Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 09:48
Static task
static1
Behavioral task
behavioral1
Sample
f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe
-
Size
10.3MB
-
MD5
f57f119b34f2ff7f7770200b1eba0e30
-
SHA1
ed3398edb4b2dd9fcf7130f573b216c88e038ad9
-
SHA256
379955aa858a8443401e40f6576aa54c9243fe38d4dd761f41ab0b5847c2a6fc
-
SHA512
31e75d262af0fc371774bd59287afdb7727ddff3cde18da1df4c0cceca86a23cd0bec60ba3b1c178ae9efea6f8710a729e6da993a30e6d6cb3d1e36a0a561b0a
-
SSDEEP
49152:i1yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:iA
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2616 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zzzqhnfn\ImagePath = "C:\\Windows\\SysWOW64\\zzzqhnfn\\qlphxiki.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 5940 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
qlphxiki.exepid process 2224 qlphxiki.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qlphxiki.exedescription pid process target process PID 2224 set thread context of 5940 2224 qlphxiki.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4572 sc.exe 5136 sc.exe 5440 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3144 2620 WerFault.exe f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe 4956 2224 WerFault.exe qlphxiki.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exeqlphxiki.exedescription pid process target process PID 2620 wrote to memory of 2900 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe cmd.exe PID 2620 wrote to memory of 2900 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe cmd.exe PID 2620 wrote to memory of 2900 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe cmd.exe PID 2620 wrote to memory of 4692 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe cmd.exe PID 2620 wrote to memory of 4692 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe cmd.exe PID 2620 wrote to memory of 4692 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe cmd.exe PID 2620 wrote to memory of 4572 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 4572 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 4572 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 5136 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 5136 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 5136 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 5440 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 5440 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 5440 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe sc.exe PID 2620 wrote to memory of 2616 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe netsh.exe PID 2620 wrote to memory of 2616 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe netsh.exe PID 2620 wrote to memory of 2616 2620 f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe netsh.exe PID 2224 wrote to memory of 5940 2224 qlphxiki.exe svchost.exe PID 2224 wrote to memory of 5940 2224 qlphxiki.exe svchost.exe PID 2224 wrote to memory of 5940 2224 qlphxiki.exe svchost.exe PID 2224 wrote to memory of 5940 2224 qlphxiki.exe svchost.exe PID 2224 wrote to memory of 5940 2224 qlphxiki.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zzzqhnfn\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qlphxiki.exe" C:\Windows\SysWOW64\zzzqhnfn\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create zzzqhnfn binPath= "C:\Windows\SysWOW64\zzzqhnfn\qlphxiki.exe /d\"C:\Users\Admin\AppData\Local\Temp\f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description zzzqhnfn "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start zzzqhnfn2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\zzzqhnfn\qlphxiki.exeC:\Windows\SysWOW64\zzzqhnfn\qlphxiki.exe /d"C:\Users\Admin\AppData\Local\Temp\f57f119b34f2ff7f7770200b1eba0e30_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 5202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2620 -ip 26201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2224 -ip 22241⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3632 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qlphxiki.exeFilesize
11.8MB
MD5c12e4e0d3180145043c0b4809d52ba2a
SHA13e37f4160b61d2e1f1dc66b4a1e4cea7b1d29e90
SHA256931cdb58c296028d9084f30ef771f48e017de0e7d55980fa3bfa66591b73fc5a
SHA51240827dea43d7ce305f609e494b7c4723f72e8c19e1e0aad9a2e53f86da27e1392ff3eaa87bd94bd8cbaf9443e56f9c056cf11997c9426acc078a25ac745d4908
-
memory/2224-10-0x0000000000C80000-0x0000000000D80000-memory.dmpFilesize
1024KB
-
memory/2224-13-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB
-
memory/2224-17-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB
-
memory/2620-4-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB
-
memory/2620-2-0x0000000000DC0000-0x0000000000DD3000-memory.dmpFilesize
76KB
-
memory/2620-7-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB
-
memory/2620-8-0x0000000000DC0000-0x0000000000DD3000-memory.dmpFilesize
76KB
-
memory/2620-1-0x0000000000E10000-0x0000000000F10000-memory.dmpFilesize
1024KB
-
memory/5940-16-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/5940-18-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/5940-11-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB
-
memory/5940-19-0x00000000004C0000-0x00000000004D5000-memory.dmpFilesize
84KB