Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 08:15
Behavioral task
behavioral1
Sample
629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe
-
Size
32KB
-
MD5
629fba91ff579f1e890e489a028d7eb1
-
SHA1
c6871d6ce30d012e79412761bd6c0c75be37d084
-
SHA256
6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
-
SHA512
5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183
-
SSDEEP
384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz
Malware Config
Extracted
phorphiex
http://worm.ws/
http://seuufhehfueugheh.ws/
http://feuhdeuhduhuehdh.ws/
http://feauhueudughuurh.ws/
http://fheuhdwdzwgzdggh.ws/
http://faugzeazdezgzgfh.ws/
http://wduufbaueeubffgh.ws/
http://okdoekeoehghaoeh.ws/
http://efuheruhdehduhgh.ws/
http://eafueudzefverrgh.ws/
http://deauduafzgezzfgh.ws/
http://gaueudbuwdbuguuh.ws/
http://efeuafubeubaefuh.ws/
http://eafuebdbedbedggh.ws/
http://wdkowdohwodhfhfh.ws/
http://efaeduvedvzfufuh.ws/
http://edhuaudhuedugufh.ws/
http://eaffuebudbeudbbh.ws/
http://seuufhehfueughet.to/
http://feuhdeuhduhuehdt.to/
http://feauhueudughuurt.to/
http://fheuhdwdzwgzdggt.to/
http://faugzeazdezgzgft.to/
http://wduufbaueeubffgt.to/
http://okdoekeoehghaoet.to/
http://efuheruhdehduhgt.to/
http://eafueudzefverrgt.to/
http://deauduafzgezzfgt.
19KXPyopGnfZ1dGjLpPPqbo7Jpqki9A9mW
3NShfYPbqkPmPkXEgJ1SGUYgSjxt1Robhs
bc1qf4awd7k76q0tks25ax7q48wmsvslvy64er6n6w
qqe5entlms8sudv7a60dnu5gpttlukmspuk5zxsahe
XjgwEqD6iFf5pHxqSzj4tm8mgs7TsS2kEw
DHvsojZJPxoYYwtVw7voSuv2ga5LGoQpG1
0xA557fe5c21325eB8f6C7d5f2004Db988c8C8D8B5
LYr5qEmeAcpv7JeCEE2HfGPV74DZLYHeT2
42TCgxVg6itTv4v8dvyCQEETmHL5N6i8a8rvcqGWb2QtWUrBpq3SdDnZbhpcg2S3UbNG98Woi6KEH7dWtpnEHQrDEzQbENy
rDs45wyGR5E6sHajNGHeNqvjvXaCJrJ22j
TY59jfEA2xQBk4R8AAJG3tBGQybMm1aSba
t1NBaHW8QgULABaASvzNALmxem8EutnxLtr
GDR62FPKRATKXTLSR3JDCVGDAVF6YC5RVZ2RQ55SNW6C2UWND3KGUHPW
P44ZCLTNESUGZESVC3QMK6LSFY7LYW3N23FKX56UMCEXK6NZBG3BUNPDWI
Signatures
-
Phorphiex payload 1 IoCs
Processes:
resource yara_rule \31722503029972\svchost.exe family_phorphiex -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2732 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exepid process 1636 629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\31722503029972\\svchost.exe" 629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\31722503029972\\svchost.exe" 629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exedescription pid process target process PID 1636 wrote to memory of 2732 1636 629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe svchost.exe PID 1636 wrote to memory of 2732 1636 629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe svchost.exe PID 1636 wrote to memory of 2732 1636 629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe svchost.exe PID 1636 wrote to memory of 2732 1636 629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\31722503029972\svchost.exeC:\31722503029972\svchost.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\31722503029972\svchost.exeFilesize
32KB
MD5629fba91ff579f1e890e489a028d7eb1
SHA1c6871d6ce30d012e79412761bd6c0c75be37d084
SHA2566cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
SHA5125e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183