Analysis
-
max time kernel
163s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe
-
Size
11.6MB
-
MD5
f97ac5a687cc94db960df62fb910a74a
-
SHA1
24b5c7775506327081ea3ed0093c62d938dd50e4
-
SHA256
00423b5dc446d975260c85ace9a92f27398430fd56bbb3d42e190d281de8d954
-
SHA512
ab81fd40d42ad8dd102b48906d5fba078360001cb300743b8e90849bc38d22f40302b6e26ee5d45f0b6bf1bd082e0293adee78ed3e21668c3c55b014d9746c0b
-
SSDEEP
196608:QPHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:Q
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 840 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fsuimfbb\ImagePath = "C:\\Windows\\SysWOW64\\fsuimfbb\\tnjpakci.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 3924 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
tnjpakci.exepid process 1064 tnjpakci.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tnjpakci.exedescription pid process target process PID 1064 set thread context of 3924 1064 tnjpakci.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2448 sc.exe 3068 sc.exe 4884 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3196 4636 WerFault.exe f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe 2068 1064 WerFault.exe tnjpakci.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exetnjpakci.exedescription pid process target process PID 4636 wrote to memory of 5064 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe cmd.exe PID 4636 wrote to memory of 5064 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe cmd.exe PID 4636 wrote to memory of 5064 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe cmd.exe PID 4636 wrote to memory of 3940 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe cmd.exe PID 4636 wrote to memory of 3940 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe cmd.exe PID 4636 wrote to memory of 3940 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe cmd.exe PID 4636 wrote to memory of 2448 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 2448 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 2448 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 3068 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 3068 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 3068 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 4884 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 4884 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 4884 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe sc.exe PID 4636 wrote to memory of 840 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe netsh.exe PID 4636 wrote to memory of 840 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe netsh.exe PID 4636 wrote to memory of 840 4636 f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe netsh.exe PID 1064 wrote to memory of 3924 1064 tnjpakci.exe svchost.exe PID 1064 wrote to memory of 3924 1064 tnjpakci.exe svchost.exe PID 1064 wrote to memory of 3924 1064 tnjpakci.exe svchost.exe PID 1064 wrote to memory of 3924 1064 tnjpakci.exe svchost.exe PID 1064 wrote to memory of 3924 1064 tnjpakci.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fsuimfbb\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tnjpakci.exe" C:\Windows\SysWOW64\fsuimfbb\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create fsuimfbb binPath= "C:\Windows\SysWOW64\fsuimfbb\tnjpakci.exe /d\"C:\Users\Admin\AppData\Local\Temp\f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description fsuimfbb "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start fsuimfbb2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 12802⤵
- Program crash
-
C:\Windows\SysWOW64\fsuimfbb\tnjpakci.exeC:\Windows\SysWOW64\fsuimfbb\tnjpakci.exe /d"C:\Users\Admin\AppData\Local\Temp\f97ac5a687cc94db960df62fb910a74a_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 5122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4636 -ip 46361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1064 -ip 10641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tnjpakci.exeFilesize
10.2MB
MD5eddb8dea99c5cc15889921105e499394
SHA116fd49cbdb02d8b61d67c5e9e46b8dcd9a9876cf
SHA256a4b2169492d8fd513cac41c89c4094e8b81188a425ba2d0eebfefc93adc4cd36
SHA512053a943464d1a83ff8313b40fbf217df3e22f340ad0f613aa247c5d86558752ac0f95d149affc2c42cc0d379f8fe24c571e9ec18d01a52e448e2a31fbdd8dac3
-
memory/1064-10-0x0000000000B10000-0x0000000000C10000-memory.dmpFilesize
1024KB
-
memory/1064-12-0x0000000000400000-0x0000000000870000-memory.dmpFilesize
4.4MB
-
memory/1064-17-0x0000000000400000-0x0000000000870000-memory.dmpFilesize
4.4MB
-
memory/3924-11-0x0000000000B50000-0x0000000000B65000-memory.dmpFilesize
84KB
-
memory/3924-15-0x0000000000B50000-0x0000000000B65000-memory.dmpFilesize
84KB
-
memory/3924-16-0x0000000000B50000-0x0000000000B65000-memory.dmpFilesize
84KB
-
memory/3924-18-0x0000000000B50000-0x0000000000B65000-memory.dmpFilesize
84KB
-
memory/4636-3-0x0000000000400000-0x0000000000870000-memory.dmpFilesize
4.4MB
-
memory/4636-2-0x00000000001C0000-0x00000000001D3000-memory.dmpFilesize
76KB
-
memory/4636-8-0x0000000000400000-0x0000000000870000-memory.dmpFilesize
4.4MB
-
memory/4636-9-0x00000000001C0000-0x00000000001D3000-memory.dmpFilesize
76KB
-
memory/4636-1-0x0000000000AE0000-0x0000000000BE0000-memory.dmpFilesize
1024KB