Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe
-
Size
14.1MB
-
MD5
fb092c7934eacc2f736c2845b5bca1b7
-
SHA1
cb689ab4ac8afbd421ac33a7f3bc13a055c12737
-
SHA256
2c6cabba751c4b40a909ec025bf92efee2b6a3ad520bfcfda7042d298781846e
-
SHA512
e73277f8529f9f0e361a5ee37df2f4ce6bd717c490effdd1e1b2aa06532d11208c4d41bca1b881f559bbc7eab3b43af813aefdd2347d01cdbba48fd81d57718b
-
SSDEEP
24576:alxdvCcpOKCtBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBz:alzOR
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\oiuxthtd = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2488 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\oiuxthtd\ImagePath = "C:\\Windows\\SysWOW64\\oiuxthtd\\obbzyzmm.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2448 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
obbzyzmm.exepid process 2740 obbzyzmm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
obbzyzmm.exedescription pid process target process PID 2740 set thread context of 2448 2740 obbzyzmm.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2596 sc.exe 2712 sc.exe 2588 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exeobbzyzmm.exedescription pid process target process PID 2928 wrote to memory of 2744 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 2744 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 2744 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 2744 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 3024 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 3024 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 3024 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 3024 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe cmd.exe PID 2928 wrote to memory of 2596 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2596 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2596 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2596 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2712 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2712 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2712 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2712 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2588 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2588 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2588 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2588 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe sc.exe PID 2928 wrote to memory of 2488 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe netsh.exe PID 2928 wrote to memory of 2488 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe netsh.exe PID 2928 wrote to memory of 2488 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe netsh.exe PID 2928 wrote to memory of 2488 2928 fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe netsh.exe PID 2740 wrote to memory of 2448 2740 obbzyzmm.exe svchost.exe PID 2740 wrote to memory of 2448 2740 obbzyzmm.exe svchost.exe PID 2740 wrote to memory of 2448 2740 obbzyzmm.exe svchost.exe PID 2740 wrote to memory of 2448 2740 obbzyzmm.exe svchost.exe PID 2740 wrote to memory of 2448 2740 obbzyzmm.exe svchost.exe PID 2740 wrote to memory of 2448 2740 obbzyzmm.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\oiuxthtd\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\obbzyzmm.exe" C:\Windows\SysWOW64\oiuxthtd\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create oiuxthtd binPath= "C:\Windows\SysWOW64\oiuxthtd\obbzyzmm.exe /d\"C:\Users\Admin\AppData\Local\Temp\fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description oiuxthtd "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start oiuxthtd2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\oiuxthtd\obbzyzmm.exeC:\Windows\SysWOW64\oiuxthtd\obbzyzmm.exe /d"C:\Users\Admin\AppData\Local\Temp\fb092c7934eacc2f736c2845b5bca1b7_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\obbzyzmm.exeFilesize
11.6MB
MD5171f509b86df6271759d32e8ddb3b24d
SHA1ffc3a5ea47d94f48cf728431d492849fd360c8e0
SHA2568b14746fa897e53c7eb58b6f087aa8c5d168a8a31c28c4d9c45129500b0eb2a9
SHA512c6ede15dc3b98bd841162995a8669f4cacdc1ea6756968a30600d0796dd05c1b60853d126298837ba5ba3ee8a243ba3d6c36f4a9d6750985ee357b0bda8ae7c2
-
memory/2448-16-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2448-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2448-23-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2448-22-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2448-21-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2448-20-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2448-12-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2740-11-0x00000000005B0000-0x00000000006B0000-memory.dmpFilesize
1024KB
-
memory/2740-17-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2740-13-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2928-10-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2928-3-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2928-1-0x0000000000620000-0x0000000000720000-memory.dmpFilesize
1024KB
-
memory/2928-9-0x0000000000620000-0x0000000000720000-memory.dmpFilesize
1024KB
-
memory/2928-8-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2928-2-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB