Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 07:24
Static task
static1
Behavioral task
behavioral1
Sample
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe
-
Size
10.4MB
-
MD5
fc3bb27a0cf68b519a1ff98126da4083
-
SHA1
d52434e6d7326478e4d2931b379ed30c31ead569
-
SHA256
57c5476b2f41ec87a6b74153c52b442d47172ad8f59a578e4ac6e902dec3be3f
-
SHA512
8fded19f127deaa5d52d8c88b89009ebf1626ada44556fcc50e9cd048c399c31d89668232db2790afbbbf0072cb5806a7f00e92391c0815f39211cbf9c7ffcdc
-
SSDEEP
3072:EOsUA8KZQ/IxsPVg4nkvzaHWgSjqdF0w2Uyopz9ZeCqJXXfehv1Ijoxw9xkaaaaK:eUA8GV2e4nYWHEjqPt9cCqxmhv1pxQ
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2740 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
ndykequm.exepid process 2460 ndykequm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ndykequm.exedescription pid process target process PID 2460 set thread context of 2828 2460 ndykequm.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2664 sc.exe 2652 sc.exe 2868 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exendykequm.exedescription pid process target process PID 2976 wrote to memory of 2856 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2856 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2856 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2856 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2128 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2128 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2128 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2128 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 2976 wrote to memory of 2664 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2664 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2664 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2664 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2652 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2652 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2652 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2652 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2868 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2868 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2868 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2868 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 2976 wrote to memory of 2740 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe netsh.exe PID 2976 wrote to memory of 2740 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe netsh.exe PID 2976 wrote to memory of 2740 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe netsh.exe PID 2976 wrote to memory of 2740 2976 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe netsh.exe PID 2460 wrote to memory of 2828 2460 ndykequm.exe svchost.exe PID 2460 wrote to memory of 2828 2460 ndykequm.exe svchost.exe PID 2460 wrote to memory of 2828 2460 ndykequm.exe svchost.exe PID 2460 wrote to memory of 2828 2460 ndykequm.exe svchost.exe PID 2460 wrote to memory of 2828 2460 ndykequm.exe svchost.exe PID 2460 wrote to memory of 2828 2460 ndykequm.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qzybqyld\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ndykequm.exe" C:\Windows\SysWOW64\qzybqyld\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create qzybqyld binPath= "C:\Windows\SysWOW64\qzybqyld\ndykequm.exe /d\"C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description qzybqyld "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start qzybqyld2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\qzybqyld\ndykequm.exeC:\Windows\SysWOW64\qzybqyld\ndykequm.exe /d"C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ndykequm.exeFilesize
14.0MB
MD5eb434c604bc873bb4d831bb43d0074bc
SHA15fa0e86e304899c49e0e130666546e07ef160bc7
SHA256ff8cba3acc79553990f02fc7be37255d110849d8441c55f3ff6e579d413e184b
SHA512f607cd3c6463fc08b852302c310cc7ca3ee19eda07f73f5e740758bc58cc4cdcfef290b8738013455f0c9a8b274133f33d954c98c253f2714d0cda126e9adfc2
-
memory/2460-9-0x00000000009E0000-0x0000000000AE0000-memory.dmpFilesize
1024KB
-
memory/2460-10-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB
-
memory/2460-16-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB
-
memory/2828-14-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2828-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2828-11-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2976-1-0x0000000000950000-0x0000000000A50000-memory.dmpFilesize
1024KB
-
memory/2976-3-0x0000000000020000-0x0000000000033000-memory.dmpFilesize
76KB
-
memory/2976-4-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB
-
memory/2976-8-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB