Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 16:21
Static task
static1
Behavioral task
behavioral1
Sample
f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe
-
Size
268KB
-
MD5
f855c178ba66fef7013303cca97a1a4e
-
SHA1
26756ba97d394b418af1a6772a226ff2f2c18b55
-
SHA256
e87a5c719ac7af99f1478732889d5df0a275315b42b3b9aecc8b91333bd9c0af
-
SHA512
2ede9d6202ab29b1724fa57d3ecc947bf6fe45c1052aefdd70a6f6f53dd9e3e0ed785faaf7e05eb46fa56c327a355b92b3f2b219f0affa85d31c192b29cd2531
-
SSDEEP
6144:jqs4O6bVLJnq2splH1e24EafBw0+8WloM+nCbVV:1sZL0dfJ4EaZZ+9oM+nmV
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4272 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lvsxnppk\ImagePath = "C:\\Windows\\SysWOW64\\lvsxnppk\\umrryqko.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 4476 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1072 umrryqko.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1072 set thread context of 4476 1072 umrryqko.exe 108 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4512 sc.exe 8 sc.exe 1436 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1804 628 WerFault.exe 90 3744 1072 WerFault.exe 104 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 628 wrote to memory of 2912 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 91 PID 628 wrote to memory of 2912 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 91 PID 628 wrote to memory of 2912 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 91 PID 628 wrote to memory of 4232 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 118 PID 628 wrote to memory of 4232 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 118 PID 628 wrote to memory of 4232 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 118 PID 628 wrote to memory of 1436 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 95 PID 628 wrote to memory of 1436 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 95 PID 628 wrote to memory of 1436 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 95 PID 628 wrote to memory of 4512 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 97 PID 628 wrote to memory of 4512 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 97 PID 628 wrote to memory of 4512 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 97 PID 628 wrote to memory of 8 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 99 PID 628 wrote to memory of 8 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 99 PID 628 wrote to memory of 8 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 99 PID 628 wrote to memory of 4272 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 101 PID 628 wrote to memory of 4272 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 101 PID 628 wrote to memory of 4272 628 f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe 101 PID 1072 wrote to memory of 4476 1072 umrryqko.exe 108 PID 1072 wrote to memory of 4476 1072 umrryqko.exe 108 PID 1072 wrote to memory of 4476 1072 umrryqko.exe 108 PID 1072 wrote to memory of 4476 1072 umrryqko.exe 108 PID 1072 wrote to memory of 4476 1072 umrryqko.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lvsxnppk\2⤵PID:2912
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\umrryqko.exe" C:\Windows\SysWOW64\lvsxnppk\2⤵PID:4232
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create lvsxnppk binPath= "C:\Windows\SysWOW64\lvsxnppk\umrryqko.exe /d\"C:\Users\Admin\AppData\Local\Temp\f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1436
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description lvsxnppk "wifi internet conection"2⤵
- Launches sc.exe
PID:4512
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start lvsxnppk2⤵
- Launches sc.exe
PID:8
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 12042⤵
- Program crash
PID:1804
-
-
C:\Windows\SysWOW64\lvsxnppk\umrryqko.exeC:\Windows\SysWOW64\lvsxnppk\umrryqko.exe /d"C:\Users\Admin\AppData\Local\Temp\f855c178ba66fef7013303cca97a1a4e_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 5202⤵
- Program crash
PID:3744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 628 -ip 6281⤵PID:4076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1072 -ip 10721⤵PID:700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:4232
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.3MB
MD5ff5e0efba609b1678240fe358aef0bf8
SHA10892171dd77e769ed2e565eb68fa657de6cb9416
SHA2561ed26b6128aabcbb763a84f4d5910b23a6257d98a6a0916bff0e3b90c266678b
SHA512130b6ac040b84af48c893038fbd43971766f27aa2086812d7e3cf3dae695eebc8d4d6676a0dc6949ca1f09678aaaa7f6c8615f678794da9c8a6d3a8a9c4a8fc3
-
Filesize
8.8MB
MD52bf13e8524c23823e37f0d8ceef15b27
SHA1a98e0483f93c220f799f255f2298c21cd544abd1
SHA2565e2449dff82b61a531f4a015e6f188c3a6e92ee8c5e618e7e15e3f07a73d9674
SHA5122484965ddc53f1c7bdb9a5230e96376b70e234f087d90f495bba7c28b0a3095bb80a9fcc6b6c49d04bc96d5f75b2bc2aa67b6faf2ad16b5dd05ce9a3d920ad4d