Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 05:24
Static task
static1
Behavioral task
behavioral1
Sample
f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe
-
Size
10.7MB
-
MD5
f2c7b3dd677d36abe158ada055822669
-
SHA1
06f400ae6e2a2c0a1e8f64e702444a297f37d0f3
-
SHA256
f17a88bf3b89dff62b431dacda445025c5c3764b9bc87bf584df2e4f274996b8
-
SHA512
b59e41c6a44de1e9ca80189581a2d634df6d88b6442ba49d77dddf943043e81ce9a7cf92a5cc6a954d20d4414f9f237526e479718540a7cd16025091b07d3130
-
SSDEEP
98304:w11111111111111111111111111111111111111111111111111111111111111f:
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2660 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\semcsfig\ImagePath = "C:\\Windows\\SysWOW64\\semcsfig\\pgcjazdh.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1776 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
pgcjazdh.exepid process 812 pgcjazdh.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pgcjazdh.exedescription pid process target process PID 812 set thread context of 1776 812 pgcjazdh.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2924 sc.exe 4248 sc.exe 1864 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3684 2260 WerFault.exe f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe 3956 812 WerFault.exe pgcjazdh.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exepgcjazdh.exedescription pid process target process PID 2260 wrote to memory of 2996 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe cmd.exe PID 2260 wrote to memory of 2996 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe cmd.exe PID 2260 wrote to memory of 2996 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe cmd.exe PID 2260 wrote to memory of 972 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe cmd.exe PID 2260 wrote to memory of 972 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe cmd.exe PID 2260 wrote to memory of 972 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe cmd.exe PID 2260 wrote to memory of 1864 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 1864 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 1864 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 2924 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 2924 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 2924 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 4248 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 4248 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 4248 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe sc.exe PID 2260 wrote to memory of 2660 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe netsh.exe PID 2260 wrote to memory of 2660 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe netsh.exe PID 2260 wrote to memory of 2660 2260 f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe netsh.exe PID 812 wrote to memory of 1776 812 pgcjazdh.exe svchost.exe PID 812 wrote to memory of 1776 812 pgcjazdh.exe svchost.exe PID 812 wrote to memory of 1776 812 pgcjazdh.exe svchost.exe PID 812 wrote to memory of 1776 812 pgcjazdh.exe svchost.exe PID 812 wrote to memory of 1776 812 pgcjazdh.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\semcsfig\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pgcjazdh.exe" C:\Windows\SysWOW64\semcsfig\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create semcsfig binPath= "C:\Windows\SysWOW64\semcsfig\pgcjazdh.exe /d\"C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description semcsfig "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start semcsfig2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 10362⤵
- Program crash
-
C:\Windows\SysWOW64\semcsfig\pgcjazdh.exeC:\Windows\SysWOW64\semcsfig\pgcjazdh.exe /d"C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 5122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2260 -ip 22601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 812 -ip 8121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pgcjazdh.exeFilesize
14.4MB
MD52086cec9bff4fb93d7ca86c8a20e1f35
SHA11431850296950ae489f710917cdf2a758e1bb502
SHA25670dd1d5b72d202392af50d00b93f678c64fb18b8e22adf532c4ab2ef2371b522
SHA51296c63bca61ab86688b97a60e7ef7d0f32dcd4a7542754ee7621add58f735c42337393680d68cfb0e0cae3737b2b8c5663cd55fe7abfa19fe04525965298c6f75
-
memory/812-10-0x00000000023B0000-0x00000000024B0000-memory.dmpFilesize
1024KB
-
memory/812-13-0x0000000000400000-0x0000000002234000-memory.dmpFilesize
30.2MB
-
memory/812-18-0x0000000000400000-0x0000000002234000-memory.dmpFilesize
30.2MB
-
memory/1776-11-0x0000000000830000-0x0000000000845000-memory.dmpFilesize
84KB
-
memory/1776-16-0x0000000000830000-0x0000000000845000-memory.dmpFilesize
84KB
-
memory/1776-17-0x0000000000830000-0x0000000000845000-memory.dmpFilesize
84KB
-
memory/1776-19-0x0000000000830000-0x0000000000845000-memory.dmpFilesize
84KB
-
memory/2260-4-0x0000000000400000-0x0000000002234000-memory.dmpFilesize
30.2MB
-
memory/2260-2-0x00000000001C0000-0x00000000001D3000-memory.dmpFilesize
76KB
-
memory/2260-7-0x0000000000400000-0x0000000002234000-memory.dmpFilesize
30.2MB
-
memory/2260-8-0x00000000001C0000-0x00000000001D3000-memory.dmpFilesize
76KB
-
memory/2260-1-0x0000000002250000-0x0000000002350000-memory.dmpFilesize
1024KB