Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 05:12
Static task
static1
Behavioral task
behavioral1
Sample
f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe
-
Size
11.3MB
-
MD5
f2c2dfad2a7c617f933121023f9615a0
-
SHA1
2413e1d32855aaaef23d75cc7da5e73258f59c0f
-
SHA256
32286087d4e5a88e15e2d34114b10047826640627628d7b269d37eef35585db7
-
SHA512
0a235f74cceebc2fd51d8472762091a958d6d43ca00bedad058cee00fa48b90e063eff78ac60610668e1a42427d25d105c8d4625079a7753e29b1c441c46eda0
-
SSDEEP
98304:nNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllH:NW
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\guhunvc = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2684 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\guhunvc\ImagePath = "C:\\Windows\\SysWOW64\\guhunvc\\myxlwgoi.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2544 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
myxlwgoi.exepid process 2944 myxlwgoi.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
myxlwgoi.exedescription pid process target process PID 2944 set thread context of 2544 2944 myxlwgoi.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2672 sc.exe 2556 sc.exe 2440 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exemyxlwgoi.exedescription pid process target process PID 1444 wrote to memory of 2524 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2524 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2524 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2524 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2572 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2572 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2572 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2572 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe cmd.exe PID 1444 wrote to memory of 2672 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2672 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2672 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2672 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2556 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2556 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2556 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2556 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2440 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2440 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2440 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2440 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe sc.exe PID 1444 wrote to memory of 2684 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe netsh.exe PID 1444 wrote to memory of 2684 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe netsh.exe PID 1444 wrote to memory of 2684 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe netsh.exe PID 1444 wrote to memory of 2684 1444 f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe netsh.exe PID 2944 wrote to memory of 2544 2944 myxlwgoi.exe svchost.exe PID 2944 wrote to memory of 2544 2944 myxlwgoi.exe svchost.exe PID 2944 wrote to memory of 2544 2944 myxlwgoi.exe svchost.exe PID 2944 wrote to memory of 2544 2944 myxlwgoi.exe svchost.exe PID 2944 wrote to memory of 2544 2944 myxlwgoi.exe svchost.exe PID 2944 wrote to memory of 2544 2944 myxlwgoi.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\guhunvc\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\myxlwgoi.exe" C:\Windows\SysWOW64\guhunvc\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create guhunvc binPath= "C:\Windows\SysWOW64\guhunvc\myxlwgoi.exe /d\"C:\Users\Admin\AppData\Local\Temp\f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description guhunvc "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start guhunvc2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\guhunvc\myxlwgoi.exeC:\Windows\SysWOW64\guhunvc\myxlwgoi.exe /d"C:\Users\Admin\AppData\Local\Temp\f2c2dfad2a7c617f933121023f9615a0_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\myxlwgoi.exeFilesize
14.7MB
MD5ff91d2da2b943d496422957aff8f56c7
SHA187d6c6c5c04a8a223ce8c20759d265173e5c3dbb
SHA2565ff8b09c0012c205e084ce72b9acb688875484f8e2ec7b6ecae3e872d8fe6fdf
SHA5121290a7e2e1491666e7b1c84b0c09a0316d0ff8928ced4b2882105360b75ff34791ff3d6a0dc408460cd7d78e1818fcd93fd39d34b9a96147b23428b7b3ec3419
-
memory/1444-1-0x0000000003860000-0x0000000003960000-memory.dmpFilesize
1024KB
-
memory/1444-2-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/1444-4-0x0000000000400000-0x00000000036CD000-memory.dmpFilesize
50.8MB
-
memory/1444-6-0x0000000000400000-0x00000000036CD000-memory.dmpFilesize
50.8MB
-
memory/2544-10-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2544-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2544-13-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2544-18-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2544-19-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2544-20-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2944-9-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/2944-15-0x0000000000400000-0x00000000036CD000-memory.dmpFilesize
50.8MB
-
memory/2944-17-0x0000000000400000-0x00000000036CD000-memory.dmpFilesize
50.8MB