Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 02:49
Static task
static1
Behavioral task
behavioral1
Sample
f284271435132b9487ddf8dd41992578_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f284271435132b9487ddf8dd41992578_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f284271435132b9487ddf8dd41992578_JaffaCakes118.exe
-
Size
14.2MB
-
MD5
f284271435132b9487ddf8dd41992578
-
SHA1
26ec52a5e08c3370a92e47b5f43a12057cbe8616
-
SHA256
8a19788e6391d24385ece1dc77bb1a3f381bfd951faa17ce3925592842d19986
-
SHA512
4027ec19d3371d2707855d1e709a48ac96e9c09251a57de035c5e2d0b10cb6ecdeddae9e6c235c524022ff305b794340815fa2ad40a7d6cf287f2304942a0687
-
SSDEEP
196608:0zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2572 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
irgbnmtd.exepid process 2632 irgbnmtd.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2964 sc.exe 2708 sc.exe 2820 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
f284271435132b9487ddf8dd41992578_JaffaCakes118.exeirgbnmtd.exedescription pid process target process PID 1372 wrote to memory of 2080 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2080 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2080 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2080 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2968 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2968 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2968 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2968 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe cmd.exe PID 1372 wrote to memory of 2964 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2964 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2964 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2964 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2708 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2708 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2708 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2708 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2820 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2820 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2820 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2820 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe sc.exe PID 1372 wrote to memory of 2572 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe netsh.exe PID 1372 wrote to memory of 2572 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe netsh.exe PID 1372 wrote to memory of 2572 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe netsh.exe PID 1372 wrote to memory of 2572 1372 f284271435132b9487ddf8dd41992578_JaffaCakes118.exe netsh.exe PID 2632 wrote to memory of 2540 2632 irgbnmtd.exe svchost.exe PID 2632 wrote to memory of 2540 2632 irgbnmtd.exe svchost.exe PID 2632 wrote to memory of 2540 2632 irgbnmtd.exe svchost.exe PID 2632 wrote to memory of 2540 2632 irgbnmtd.exe svchost.exe PID 2632 wrote to memory of 2540 2632 irgbnmtd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ffjnhedd\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\irgbnmtd.exe" C:\Windows\SysWOW64\ffjnhedd\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ffjnhedd binPath= "C:\Windows\SysWOW64\ffjnhedd\irgbnmtd.exe /d\"C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ffjnhedd "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ffjnhedd2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\ffjnhedd\irgbnmtd.exeC:\Windows\SysWOW64\ffjnhedd\irgbnmtd.exe /d"C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\irgbnmtd.exeFilesize
14.4MB
MD5c047fe02bef3fd5ba51741364ccf71d9
SHA11e570930debfac78bcf118e086ff131e5eb04d1b
SHA256b12e71cc91c1e56258ec1d8ee8b3ed4014a47eb79cde576f761b88744115ce22
SHA51244283d58db57d80e117bc2ee76197d8641bb11be4d10de7199047bbe0f1304076aac52aa67a7f64696e1c81eedbe163341a6bec3f42c98379ecacddbe1236a1e
-
memory/1372-1-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB
-
memory/1372-2-0x00000000001C0000-0x00000000001D3000-memory.dmpFilesize
76KB
-
memory/1372-4-0x0000000000400000-0x00000000008EB000-memory.dmpFilesize
4.9MB
-
memory/1372-7-0x0000000000400000-0x00000000008EB000-memory.dmpFilesize
4.9MB
-
memory/1372-8-0x00000000001C0000-0x00000000001D3000-memory.dmpFilesize
76KB
-
memory/2540-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2540-12-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2632-10-0x0000000000990000-0x0000000000A90000-memory.dmpFilesize
1024KB
-
memory/2632-11-0x0000000000400000-0x00000000008EB000-memory.dmpFilesize
4.9MB
-
memory/2632-15-0x0000000000400000-0x00000000008EB000-memory.dmpFilesize
4.9MB
-
memory/2632-17-0x0000000000990000-0x0000000000A90000-memory.dmpFilesize
1024KB