Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 15:12
Static task
static1
Behavioral task
behavioral1
Sample
fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe
-
Size
100KB
-
MD5
fa932569d765ca8acd7ae5e7ca1ae67e
-
SHA1
781889fcc52b7bdaf6eb2a9943d46e0793c2a807
-
SHA256
24de4d60a3c47cb3b323292fb832571992a2bee924031cd89432c5deee8342c1
-
SHA512
47b29459323356b1bdb72bb93bc4a4699b2f915afd6489f74b72efcb43cfc2b3e3e012fb60c4c78e7a162b1cd7fdcef6cf3955a4db4aecf07f59ee8e7f89f8a7
-
SSDEEP
3072:AVUAXECKcXd00AoBeiyro9Lu7MKGVk8jwaaHw7Koj4rDMUeRF:eZNKo00iiyrsIMKjeF
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\oeidqyww\\wkapbcgn.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkapbcgn.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkapbcgn.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
opxkdeitgifgtulc.exepid process 2472 opxkdeitgifgtulc.exe -
Loads dropped DLL 5 IoCs
Processes:
fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exepid process 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\WkaPbcgn = "C:\\Users\\Admin\\AppData\\Local\\oeidqyww\\wkapbcgn.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe 2912 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 468 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exesvchost.exesvchost.exeopxkdeitgifgtulc.exedescription pid process Token: SeSecurityPrivilege 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe Token: SeDebugPrivilege 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe Token: SeSecurityPrivilege 2240 svchost.exe Token: SeSecurityPrivilege 2912 svchost.exe Token: SeDebugPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeSecurityPrivilege 2472 opxkdeitgifgtulc.exe Token: SeLoadDriverPrivilege 2472 opxkdeitgifgtulc.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe Token: SeBackupPrivilege 2912 svchost.exe Token: SeRestorePrivilege 2912 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exedescription pid process target process PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2240 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2912 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe svchost.exe PID 2748 wrote to memory of 2472 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe opxkdeitgifgtulc.exe PID 2748 wrote to memory of 2472 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe opxkdeitgifgtulc.exe PID 2748 wrote to memory of 2472 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe opxkdeitgifgtulc.exe PID 2748 wrote to memory of 2472 2748 fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe opxkdeitgifgtulc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa932569d765ca8acd7ae5e7ca1ae67e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\opxkdeitgifgtulc.exe"C:\Users\Admin\AppData\Local\Temp\opxkdeitgifgtulc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\oeidqyww\wkapbcgn.exeFilesize
100KB
MD5fa932569d765ca8acd7ae5e7ca1ae67e
SHA1781889fcc52b7bdaf6eb2a9943d46e0793c2a807
SHA25624de4d60a3c47cb3b323292fb832571992a2bee924031cd89432c5deee8342c1
SHA51247b29459323356b1bdb72bb93bc4a4699b2f915afd6489f74b72efcb43cfc2b3e3e012fb60c4c78e7a162b1cd7fdcef6cf3955a4db4aecf07f59ee8e7f89f8a7
-
memory/2240-12-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2240-25-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2240-24-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2240-10-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2240-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2240-16-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2240-19-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2240-21-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2240-22-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2472-80-0x0000000000240000-0x0000000000242000-memory.dmpFilesize
8KB
-
memory/2472-79-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2472-77-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2472-82-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2748-54-0x00000000775B0000-0x00000000775B1000-memory.dmpFilesize
4KB
-
memory/2748-2-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2748-5-0x0000000000240000-0x0000000000242000-memory.dmpFilesize
8KB
-
memory/2748-1-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2748-8-0x00000000775B0000-0x00000000775B1000-memory.dmpFilesize
4KB
-
memory/2748-6-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2748-4-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2748-7-0x00000000775AF000-0x00000000775B0000-memory.dmpFilesize
4KB
-
memory/2748-73-0x0000000002580000-0x00000000025BB000-memory.dmpFilesize
236KB
-
memory/2748-53-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2748-0-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2748-55-0x0000000000400000-0x000000000043A6BC-memory.dmpFilesize
233KB
-
memory/2748-58-0x00000000775AF000-0x00000000775B0000-memory.dmpFilesize
4KB
-
memory/2748-64-0x0000000002580000-0x00000000025BB000-memory.dmpFilesize
236KB
-
memory/2912-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-29-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-51-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-90-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-84-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-86-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-83-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-88-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-87-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2912-103-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB