Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 15:42
Static task
static1
Behavioral task
behavioral1
Sample
f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe
-
Size
14.9MB
-
MD5
f3cc40d0eeb5bc12926970e04a727ee5
-
SHA1
00a858fd157c5a5d663ab170bdfabb99088b0568
-
SHA256
e5badbae1af7bd777e66282cf56e38e6a5bc75063f5b9342b4bd6571836cea63
-
SHA512
78d2876fa7ccf822ac4cfdb8e42e0c6b4b5e4b3a344c1337d05d0e86d849a9392e541bc45aa95fcae0d6fd84383460efbcd60612a5a4e87748aecd0e0b5d8840
-
SSDEEP
49152:r8KGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGy:r8
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\diqghnur = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2528 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\diqghnur\ImagePath = "C:\\Windows\\SysWOW64\\diqghnur\\oligsdsg.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2488 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
oligsdsg.exepid process 2752 oligsdsg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
oligsdsg.exedescription pid process target process PID 2752 set thread context of 2488 2752 oligsdsg.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1956 sc.exe 2640 sc.exe 2728 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exeoligsdsg.exedescription pid process target process PID 2248 wrote to memory of 2572 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2572 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2572 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 2572 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 1244 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 1244 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 1244 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 1244 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe cmd.exe PID 2248 wrote to memory of 1956 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 1956 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 1956 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 1956 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2640 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2640 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2640 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2640 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2728 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2728 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2728 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2728 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe sc.exe PID 2248 wrote to memory of 2528 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe netsh.exe PID 2248 wrote to memory of 2528 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe netsh.exe PID 2248 wrote to memory of 2528 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe netsh.exe PID 2248 wrote to memory of 2528 2248 f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe netsh.exe PID 2752 wrote to memory of 2488 2752 oligsdsg.exe svchost.exe PID 2752 wrote to memory of 2488 2752 oligsdsg.exe svchost.exe PID 2752 wrote to memory of 2488 2752 oligsdsg.exe svchost.exe PID 2752 wrote to memory of 2488 2752 oligsdsg.exe svchost.exe PID 2752 wrote to memory of 2488 2752 oligsdsg.exe svchost.exe PID 2752 wrote to memory of 2488 2752 oligsdsg.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\diqghnur\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oligsdsg.exe" C:\Windows\SysWOW64\diqghnur\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create diqghnur binPath= "C:\Windows\SysWOW64\diqghnur\oligsdsg.exe /d\"C:\Users\Admin\AppData\Local\Temp\f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description diqghnur "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start diqghnur2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\diqghnur\oligsdsg.exeC:\Windows\SysWOW64\diqghnur\oligsdsg.exe /d"C:\Users\Admin\AppData\Local\Temp\f3cc40d0eeb5bc12926970e04a727ee5_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\oligsdsg.exeFilesize
14.5MB
MD5bb679f9d408fa1d9b4c6a080927158e5
SHA1acb4fa6de84fc585ca57e7ddb91dbb29be159e9e
SHA2563198ce69785bcf1ebd7891996bd3333a7afbe72f3607ad755f839b68b16c0e10
SHA5125a4238cd37bf6607b5b5c4de58a44cf71a54479cf84df1e37a64a03c2561d329e76ee07a2b5e45d8b133027218a95414a80d28b62734ffafcfda91889efc80ee
-
memory/2248-1-0x0000000000D20000-0x0000000000E20000-memory.dmpFilesize
1024KB
-
memory/2248-3-0x0000000000230000-0x0000000000243000-memory.dmpFilesize
76KB
-
memory/2248-4-0x0000000000400000-0x0000000000C14000-memory.dmpFilesize
8.1MB
-
memory/2248-7-0x0000000000400000-0x0000000000C14000-memory.dmpFilesize
8.1MB
-
memory/2488-10-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2488-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2488-14-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2488-18-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2488-19-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2488-20-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2488-21-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2752-9-0x0000000000DC0000-0x0000000000EC0000-memory.dmpFilesize
1024KB
-
memory/2752-11-0x0000000000400000-0x0000000000C14000-memory.dmpFilesize
8.1MB
-
memory/2752-16-0x0000000000400000-0x0000000000C14000-memory.dmpFilesize
8.1MB