Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 09:36
Static task
static1
Behavioral task
behavioral1
Sample
fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe
-
Size
95KB
-
MD5
fc750f6c7b4c57b368e7c01aff4399ed
-
SHA1
eacd83ebf16c89c0f90f9399bacc3db273df058f
-
SHA256
c07c011568614e3119d36a67fa208666c276f3500ca3ad1a156177c9e63cec70
-
SHA512
e9b1ca25c6a7db5c59c518d804750d68555a60ee371609807014245484054687eac8fbc652b10665205b4733420d5e37619e693a20b5febaa735f49427382f19
-
SSDEEP
1536:aMJFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8priIQmwpd:aMfS4jHS8q/3nTzePCwNUh4E9iy0d
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule \??\c:\programdata\application data\storm\update\%sessionname%\ekxle.cc3 family_gh0strat behavioral1/memory/2900-21-0x0000000000400000-0x000000000044C60F-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
Processes:
hyffccrtmupid process 2900 hyffccrtmu -
Executes dropped EXE 1 IoCs
Processes:
hyffccrtmupid process 2900 hyffccrtmu -
Loads dropped DLL 3 IoCs
Processes:
fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exesvchost.exepid process 1920 fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe 1920 fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe 2760 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\trmgawwrxq svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum svchost.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
hyffccrtmusvchost.exepid process 2900 hyffccrtmu 2760 svchost.exe 2760 svchost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
hyffccrtmusvchost.exedescription pid process Token: SeRestorePrivilege 2900 hyffccrtmu Token: SeBackupPrivilege 2900 hyffccrtmu Token: SeBackupPrivilege 2900 hyffccrtmu Token: SeRestorePrivilege 2900 hyffccrtmu Token: SeBackupPrivilege 2760 svchost.exe Token: SeRestorePrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeSecurityPrivilege 2760 svchost.exe Token: SeSecurityPrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeSecurityPrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeSecurityPrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeRestorePrivilege 2760 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exedescription pid process target process PID 1920 wrote to memory of 2900 1920 fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe hyffccrtmu PID 1920 wrote to memory of 2900 1920 fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe hyffccrtmu PID 1920 wrote to memory of 2900 1920 fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe hyffccrtmu PID 1920 wrote to memory of 2900 1920 fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe hyffccrtmu
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\hyffccrtmu"C:\Users\Admin\AppData\Local\Temp\fc750f6c7b4c57b368e7c01aff4399ed_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\fc750f6c7b4c57b368e7c01aff4399ed_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\programdata\application data\storm\update\%sessionname%\ekxle.cc3Filesize
19.0MB
MD50216b414c03cf2d1de14d5ba23bc29b7
SHA11470f6acb4e748b30902c345a17034f66c691ba5
SHA2563cae1ef8baa30b259bb594e4e144359fd5debcb057892b85de863b1f2aba2b0a
SHA5125de12351e096b7e3dbea474e3da563801b37cdf90c9424c7d184212ef197c196ba920d9267c2747eb8c4da1079ecefc80f8377bcc8c400090c3b1d0626432a28
-
\Users\Admin\AppData\Local\hyffccrtmuFilesize
23.7MB
MD5c4ae09dafb26e37d79499b5ee4dbbb7e
SHA18b84bfa7072f6299e144e337e4ffb5aa68b250eb
SHA256cf60902ea7af7d271094c257d7ba67c0489573c6cfae65fc58cdbb1576ba72a5
SHA512975e7d3ef3d49401a9966c6bb6298c27fad3f55df7b693bcfee3fc2b650eea1c8103bfd2111343f89573e3c48202823923bf97227e425b1ff24ea4e203caef82
-
memory/1920-2-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/1920-1-0x0000000000400000-0x000000000044C60F-memory.dmpFilesize
305KB
-
memory/1920-12-0x0000000000230000-0x000000000027D000-memory.dmpFilesize
308KB
-
memory/1920-11-0x0000000000400000-0x000000000044C60F-memory.dmpFilesize
305KB
-
memory/1920-24-0x0000000000230000-0x000000000027D000-memory.dmpFilesize
308KB
-
memory/2760-22-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/2900-15-0x0000000000400000-0x000000000044C60F-memory.dmpFilesize
305KB
-
memory/2900-16-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/2900-21-0x0000000000400000-0x000000000044C60F-memory.dmpFilesize
305KB