Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 10:32
Static task
static1
Behavioral task
behavioral1
Sample
f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe
-
Size
14.9MB
-
MD5
f34d8f6b5347bdcd842d87c92c707971
-
SHA1
0ef31e983de6af6f1ddd10f12627c934b2bcd117
-
SHA256
2b7573c9e8ecc29efd019b7aa743c09a45cb4ec3974e626cd6be6d044eaf4011
-
SHA512
c98f57420fb64dae46616d3405fa7035921592cf88b3d4da22bc5e704992b5c21540194ab13593e98cda9550cf3bb22ca8615aab7441985abe5805c61393c098
-
SSDEEP
24576:djCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:d/D
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\bjnoqncr = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2928 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\bjnoqncr\ImagePath = "C:\\Windows\\SysWOW64\\bjnoqncr\\jnqmyhea.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2084 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
jnqmyhea.exepid process 2536 jnqmyhea.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jnqmyhea.exedescription pid process target process PID 2536 set thread context of 2084 2536 jnqmyhea.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2584 sc.exe 2676 sc.exe 2552 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exejnqmyhea.exedescription pid process target process PID 1644 wrote to memory of 2528 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2528 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2528 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2528 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2660 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2660 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2660 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2660 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe cmd.exe PID 1644 wrote to memory of 2584 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2584 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2584 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2584 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2676 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2676 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2676 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2676 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2552 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2552 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2552 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2552 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe sc.exe PID 1644 wrote to memory of 2928 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe netsh.exe PID 1644 wrote to memory of 2928 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe netsh.exe PID 1644 wrote to memory of 2928 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe netsh.exe PID 1644 wrote to memory of 2928 1644 f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe netsh.exe PID 2536 wrote to memory of 2084 2536 jnqmyhea.exe svchost.exe PID 2536 wrote to memory of 2084 2536 jnqmyhea.exe svchost.exe PID 2536 wrote to memory of 2084 2536 jnqmyhea.exe svchost.exe PID 2536 wrote to memory of 2084 2536 jnqmyhea.exe svchost.exe PID 2536 wrote to memory of 2084 2536 jnqmyhea.exe svchost.exe PID 2536 wrote to memory of 2084 2536 jnqmyhea.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bjnoqncr\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jnqmyhea.exe" C:\Windows\SysWOW64\bjnoqncr\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create bjnoqncr binPath= "C:\Windows\SysWOW64\bjnoqncr\jnqmyhea.exe /d\"C:\Users\Admin\AppData\Local\Temp\f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description bjnoqncr "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start bjnoqncr2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\bjnoqncr\jnqmyhea.exeC:\Windows\SysWOW64\bjnoqncr\jnqmyhea.exe /d"C:\Users\Admin\AppData\Local\Temp\f34d8f6b5347bdcd842d87c92c707971_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jnqmyhea.exeFilesize
12.0MB
MD5910118cffb237f83756deb081ecee84b
SHA1dc463bfda5b0fa4e4230dbf86bb7a0c6763a7e3e
SHA256dda56b6b6807419a79491f22c80ac7a4780aceeea87e1e2f8c52db2e085c4461
SHA512f4e02f1f81151b3795ca2a920ef3a7de181c14c764a093463e5b6c9c6d533899b6ddbe271be92899145ee30e81ba2bbea8b47f4f6f359d186a29c9d598b7a54d
-
memory/1644-1-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB
-
memory/1644-2-0x00000000001B0000-0x00000000001C3000-memory.dmpFilesize
76KB
-
memory/1644-4-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1644-7-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/2084-14-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2084-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2084-11-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2084-18-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2084-19-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2084-20-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2084-21-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2536-10-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/2536-9-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/2536-15-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB