Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 08:24
Static task
static1
Behavioral task
behavioral1
Sample
f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe
-
Size
13.7MB
-
MD5
f315b58d3cfb7541cc071900a1e00671
-
SHA1
59e2447b1d9be5bdadbbd1b67da60631f6e123eb
-
SHA256
c09c6a7691b46bfea06316df79f17ed85a35610145b7e916417dfc557418bba2
-
SHA512
03d9bcec97ff66d779685f0854d1fce707a1c0c08d4b0f3e1298ea9f9e77cb0ed44efb1190f8029f9f3d27808d7c880f6dbfdccb0493dea981f10dda7fb12447
-
SSDEEP
49152:g1yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllln:gA
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qaprqwne = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2572 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qaprqwne\ImagePath = "C:\\Windows\\SysWOW64\\qaprqwne\\vppgrart.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2568 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
vppgrart.exepid process 2080 vppgrart.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
vppgrart.exedescription pid process target process PID 2080 set thread context of 2568 2080 vppgrart.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2128 sc.exe 2664 sc.exe 2708 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exevppgrart.exedescription pid process target process PID 2932 wrote to memory of 2540 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2540 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2540 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2540 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2640 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2640 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2640 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2640 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe cmd.exe PID 2932 wrote to memory of 2128 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2128 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2128 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2128 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2664 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2664 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2664 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2664 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2708 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2708 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2708 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2708 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe sc.exe PID 2932 wrote to memory of 2572 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe netsh.exe PID 2932 wrote to memory of 2572 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe netsh.exe PID 2932 wrote to memory of 2572 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe netsh.exe PID 2932 wrote to memory of 2572 2932 f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe netsh.exe PID 2080 wrote to memory of 2568 2080 vppgrart.exe svchost.exe PID 2080 wrote to memory of 2568 2080 vppgrart.exe svchost.exe PID 2080 wrote to memory of 2568 2080 vppgrart.exe svchost.exe PID 2080 wrote to memory of 2568 2080 vppgrart.exe svchost.exe PID 2080 wrote to memory of 2568 2080 vppgrart.exe svchost.exe PID 2080 wrote to memory of 2568 2080 vppgrart.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qaprqwne\2⤵PID:2540
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vppgrart.exe" C:\Windows\SysWOW64\qaprqwne\2⤵PID:2640
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create qaprqwne binPath= "C:\Windows\SysWOW64\qaprqwne\vppgrart.exe /d\"C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2128 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description qaprqwne "wifi internet conection"2⤵
- Launches sc.exe
PID:2664 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start qaprqwne2⤵
- Launches sc.exe
PID:2708 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2572
-
C:\Windows\SysWOW64\qaprqwne\vppgrart.exeC:\Windows\SysWOW64\qaprqwne\vppgrart.exe /d"C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2568
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.4MB
MD52d5e9ceb6f9ebb5632717586f70d1e69
SHA14f4832fbe1659d153f265a0038fe88159a623f00
SHA2561bd52034a5801fbea194eeb69724fe758d942f3a9116c24463adc92e4a22d4fd
SHA512a86d0e232c3c5a7ae35e467e791ecf746468001eb8d880f4e0eae661adb37d35da313e6cf0ac25ebeb08bbf487b27f3194a6963433cae176a4b347dcaedd4c8b