Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 01:33
Static task
static1
Behavioral task
behavioral1
Sample
f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe
-
Size
12.9MB
-
MD5
f4c26a587ceedc4e1f881db4635d2e46
-
SHA1
222207a71d9e9e3eb534b4fdbd644e848f1c24e0
-
SHA256
683fa1172ed26a953994f43177ceff28ee665a14736e73fc6f91f9fe330545a0
-
SHA512
722be7f412946c0b4a29b611afea11f0d5ca8b4d3263904299a2102a7a58dd1cb5a115f56a298820ade78b89c229e372189648db33de1cd2c13a8b09cc2a2463
-
SSDEEP
196608:vV8YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY/:
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1048 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wtxktimt\ImagePath = "C:\\Windows\\SysWOW64\\wtxktimt\\xhcxoohn.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2320 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
xhcxoohn.exepid process 2708 xhcxoohn.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
xhcxoohn.exedescription pid process target process PID 2708 set thread context of 2320 2708 xhcxoohn.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 3528 sc.exe 4908 sc.exe 3044 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1444 3220 WerFault.exe f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe 3980 2708 WerFault.exe xhcxoohn.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exexhcxoohn.exedescription pid process target process PID 3220 wrote to memory of 4328 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe cmd.exe PID 3220 wrote to memory of 4328 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe cmd.exe PID 3220 wrote to memory of 4328 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe cmd.exe PID 3220 wrote to memory of 1208 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe cmd.exe PID 3220 wrote to memory of 1208 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe cmd.exe PID 3220 wrote to memory of 1208 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe cmd.exe PID 3220 wrote to memory of 3044 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 3044 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 3044 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 3528 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 3528 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 3528 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 4908 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 4908 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 4908 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe sc.exe PID 3220 wrote to memory of 1048 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe netsh.exe PID 3220 wrote to memory of 1048 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe netsh.exe PID 3220 wrote to memory of 1048 3220 f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe netsh.exe PID 2708 wrote to memory of 2320 2708 xhcxoohn.exe svchost.exe PID 2708 wrote to memory of 2320 2708 xhcxoohn.exe svchost.exe PID 2708 wrote to memory of 2320 2708 xhcxoohn.exe svchost.exe PID 2708 wrote to memory of 2320 2708 xhcxoohn.exe svchost.exe PID 2708 wrote to memory of 2320 2708 xhcxoohn.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wtxktimt\2⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xhcxoohn.exe" C:\Windows\SysWOW64\wtxktimt\2⤵PID:1208
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create wtxktimt binPath= "C:\Windows\SysWOW64\wtxktimt\xhcxoohn.exe /d\"C:\Users\Admin\AppData\Local\Temp\f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3044 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description wtxktimt "wifi internet conection"2⤵
- Launches sc.exe
PID:3528 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start wtxktimt2⤵
- Launches sc.exe
PID:4908 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:1048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 12242⤵
- Program crash
PID:1444
-
C:\Windows\SysWOW64\wtxktimt\xhcxoohn.exeC:\Windows\SysWOW64\wtxktimt\xhcxoohn.exe /d"C:\Users\Admin\AppData\Local\Temp\f4c26a587ceedc4e1f881db4635d2e46_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:2320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 5202⤵
- Program crash
PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3220 -ip 32201⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2708 -ip 27081⤵PID:3840
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\xhcxoohn.exeFilesize
11.2MB
MD5f3aebf052bf1c10555f6095b849d2d8a
SHA18aa5d1ed81ee89beca5c5b9bcfb3d94ff690632e
SHA2565d2b094f54e6b8429da8a49801875bb7ebf8d9dcd903c00b8f093115462f39e9
SHA512abda6250753ab3a5288ae2f59c34e928a215b7bf387d30d4fb3cd21bcb9367f3e7d1364109a37324377e4116294b2d3dbf527502988458ceb478339cb4e35fe7
-
memory/2320-16-0x0000000000A70000-0x0000000000A85000-memory.dmpFilesize
84KB
-
memory/2320-11-0x0000000000A70000-0x0000000000A85000-memory.dmpFilesize
84KB
-
memory/2320-18-0x0000000000A70000-0x0000000000A85000-memory.dmpFilesize
84KB
-
memory/2320-19-0x0000000000A70000-0x0000000000A85000-memory.dmpFilesize
84KB
-
memory/2708-10-0x0000000000BF0000-0x0000000000CF0000-memory.dmpFilesize
1024KB
-
memory/2708-12-0x0000000000400000-0x00000000008EA000-memory.dmpFilesize
4.9MB
-
memory/2708-17-0x0000000000400000-0x00000000008EA000-memory.dmpFilesize
4.9MB
-
memory/3220-4-0x0000000000400000-0x00000000008EA000-memory.dmpFilesize
4.9MB
-
memory/3220-2-0x0000000002630000-0x0000000002643000-memory.dmpFilesize
76KB
-
memory/3220-7-0x0000000000400000-0x00000000008EA000-memory.dmpFilesize
4.9MB
-
memory/3220-8-0x0000000002630000-0x0000000002643000-memory.dmpFilesize
76KB
-
memory/3220-1-0x0000000000A00000-0x0000000000B00000-memory.dmpFilesize
1024KB