Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe
-
Size
13.2MB
-
MD5
f98cc65337ea6c995f6af7bea54a1b88
-
SHA1
388096691f92d4cfa2123ea242dcca5b2dbaa542
-
SHA256
033cc64af4d9e217e27392f016f003250e17ed026595cb682b5504298ef4cc12
-
SHA512
7037f54701e9ebf699c76f8ff19a19195d004293bbd2d562ddcac86ecea480fbb4bd6f12c2b907f4163b671c22f8d52e47d636692e41995551f6e376755050fb
-
SSDEEP
49152:J1yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllln:JA
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\impyvjqz = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2556 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\impyvjqz\ImagePath = "C:\\Windows\\SysWOW64\\impyvjqz\\ppqbwxvd.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2588 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
ppqbwxvd.exepid process 2604 ppqbwxvd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ppqbwxvd.exedescription pid process target process PID 2604 set thread context of 2588 2604 ppqbwxvd.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2164 sc.exe 2636 sc.exe 2640 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exeppqbwxvd.exedescription pid process target process PID 1772 wrote to memory of 2896 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2896 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2896 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2896 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2940 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2940 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2940 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2940 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe cmd.exe PID 1772 wrote to memory of 2164 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2164 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2164 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2164 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2636 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2636 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2636 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2636 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2640 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2640 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2640 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2640 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe sc.exe PID 1772 wrote to memory of 2556 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe netsh.exe PID 1772 wrote to memory of 2556 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe netsh.exe PID 1772 wrote to memory of 2556 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe netsh.exe PID 1772 wrote to memory of 2556 1772 f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe netsh.exe PID 2604 wrote to memory of 2588 2604 ppqbwxvd.exe svchost.exe PID 2604 wrote to memory of 2588 2604 ppqbwxvd.exe svchost.exe PID 2604 wrote to memory of 2588 2604 ppqbwxvd.exe svchost.exe PID 2604 wrote to memory of 2588 2604 ppqbwxvd.exe svchost.exe PID 2604 wrote to memory of 2588 2604 ppqbwxvd.exe svchost.exe PID 2604 wrote to memory of 2588 2604 ppqbwxvd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\impyvjqz\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ppqbwxvd.exe" C:\Windows\SysWOW64\impyvjqz\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create impyvjqz binPath= "C:\Windows\SysWOW64\impyvjqz\ppqbwxvd.exe /d\"C:\Users\Admin\AppData\Local\Temp\f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description impyvjqz "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start impyvjqz2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\impyvjqz\ppqbwxvd.exeC:\Windows\SysWOW64\impyvjqz\ppqbwxvd.exe /d"C:\Users\Admin\AppData\Local\Temp\f98cc65337ea6c995f6af7bea54a1b88_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ppqbwxvd.exeFilesize
13.4MB
MD5a7df7c61c1c534bba481bd9a931a99cc
SHA105e2a559bb04b1b0c9b2272a4b79195ccc8d362a
SHA256cdaa670246bfd46b44591b9cc3ef7606a6bc859a34150fab0f0eb608599104e1
SHA512941d6100d94feba0e4eaca62acff7916adcc153d82ee1ffd31099c913704fb6d539bf0553edd397146af51c9d0f9ce62d5bd86b48e2604c7eab87d9d071b7484
-
memory/1772-1-0x0000000000DB0000-0x0000000000EB0000-memory.dmpFilesize
1024KB
-
memory/1772-4-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB
-
memory/1772-7-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB
-
memory/1772-8-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/1772-2-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2588-20-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2588-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2588-11-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2588-22-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2588-14-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2588-21-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2604-10-0x0000000000CA0000-0x0000000000DA0000-memory.dmpFilesize
1024KB
-
memory/2604-18-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB
-
memory/2604-16-0x0000000000400000-0x0000000000C20000-memory.dmpFilesize
8.1MB