Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 06:35
Static task
static1
Behavioral task
behavioral1
Sample
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe
-
Size
454KB
-
MD5
749ca850ede36a942a2ff2984313299f
-
SHA1
b1d42108b09427c61e846b8f4f819cfe78f922a6
-
SHA256
1a7d054abcd9570fa89ab81ed211b37bc59b513a13d5f8db900392a988e5043b
-
SHA512
5092010bf481b619d53ee20d4be12f5383429aeaec6e8991eb6ccaecdbb25bdf7d729d044d4d39227888230689877829dd8406c4c8f5154fdac7bd48f78063ea
-
SSDEEP
6144:2W7UQ+lpxgdm6zNc2aDiUkMwxxnwy29CNbc0kPF7c5RZs:Ygdm6zNfFxxnwdv4Zs
Malware Config
Extracted
phorphiex
http://185.176.27.132/
http://urusurofhsorhfuuhr.su/
http://aeifaeifhutuhuhusr.su/
http://rzhsudhugugfugugsr.su/
http://bfagzzezgaegzgfair.su/
http://eaeuafhuaegfugeudr.su/
http://aeufuaehfiuehfuhfr.su/
http://daedagheauehfuuhfr.su/
http://aeoughaoheguaoehdr.su/
http://eguaheoghouughahsr.su/
http://huaeokaefoaeguaehr.su/
http://afaeigaifgsgrhhafr.su/
http://afaigaeigieufuifir.su/
http://geauhouefheuutiiir.su/
http://gaoheeuofhefefhutr.su/
http://gaouehaehfoaeajrsr.su/
http://gaohrhurhuhruhfsdr.su/
http://gaghpaheiafhjefijr.su/
http://gaoehuoaoefhuhfugr.su/
http://aegohaohuoruitiier.su/
http://befaheaiudeuhughgr.su/
http://urusurofhsorhfuuhz.io/
http://aeifaeifhutuhuhusz.io/
http://rzhsudhugugfugugsz.io/
13cQ2H6oszrEnvw1ZGdsPix9gUayB8tzNa
qr5pm4d27z250wpz4sfy08ytghxn56kryvsw5tdw99
XfrM8P9YWSg8mQTxSCCxyHUeQjMEGx8vnE
DSG5PddW9wu1eKdLcx4f3KBF4wUvaBFaGc
0x373b9854c9e4511b920372f5495640cdc25d6832
LSermtCTLWeS683x17AtYuhNT8MpMmVmi8
t1XgRHyGj6YDNqkS5EWwdcXG1rjQPFFdUsR
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Signatures
-
Processes:
syslkmz.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" syslkmz.exe -
Phorphiex payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4724-2-0x0000000000400000-0x000000000040E000-memory.dmp family_phorphiex behavioral2/memory/4724-4-0x0000000000400000-0x000000000040E000-memory.dmp family_phorphiex behavioral2/memory/4724-10-0x0000000000400000-0x000000000040E000-memory.dmp family_phorphiex behavioral2/memory/1192-16-0x0000000000400000-0x000000000040E000-memory.dmp family_phorphiex -
Processes:
syslkmz.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslkmz.exe -
Executes dropped EXE 1 IoCs
Processes:
syslkmz.exepid process 1192 syslkmz.exe -
Processes:
syslkmz.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" syslkmz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslkmz.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\1396814479\\syslkmz.exe" 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\1396814479\\syslkmz.exe" 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
Processes:
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\1396814479 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe File created C:\Windows\1396814479\syslkmz.exe 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe File opened for modification C:\Windows\1396814479\syslkmz.exe 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exesyslkmz.exepid process 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe 1192 syslkmz.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exesyslkmz.exedescription pid process Token: SeDebugPrivilege 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe Token: SeDebugPrivilege 1192 syslkmz.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exesyslkmz.exepid process 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe 1192 syslkmz.exe 1192 syslkmz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
749ca850ede36a942a2ff2984313299f_JaffaCakes118.exedescription pid process target process PID 4724 wrote to memory of 1192 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe syslkmz.exe PID 4724 wrote to memory of 1192 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe syslkmz.exe PID 4724 wrote to memory of 1192 4724 749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe syslkmz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\749ca850ede36a942a2ff2984313299f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\1396814479\syslkmz.exeC:\Windows\1396814479\syslkmz.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\1396814479\syslkmz.exeFilesize
454KB
MD5749ca850ede36a942a2ff2984313299f
SHA1b1d42108b09427c61e846b8f4f819cfe78f922a6
SHA2561a7d054abcd9570fa89ab81ed211b37bc59b513a13d5f8db900392a988e5043b
SHA5125092010bf481b619d53ee20d4be12f5383429aeaec6e8991eb6ccaecdbb25bdf7d729d044d4d39227888230689877829dd8406c4c8f5154fdac7bd48f78063ea
-
memory/1192-12-0x0000000000F00000-0x0000000000F78000-memory.dmpFilesize
480KB
-
memory/1192-16-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4724-0-0x0000000000F90000-0x0000000001008000-memory.dmpFilesize
480KB
-
memory/4724-1-0x0000000000FD2000-0x0000000000FD9000-memory.dmpFilesize
28KB
-
memory/4724-2-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4724-4-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4724-11-0x0000000000FD2000-0x0000000000FD9000-memory.dmpFilesize
28KB
-
memory/4724-10-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB