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFRFJ:RCjGDoD
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2600 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
lypyqdfz.exepid process 2536 lypyqdfz.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2476 sc.exe 2356 sc.exe 2608 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exelypyqdfz.exedescription pid process target process PID 1664 wrote to memory of 2628 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2628 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2628 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2628 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2944 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2944 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2944 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2944 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe cmd.exe PID 1664 wrote to memory of 2608 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2608 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2608 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2608 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2476 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2476 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2476 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2476 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2356 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2356 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2356 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2356 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe sc.exe PID 1664 wrote to memory of 2600 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe netsh.exe PID 1664 wrote to memory of 2600 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe netsh.exe PID 1664 wrote to memory of 2600 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe netsh.exe PID 1664 wrote to memory of 2600 1664 f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe netsh.exe PID 2536 wrote to memory of 2364 2536 lypyqdfz.exe svchost.exe PID 2536 wrote to memory of 2364 2536 lypyqdfz.exe svchost.exe PID 2536 wrote to memory of 2364 2536 lypyqdfz.exe svchost.exe PID 2536 wrote to memory of 2364 2536 lypyqdfz.exe svchost.exe PID 2536 wrote to memory of 2364 2536 lypyqdfz.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xtcdfzlq\2⤵PID:2628
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lypyqdfz.exe" C:\Windows\SysWOW64\xtcdfzlq\2⤵PID:2944
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create xtcdfzlq binPath= "C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe /d\"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2608 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description xtcdfzlq "wifi internet conection"2⤵
- Launches sc.exe
PID:2476 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start xtcdfzlq2⤵
- Launches sc.exe
PID:2356 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2600
-
C:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exeC:\Windows\SysWOW64\xtcdfzlq\lypyqdfz.exe /d"C:\Users\Admin\AppData\Local\Temp\f1a4db415a4dd63a80f0b8cc7a2d2362_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:2364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.2MB
MD5702a8c82b7c7bb11b56695e1059ecc46
SHA1d662ad72e5a93d334d057291d06d12c8fb819199
SHA2566c3e68d8f3952daa0093b672b61ddb809756324127d40243fc25a9d82099b13c
SHA51283378d61fdca534d9aa5a895be181f39e8a5c79c911edb18663e7dfeb4281f32f3b3c361a9d3ad00013187abf019255737323cf412982b1d3b5827f5ff3ccd76