Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 07:35
Static task
static1
Behavioral task
behavioral1
Sample
f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe
-
Size
14.8MB
-
MD5
f3015e7fa8a419f7f1110881d4a15abf
-
SHA1
2bb0e90e81ce18596a98bb7f72eaabf63e1147f1
-
SHA256
c89d2e5ffe20c5e936a9df89dbe29d684442bdb0ec0401fdf7e34e25963866fc
-
SHA512
ed53c70614f15716e277d984d5d3131af53c407befcd72ad7398b06da3f18af7fd95d58db5eeb9c0cd16a3dc6f8334576c1236f9881738fd0785b9d3337bd06d
-
SSDEEP
49152:Tuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu:
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\kibygykc = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2428 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kibygykc\ImagePath = "C:\\Windows\\SysWOW64\\kibygykc\\revewjlf.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1668 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
revewjlf.exepid process 2688 revewjlf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
revewjlf.exedescription pid process target process PID 2688 set thread context of 1668 2688 revewjlf.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2856 sc.exe 2724 sc.exe 2512 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exerevewjlf.exedescription pid process target process PID 2340 wrote to memory of 2736 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2736 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2736 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2736 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2548 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2548 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2548 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2548 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe cmd.exe PID 2340 wrote to memory of 2724 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2724 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2724 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2724 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2512 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2512 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2512 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2512 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2856 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2856 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2856 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2856 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe sc.exe PID 2340 wrote to memory of 2428 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe netsh.exe PID 2340 wrote to memory of 2428 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe netsh.exe PID 2340 wrote to memory of 2428 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe netsh.exe PID 2340 wrote to memory of 2428 2340 f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe netsh.exe PID 2688 wrote to memory of 1668 2688 revewjlf.exe svchost.exe PID 2688 wrote to memory of 1668 2688 revewjlf.exe svchost.exe PID 2688 wrote to memory of 1668 2688 revewjlf.exe svchost.exe PID 2688 wrote to memory of 1668 2688 revewjlf.exe svchost.exe PID 2688 wrote to memory of 1668 2688 revewjlf.exe svchost.exe PID 2688 wrote to memory of 1668 2688 revewjlf.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kibygykc\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\revewjlf.exe" C:\Windows\SysWOW64\kibygykc\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create kibygykc binPath= "C:\Windows\SysWOW64\kibygykc\revewjlf.exe /d\"C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description kibygykc "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start kibygykc2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\kibygykc\revewjlf.exeC:\Windows\SysWOW64\kibygykc\revewjlf.exe /d"C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\revewjlf.exeFilesize
12.9MB
MD5b122a6cddd7b94fdeb66ea811f4fffe6
SHA1d2f8233fea2e67465916f8cf8cd17297b03c6158
SHA256e03b71c0d5ba887422fdcd0eccd8fd2e5365b28d43ad3fbb04a395e745900c52
SHA512d66ebba3c59b1540676f3daad74aad76617baec46baa2a1e9f536b604a0bb6e9343877ea7dd8e0352c4595914a94136004597c167c14cbf5196bec8862535d07
-
memory/1668-21-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/1668-11-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/1668-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1668-22-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/1668-15-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/1668-20-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2340-2-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2340-4-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB
-
memory/2340-9-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2340-8-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB
-
memory/2340-1-0x0000000002D80000-0x0000000002E80000-memory.dmpFilesize
1024KB
-
memory/2688-10-0x0000000002D00000-0x0000000002E00000-memory.dmpFilesize
1024KB
-
memory/2688-18-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB
-
memory/2688-14-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB