Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 17:07
Static task
static1
Behavioral task
behavioral1
Sample
f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe
-
Size
13.7MB
-
MD5
f869bf89806a1807f9f293f862ce247d
-
SHA1
ad7e03dcfba00ae87b7ac0917ce4fb71692d6908
-
SHA256
2f05f2d8f91e7938437ff58cfa4aecae41d17e18d1abc37a2f70f24227b44230
-
SHA512
5b0b072562e5c2970714d9efefaf022b79f978bc5241e1d0d1b83e66759ec4a75f7fec1e200601caa7af9f0b9cb09951af62b44f788f9bac9ffeeb75275af566
-
SSDEEP
49152:wqwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwH:
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\fzvaxwzv = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2572 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fzvaxwzv\ImagePath = "C:\\Windows\\SysWOW64\\fzvaxwzv\\quxtfolh.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2840 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
quxtfolh.exepid process 2592 quxtfolh.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
quxtfolh.exedescription pid process target process PID 2592 set thread context of 2840 2592 quxtfolh.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2456 sc.exe 1960 sc.exe 2936 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exequxtfolh.exedescription pid process target process PID 1136 wrote to memory of 2268 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 2268 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 2268 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 2268 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 2116 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 2116 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 2116 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 2116 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe cmd.exe PID 1136 wrote to memory of 1960 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 1960 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 1960 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 1960 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2936 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2936 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2936 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2936 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2456 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2456 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2456 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2456 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe sc.exe PID 1136 wrote to memory of 2572 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe netsh.exe PID 1136 wrote to memory of 2572 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe netsh.exe PID 1136 wrote to memory of 2572 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe netsh.exe PID 1136 wrote to memory of 2572 1136 f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe netsh.exe PID 2592 wrote to memory of 2840 2592 quxtfolh.exe svchost.exe PID 2592 wrote to memory of 2840 2592 quxtfolh.exe svchost.exe PID 2592 wrote to memory of 2840 2592 quxtfolh.exe svchost.exe PID 2592 wrote to memory of 2840 2592 quxtfolh.exe svchost.exe PID 2592 wrote to memory of 2840 2592 quxtfolh.exe svchost.exe PID 2592 wrote to memory of 2840 2592 quxtfolh.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fzvaxwzv\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\quxtfolh.exe" C:\Windows\SysWOW64\fzvaxwzv\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create fzvaxwzv binPath= "C:\Windows\SysWOW64\fzvaxwzv\quxtfolh.exe /d\"C:\Users\Admin\AppData\Local\Temp\f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description fzvaxwzv "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start fzvaxwzv2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\fzvaxwzv\quxtfolh.exeC:\Windows\SysWOW64\fzvaxwzv\quxtfolh.exe /d"C:\Users\Admin\AppData\Local\Temp\f869bf89806a1807f9f293f862ce247d_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\quxtfolh.exeFilesize
13.0MB
MD55c9b72b9c4a7220d2399b9afb28bc23d
SHA1a03a8e3fcdf1969c9778dd907d22f3a8ef627eda
SHA25695308439b2ebb249538097c4a166cf5bd4d1d88d894b3b43c0cb4a588c7192ac
SHA5123c42633b04ccf880ad8c1c4e9e261efe2457d85a064bf2190713c3b7c28d202e9d4b3c7262e8180a0614fdf536e8977089c1d02401d7c73007009ad3e11ddf9d
-
memory/1136-13-0x0000000002D30000-0x0000000002E30000-memory.dmpFilesize
1024KB
-
memory/1136-2-0x00000000002A0000-0x00000000002B3000-memory.dmpFilesize
76KB
-
memory/1136-4-0x0000000000400000-0x0000000002CC0000-memory.dmpFilesize
40.8MB
-
memory/1136-1-0x0000000002D30000-0x0000000002E30000-memory.dmpFilesize
1024KB
-
memory/1136-8-0x0000000000400000-0x0000000002CC0000-memory.dmpFilesize
40.8MB
-
memory/2592-9-0x0000000003100000-0x0000000003200000-memory.dmpFilesize
1024KB
-
memory/2592-10-0x00000000003B0000-0x00000000003C3000-memory.dmpFilesize
76KB
-
memory/2592-20-0x0000000000400000-0x0000000002CC0000-memory.dmpFilesize
40.8MB
-
memory/2592-19-0x0000000000400000-0x0000000002CC0000-memory.dmpFilesize
40.8MB
-
memory/2840-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2840-11-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2840-15-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2840-18-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2840-21-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2840-22-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2840-23-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB