Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 09:16
Static task
static1
Behavioral task
behavioral1
Sample
f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe
-
Size
12.5MB
-
MD5
f57318e139826014dbcc8f0eaad35e40
-
SHA1
39d26c2ffbb92c2f5b443ae094a84b1bf760aea2
-
SHA256
97d0ba8f894b85f3f70a6178237202b905ee26b085419fef0710a06f2b715e07
-
SHA512
e0a9568659e0ebd2a64b4c4e1fb070e2c4b946ec10a63b301221b5b9528c532da9ea90f535a8037e514faf210649a214bca001d3e4b45f1ac5dd09640a345b4c
-
SSDEEP
49152:g8yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyye:g
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4996 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lbemzbyj\ImagePath = "C:\\Windows\\SysWOW64\\lbemzbyj\\noqrlojb.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1312 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
noqrlojb.exepid process 4016 noqrlojb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
noqrlojb.exedescription pid process target process PID 4016 set thread context of 1312 4016 noqrlojb.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4496 sc.exe 4208 sc.exe 4652 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1920 4728 WerFault.exe f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe 4100 4016 WerFault.exe noqrlojb.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exenoqrlojb.exedescription pid process target process PID 4728 wrote to memory of 1844 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 1844 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 1844 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 5036 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 5036 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 5036 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 4496 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4496 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4496 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4208 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4208 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4208 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4652 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4652 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4652 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe sc.exe PID 4728 wrote to memory of 4996 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe netsh.exe PID 4728 wrote to memory of 4996 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe netsh.exe PID 4728 wrote to memory of 4996 4728 f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe netsh.exe PID 4016 wrote to memory of 1312 4016 noqrlojb.exe svchost.exe PID 4016 wrote to memory of 1312 4016 noqrlojb.exe svchost.exe PID 4016 wrote to memory of 1312 4016 noqrlojb.exe svchost.exe PID 4016 wrote to memory of 1312 4016 noqrlojb.exe svchost.exe PID 4016 wrote to memory of 1312 4016 noqrlojb.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lbemzbyj\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\noqrlojb.exe" C:\Windows\SysWOW64\lbemzbyj\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create lbemzbyj binPath= "C:\Windows\SysWOW64\lbemzbyj\noqrlojb.exe /d\"C:\Users\Admin\AppData\Local\Temp\f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description lbemzbyj "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start lbemzbyj2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 12322⤵
- Program crash
-
C:\Windows\SysWOW64\lbemzbyj\noqrlojb.exeC:\Windows\SysWOW64\lbemzbyj\noqrlojb.exe /d"C:\Users\Admin\AppData\Local\Temp\f57318e139826014dbcc8f0eaad35e40_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 5082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4728 -ip 47281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4016 -ip 40161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\noqrlojb.exeFilesize
13.9MB
MD5f29de2ea714f8f11b291e2666c24e85d
SHA16f8231b3ec8bd72b84291d2a2369226002528345
SHA2561370f14abb9a82f47780c0e7cc2a74fdc983182f2f22bb9abde073d189437cba
SHA512c8870ca6474fd3904a5b27323897b63a06d1b79adeef85b19e4f305fdc1c0fcd6a82723dc6b3fed035f3b67d6c80b9735aea34d1dd1dbb5f41860458f5ecf541
-
memory/1312-11-0x00000000009D0000-0x00000000009E5000-memory.dmpFilesize
84KB
-
memory/1312-16-0x00000000009D0000-0x00000000009E5000-memory.dmpFilesize
84KB
-
memory/1312-18-0x00000000009D0000-0x00000000009E5000-memory.dmpFilesize
84KB
-
memory/1312-19-0x00000000009D0000-0x00000000009E5000-memory.dmpFilesize
84KB
-
memory/4016-12-0x0000000000400000-0x00000000008E9000-memory.dmpFilesize
4.9MB
-
memory/4016-10-0x0000000000A90000-0x0000000000B90000-memory.dmpFilesize
1024KB
-
memory/4016-17-0x0000000000400000-0x00000000008E9000-memory.dmpFilesize
4.9MB
-
memory/4728-4-0x0000000000400000-0x00000000008E9000-memory.dmpFilesize
4.9MB
-
memory/4728-2-0x0000000000B50000-0x0000000000B63000-memory.dmpFilesize
76KB
-
memory/4728-7-0x0000000000400000-0x00000000008E9000-memory.dmpFilesize
4.9MB
-
memory/4728-8-0x0000000000B50000-0x0000000000B63000-memory.dmpFilesize
76KB
-
memory/4728-1-0x0000000000C30000-0x0000000000D30000-memory.dmpFilesize
1024KB