Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe
-
Size
137KB
-
MD5
fe13c06ef08634e69555b8c1d009bcb9
-
SHA1
61211386481811b31cc2f899b2134a0ce638a264
-
SHA256
28ce4f3e1448c91520eeb42861a2fdbe473adc1c48dfffe22a48f54406a97948
-
SHA512
a64f6b5595c980d9d2f37475afdc1e911bfb8ca16f8f0895a9209772832416afffc4f59d3a072b318e55324809459fd76e677cfadd1539a31bcfeb31a30ebf1d
-
SSDEEP
3072:/wpMn7cYBxzHlSXQ3NhueuQYeLJ3Jh9ypXxXfUfCwhko:/EAcjQY6pJipa
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\yftfvter\\hllrgwni.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hllrgwni.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hllrgwni.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
x0xBIn7Uyqjmiuepjkxwdxac.exepid process 2828 x0xBIn7U 2856 yqjmiuepjkxwdxac.exe -
Loads dropped DLL 6 IoCs
Processes:
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exex0xBIn7Upid process 3024 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe 3024 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe 2828 x0xBIn7U 2828 x0xBIn7U 2828 x0xBIn7U 2828 x0xBIn7U -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\HllRgwni = "C:\\Users\\Admin\\AppData\\Local\\yftfvter\\hllrgwni.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe 2448 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 476 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
x0xBIn7Usvchost.exesvchost.exeyqjmiuepjkxwdxac.exedescription pid process Token: SeSecurityPrivilege 2828 x0xBIn7U Token: SeDebugPrivilege 2828 x0xBIn7U Token: SeSecurityPrivilege 3004 svchost.exe Token: SeSecurityPrivilege 2448 svchost.exe Token: SeDebugPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeSecurityPrivilege 2856 yqjmiuepjkxwdxac.exe Token: SeLoadDriverPrivilege 2856 yqjmiuepjkxwdxac.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe Token: SeBackupPrivilege 2448 svchost.exe Token: SeRestorePrivilege 2448 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exepid process 3024 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exex0xBIn7Udescription pid process target process PID 3024 wrote to memory of 2828 3024 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe x0xBIn7U PID 3024 wrote to memory of 2828 3024 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe x0xBIn7U PID 3024 wrote to memory of 2828 3024 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe x0xBIn7U PID 3024 wrote to memory of 2828 3024 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe x0xBIn7U PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 3004 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2448 2828 x0xBIn7U svchost.exe PID 2828 wrote to memory of 2856 2828 x0xBIn7U yqjmiuepjkxwdxac.exe PID 2828 wrote to memory of 2856 2828 x0xBIn7U yqjmiuepjkxwdxac.exe PID 2828 wrote to memory of 2856 2828 x0xBIn7U yqjmiuepjkxwdxac.exe PID 2828 wrote to memory of 2856 2828 x0xBIn7U yqjmiuepjkxwdxac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x0xBIn7U"x0xBIn7U"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\yqjmiuepjkxwdxac.exe"C:\Users\Admin\AppData\Local\Temp\yqjmiuepjkxwdxac.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\x0xBIn7UFilesize
95KB
MD59e9ad7686371d18a65e9193b5279ae3a
SHA132387208357480c8e5d519a6cd64117a50303953
SHA256a184487f8f4edf4ff4c90dce3f1fbd45031a528046eadbac44287e405e74c4bf
SHA5123a6d2548f47ad4b95035908b483afcf87969ecab27598aff423f0a77e8c6851bf35a6956ba24fe56b57cfe3e3cfbe257c1f70a7f349e6b3b9f53547a31cb42e5
-
memory/2448-77-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-107-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-76-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-108-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-74-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-106-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-105-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-75-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-103-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-64-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-109-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-110-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-104-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-73-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-72-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-71-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-70-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-69-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-68-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-42-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-48-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-57-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2448-58-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-92-0x0000000002B60000-0x0000000002B9A000-memory.dmpFilesize
232KB
-
memory/2828-67-0x00000000773A0000-0x00000000773A1000-memory.dmpFilesize
4KB
-
memory/2828-14-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2828-20-0x000000007739F000-0x00000000773A0000-memory.dmpFilesize
4KB
-
memory/2828-12-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2828-17-0x0000000000240000-0x0000000000242000-memory.dmpFilesize
8KB
-
memory/2828-16-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2828-15-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2828-22-0x00000000773A0000-0x00000000773A1000-memory.dmpFilesize
4KB
-
memory/2828-85-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2828-93-0x000000007739F000-0x00000000773A0000-memory.dmpFilesize
4KB
-
memory/2856-100-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2856-97-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/3004-29-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/3004-25-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/3004-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3004-30-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3004-31-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/3004-33-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/3004-36-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3004-37-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3004-38-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3024-0-0x0000000001000000-0x0000000001025000-memory.dmpFilesize
148KB
-
memory/3024-18-0x0000000001000000-0x0000000001025000-memory.dmpFilesize
148KB
-
memory/3024-19-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3024-11-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3024-9-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB