Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 07:24
Static task
static1
Behavioral task
behavioral1
Sample
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe
-
Size
10.4MB
-
MD5
fc3bb27a0cf68b519a1ff98126da4083
-
SHA1
d52434e6d7326478e4d2931b379ed30c31ead569
-
SHA256
57c5476b2f41ec87a6b74153c52b442d47172ad8f59a578e4ac6e902dec3be3f
-
SHA512
8fded19f127deaa5d52d8c88b89009ebf1626ada44556fcc50e9cd048c399c31d89668232db2790afbbbf0072cb5806a7f00e92391c0815f39211cbf9c7ffcdc
-
SSDEEP
3072:EOsUA8KZQ/IxsPVg4nkvzaHWgSjqdF0w2Uyopz9ZeCqJXXfehv1Ijoxw9xkaaaaK:eUA8GV2e4nYWHEjqPt9cCqxmhv1pxQ
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3224 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ihgfixig\ImagePath = "C:\\Windows\\SysWOW64\\ihgfixig\\pwzxyyoc.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 3968 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
pwzxyyoc.exepid process 3804 pwzxyyoc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pwzxyyoc.exedescription pid process target process PID 3804 set thread context of 3968 3804 pwzxyyoc.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4380 sc.exe 4476 sc.exe 4984 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 5056 4876 WerFault.exe fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe 1792 3804 WerFault.exe pwzxyyoc.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exepwzxyyoc.exedescription pid process target process PID 4876 wrote to memory of 1476 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 4876 wrote to memory of 1476 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 4876 wrote to memory of 1476 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 4876 wrote to memory of 1576 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 4876 wrote to memory of 1576 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 4876 wrote to memory of 1576 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe cmd.exe PID 4876 wrote to memory of 4380 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4380 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4380 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4476 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4476 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4476 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4984 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4984 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 4984 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe sc.exe PID 4876 wrote to memory of 3224 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe netsh.exe PID 4876 wrote to memory of 3224 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe netsh.exe PID 4876 wrote to memory of 3224 4876 fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe netsh.exe PID 3804 wrote to memory of 3968 3804 pwzxyyoc.exe svchost.exe PID 3804 wrote to memory of 3968 3804 pwzxyyoc.exe svchost.exe PID 3804 wrote to memory of 3968 3804 pwzxyyoc.exe svchost.exe PID 3804 wrote to memory of 3968 3804 pwzxyyoc.exe svchost.exe PID 3804 wrote to memory of 3968 3804 pwzxyyoc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ihgfixig\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pwzxyyoc.exe" C:\Windows\SysWOW64\ihgfixig\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ihgfixig binPath= "C:\Windows\SysWOW64\ihgfixig\pwzxyyoc.exe /d\"C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ihgfixig "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ihgfixig2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 8962⤵
- Program crash
-
C:\Windows\SysWOW64\ihgfixig\pwzxyyoc.exeC:\Windows\SysWOW64\ihgfixig\pwzxyyoc.exe /d"C:\Users\Admin\AppData\Local\Temp\fc3bb27a0cf68b519a1ff98126da4083_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 5162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3804 -ip 38041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pwzxyyoc.exeFilesize
14.1MB
MD592efd667d500a602051a89f3984f0df4
SHA1afcfc420ed9aac73a4b4369f093a8e71c34b88e6
SHA256159149841d344fcc07e2ecd3083ee61f6eb0dc07c0d3901aab7ac5ca465dd0a8
SHA5125ab2d8015bcf5167edcd8f86437a25a2ba229b8c591eb88e02603a50882b9d799d73bfebc2d3fd82f749b3d28ff25ca0400eebbfcba662e2567651e361270589
-
memory/3804-10-0x0000000000BF0000-0x0000000000CF0000-memory.dmpFilesize
1024KB
-
memory/3804-12-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB
-
memory/3804-18-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB
-
memory/3968-11-0x00000000003C0000-0x00000000003D5000-memory.dmpFilesize
84KB
-
memory/3968-15-0x00000000003C0000-0x00000000003D5000-memory.dmpFilesize
84KB
-
memory/3968-17-0x00000000003C0000-0x00000000003D5000-memory.dmpFilesize
84KB
-
memory/3968-19-0x00000000003C0000-0x00000000003D5000-memory.dmpFilesize
84KB
-
memory/4876-4-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB
-
memory/4876-2-0x00000000008E0000-0x00000000008F3000-memory.dmpFilesize
76KB
-
memory/4876-8-0x0000000000400000-0x000000000086C000-memory.dmpFilesize
4.4MB
-
memory/4876-9-0x00000000008E0000-0x00000000008F3000-memory.dmpFilesize
76KB
-
memory/4876-1-0x0000000000980000-0x0000000000A80000-memory.dmpFilesize
1024KB