Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 02:16
Static task
static1
Behavioral task
behavioral1
Sample
fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe
-
Size
10.3MB
-
MD5
fbb4d43f90d6c4e44bc3d66bb4e00a7f
-
SHA1
71333f6fac993d9c6f1d7c853beffb364f0a5aaa
-
SHA256
5bc56bbb39fc526c456c171afcfd0f0861418f6acb277fd9304bf01023c9d40d
-
SHA512
59152fa21df817423fba2bf3a635f7228bcdd0ae88bbef766a3523e3609304ea86b4192637ed9f0a58b8a0211c918b3768628ac150aebafb7567f321137cb51f
-
SSDEEP
6144:UDLhwY9FPsMFYUaPWIXDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD/:WWSFPsycP
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\vlhskmfi = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2660 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vlhskmfi\ImagePath = "C:\\Windows\\SysWOW64\\vlhskmfi\\mvpumlgc.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2520 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
mvpumlgc.exepid process 2640 mvpumlgc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mvpumlgc.exedescription pid process target process PID 2640 set thread context of 2520 2640 mvpumlgc.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2592 sc.exe 2536 sc.exe 2396 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exemvpumlgc.exedescription pid process target process PID 1948 wrote to memory of 2228 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2228 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2228 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2228 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2924 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2924 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2924 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2924 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe cmd.exe PID 1948 wrote to memory of 2592 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2592 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2592 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2592 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2536 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2536 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2536 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2536 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2396 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2396 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2396 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2396 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe sc.exe PID 1948 wrote to memory of 2660 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe netsh.exe PID 1948 wrote to memory of 2660 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe netsh.exe PID 1948 wrote to memory of 2660 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe netsh.exe PID 1948 wrote to memory of 2660 1948 fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe netsh.exe PID 2640 wrote to memory of 2520 2640 mvpumlgc.exe svchost.exe PID 2640 wrote to memory of 2520 2640 mvpumlgc.exe svchost.exe PID 2640 wrote to memory of 2520 2640 mvpumlgc.exe svchost.exe PID 2640 wrote to memory of 2520 2640 mvpumlgc.exe svchost.exe PID 2640 wrote to memory of 2520 2640 mvpumlgc.exe svchost.exe PID 2640 wrote to memory of 2520 2640 mvpumlgc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vlhskmfi\2⤵PID:2228
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mvpumlgc.exe" C:\Windows\SysWOW64\vlhskmfi\2⤵PID:2924
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create vlhskmfi binPath= "C:\Windows\SysWOW64\vlhskmfi\mvpumlgc.exe /d\"C:\Users\Admin\AppData\Local\Temp\fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2592 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description vlhskmfi "wifi internet conection"2⤵
- Launches sc.exe
PID:2536 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start vlhskmfi2⤵
- Launches sc.exe
PID:2396 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2660
-
C:\Windows\SysWOW64\vlhskmfi\mvpumlgc.exeC:\Windows\SysWOW64\vlhskmfi\mvpumlgc.exe /d"C:\Users\Admin\AppData\Local\Temp\fbb4d43f90d6c4e44bc3d66bb4e00a7f_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2520
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mvpumlgc.exeFilesize
13.9MB
MD58de48be2ff74c6bed4cd7f4778b8f777
SHA166fac193365fdf514d937fa10d536e7ac4f8394a
SHA2566a9523a6f359ae6023252ecd159c0ec45271ad7fef715f7464236502784f8c0d
SHA512d0cfafd6dd16e322007353d32d8e7aa9d8cddb14741ab7b5352939cb863ef84720fbbf2bc3370f58e7cd15eb212650ddaee16a0e8ac7720380e9ec2b74855ddc
-
memory/1948-3-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/1948-1-0x0000000000BD0000-0x0000000000CD0000-memory.dmpFilesize
1024KB
-
memory/1948-4-0x0000000000400000-0x0000000000A79000-memory.dmpFilesize
6.5MB
-
memory/1948-7-0x0000000000400000-0x0000000000A79000-memory.dmpFilesize
6.5MB
-
memory/2520-14-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2520-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2520-11-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2520-18-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2520-19-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2520-20-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/2640-10-0x0000000000B50000-0x0000000000C50000-memory.dmpFilesize
1024KB
-
memory/2640-9-0x0000000000400000-0x0000000000A79000-memory.dmpFilesize
6.5MB
-
memory/2640-16-0x0000000000400000-0x0000000000A79000-memory.dmpFilesize
6.5MB