Analysis
-
max time kernel
158s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 19:18
Static task
static1
Behavioral task
behavioral1
Sample
f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe
-
Size
12.9MB
-
MD5
f427dd2a74d5dc82ea884b973d2df32b
-
SHA1
74dbbe53e39aba884a87de297cf6e71fe0a7929a
-
SHA256
0554a5c223f9ad4748018db751a20f23589c8ed93a5f118941ea6e5a0b794cd1
-
SHA512
0630e26f057741e8688205d3994c66429804b89aa0d72380e892aecbd275dc8f7d4cf0e2d61eb57855b50aab910208a84b125aa16f76041504e108612cfc934e
-
SSDEEP
24576:CjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:Cnh
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2556 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nfsebuuh\ImagePath = "C:\\Windows\\SysWOW64\\nfsebuuh\\avfiwhhp.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
avfiwhhp.exepid process 1968 avfiwhhp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
avfiwhhp.exedescription pid process target process PID 1968 set thread context of 4520 1968 avfiwhhp.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4392 sc.exe 1672 sc.exe 2380 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exeavfiwhhp.exedescription pid process target process PID 1076 wrote to memory of 2768 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe cmd.exe PID 1076 wrote to memory of 2768 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe cmd.exe PID 1076 wrote to memory of 2768 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe cmd.exe PID 1076 wrote to memory of 1264 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe cmd.exe PID 1076 wrote to memory of 1264 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe cmd.exe PID 1076 wrote to memory of 1264 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe cmd.exe PID 1076 wrote to memory of 2380 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 2380 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 2380 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 4392 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 4392 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 4392 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 1672 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 1672 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 1672 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe sc.exe PID 1076 wrote to memory of 2556 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe netsh.exe PID 1076 wrote to memory of 2556 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe netsh.exe PID 1076 wrote to memory of 2556 1076 f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe netsh.exe PID 1968 wrote to memory of 4520 1968 avfiwhhp.exe svchost.exe PID 1968 wrote to memory of 4520 1968 avfiwhhp.exe svchost.exe PID 1968 wrote to memory of 4520 1968 avfiwhhp.exe svchost.exe PID 1968 wrote to memory of 4520 1968 avfiwhhp.exe svchost.exe PID 1968 wrote to memory of 4520 1968 avfiwhhp.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nfsebuuh\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\avfiwhhp.exe" C:\Windows\SysWOW64\nfsebuuh\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create nfsebuuh binPath= "C:\Windows\SysWOW64\nfsebuuh\avfiwhhp.exe /d\"C:\Users\Admin\AppData\Local\Temp\f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description nfsebuuh "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start nfsebuuh2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\nfsebuuh\avfiwhhp.exeC:\Windows\SysWOW64\nfsebuuh\avfiwhhp.exe /d"C:\Users\Admin\AppData\Local\Temp\f427dd2a74d5dc82ea884b973d2df32b_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\avfiwhhp.exeFilesize
13.2MB
MD528c5f4158d840f082fe8c5235ea73fb5
SHA1509a4ff3451a5f59384b54a1a90f07082a220284
SHA2568039c6be3fa1cb6124169f9ce8e39fe0482d88114a087a5b47227dc17aa1aa4e
SHA51296c9235b6bdbaf2bf07d04766fa7e19c1614e65127e5e7b989bae36e7734efcb5f6a540689e74f3db40c6ffe7993fc6d02ea91b4bf2973928406ee9c69d16cf7
-
memory/1076-1-0x0000000000700000-0x0000000000800000-memory.dmpFilesize
1024KB
-
memory/1076-2-0x00000000021B0000-0x00000000021C3000-memory.dmpFilesize
76KB
-
memory/1076-3-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1076-5-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1076-9-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1076-21-0x0000000000700000-0x0000000000800000-memory.dmpFilesize
1024KB
-
memory/1968-12-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1968-11-0x00000000005C0000-0x00000000005D3000-memory.dmpFilesize
76KB
-
memory/1968-17-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1968-10-0x0000000000780000-0x0000000000880000-memory.dmpFilesize
1024KB
-
memory/4520-13-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/4520-16-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/4520-18-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/4520-19-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/4520-28-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB