Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 08:51
Behavioral task
behavioral1
Sample
7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
General
- Target 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe
- Size 1.1MB
- Sample240528-kr78rada91
- SHA256 ccfb64f4ae7e3b73161c04364528abab7b4d8b73106bb85d6f069c3ecaaf1cba
- MD5 7c5fd052b443e7f366e36e8778661271
- SHA1 b6418caa18fe688c14c6d87c96155275e0fb4ee9
- SHA512 6e9b459634a61612a0246359407b02db648120145f5d0f56e508c4346769b52fe757bc4c9e88fdebacac11e45f73071168dfad6615b0d1c548945df332ebe42f
- SSDEEP 24576:F31SZSaMidm23AzTOAV4xhFIaSV5VZZGSDNVwftoJNDBki+4K4zI4VX9wm6fj:FwZSTidmvuAGhFA54qVwfoNDBkirJzIz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/1340-3-0x0000000000F70000-0x0000000001095000-memory.dmp xmrig behavioral2/files/0x0007000000023406-8.dat xmrig behavioral2/memory/2408-12-0x0000000000520000-0x0000000000645000-memory.dmp xmrig behavioral2/memory/1340-17-0x0000000000F70000-0x0000000001095000-memory.dmp xmrig behavioral2/files/0x0007000000023412-20.dat xmrig behavioral2/memory/2408-34-0x0000000000520000-0x0000000000645000-memory.dmp xmrig -
resource yara_rule behavioral2/files/0x0008000000022f51-2.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation hCKob.exe - Executes dropped EXE 4 IoCs
pid Process 4400 hCKob.exe 2408 loader_xmr.exe 716 hCKob.exe 3440 xmrig.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 hCKob.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 hCKob.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE hCKob.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies hCKob.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe hCKob.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe hCKob.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe hCKob.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe hCKob.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe hCKob.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe hCKob.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe hCKob.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\chrome_installer.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe hCKob.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe hCKob.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe hCKob.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe hCKob.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe hCKob.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe hCKob.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe hCKob.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe hCKob.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe hCKob.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe hCKob.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe hCKob.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" hCKob.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" hCKob.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix hCKob.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" hCKob.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" hCKob.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ hCKob.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" hCKob.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" hCKob.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 5108 PING.EXE - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2408 loader_xmr.exe 2408 loader_xmr.exe 2408 loader_xmr.exe 2408 loader_xmr.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1340 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe Token: SeLockMemoryPrivilege 3440 xmrig.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1340 wrote to memory of 4400 1340 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe 83 PID 1340 wrote to memory of 4400 1340 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe 83 PID 1340 wrote to memory of 4400 1340 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe 83 PID 2408 wrote to memory of 716 2408 loader_xmr.exe 85 PID 2408 wrote to memory of 716 2408 loader_xmr.exe 85 PID 2408 wrote to memory of 716 2408 loader_xmr.exe 85 PID 1340 wrote to memory of 3916 1340 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe 86 PID 1340 wrote to memory of 3916 1340 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe 86 PID 1340 wrote to memory of 3916 1340 7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe 86 PID 3916 wrote to memory of 5108 3916 cmd.exe 88 PID 3916 wrote to memory of 5108 3916 cmd.exe 88 PID 3916 wrote to memory of 5108 3916 cmd.exe 88 PID 2408 wrote to memory of 3440 2408 loader_xmr.exe 90 PID 2408 wrote to memory of 3440 2408 loader_xmr.exe 90 PID 716 wrote to memory of 2496 716 hCKob.exe 98 PID 716 wrote to memory of 2496 716 hCKob.exe 98 PID 716 wrote to memory of 2496 716 hCKob.exe 98 PID 4400 wrote to memory of 4328 4400 hCKob.exe 99 PID 4400 wrote to memory of 4328 4400 hCKob.exe 99 PID 4400 wrote to memory of 4328 4400 hCKob.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7c5fd052b443e7f366e36e8778661271_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\hCKob.exeC:\Users\Admin\AppData\Local\Temp\hCKob.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\78320968.bat" "3⤵PID:4328
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @ping -n 5 127.0.0.1&del C:\Users\Admin\AppData\Local\Temp\7C5FD0~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.13⤵
- Runs ping.exe
PID:5108
-
-
-
C:\ProgramData\Ltional\loader_xmr.exeC:\ProgramData\Ltional\loader_xmr.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\TEMP\hCKob.exeC:\Windows\TEMP\hCKob.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\78320968.bat" "3⤵PID:2496
-
-
-
C:\ProgramData\Microsoft\Ltional\xmrig.exeC:\ProgramData\Microsoft\Ltional\xmrig.exe -o stratum+tcp://pool.supportxmr.com:5555 -u 44zTykLhMkwepTxWQbrhbxjFq6UEM3fZP91fc7hysUaB5vKZb6NjYqhMLKaajbJpugCht2BFeNm9iESL5uuYZ5r8Ssaxx2S -p MyWorker:[email protected] -k --max-cpu-usage=802⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 31KB
- SHA256 9d12c9a188b58770103b531d98831382dba5c2017cd1e5d8c6c04b4a1777b5e3
- MD5 61252e41ba4d5c7395dea649bbc2dfc5
- SHA1 7a6447f3bdf1236f537ef121370a5042ec1b6b44
- SHA512 ac7a4c9f5d8462cf1c3914a965f4d34560567eb5ac79d1b9eed5a6ed6279ea763b2eb401bae1202c99ddebef8edc4540a0c84316185629f90ff4748226547ba6
- SSDEEP 768:uWQ3655Kv1X/qY1MSdteQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdtlGCq2iW7z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Ltional\loader_xmr.exe
- Size 1.1MB
- SHA256 ccfb64f4ae7e3b73161c04364528abab7b4d8b73106bb85d6f069c3ecaaf1cba
- MD5 7c5fd052b443e7f366e36e8778661271
- SHA1 b6418caa18fe688c14c6d87c96155275e0fb4ee9
- SHA512 6e9b459634a61612a0246359407b02db648120145f5d0f56e508c4346769b52fe757bc4c9e88fdebacac11e45f73071168dfad6615b0d1c548945df332ebe42f
- SSDEEP 24576:F31SZSaMidm23AzTOAV4xhFIaSV5VZZGSDNVwftoJNDBki+4K4zI4VX9wm6fj:FwZSTidmvuAGhFA54qVwfoNDBkirJzIz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Ltional\xmrig.exe
- Size 467KB
- SHA256 77255adc0910dc376f87f4db05849dc8a20c9e87ab181cf2ff513fc718c869bd
- MD5 3fe786058a5e426c151ac71566f504ae
- SHA1 76a8fe2f276a8fe174559fe24250093adb8619db
- SHA512 5e387b659c007ac8179375c9b2ce35b8413100394ebb3773962a33e1ac9de228b128d713417aa1138b3cbef5f3a5b79a6b11f888495519bbe46bddac78ed1a7c
- SSDEEP 12288:nvZxZQhVYaxECCLm072NqezRZtIeU32ybr0G/NEtIWpqRCf4zBlgVX9:nbvCxIeU3toG/NEtIWp4K4zDgVX9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\78320968.bat
- Size 185B
- SHA256 719daf4e7c8cfcf51fda3870d308bddd31386a2fd8bcef31a2e877229d2719ec
- MD5 a92824dc9838a0e6cdab34d39ec4bcd4
- SHA1 58fcc34ae0b08e2f1d01f1c9dc6cfd06505e6e9d
- SHA512 4a80d0e1ca84172d8da7866d5ff215a6af81f46566efc69766c0a1450a5ef0c7a8e17f3a7f456b15c10658968fab9d2c4f72ef100b954c7cb47e919b7ead7dcc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\hCKob.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\78320968.bat
- Size 131B
- SHA256 3912a67cab99395be37c50a39a495289ef5d4453a6544f580fdbdf9b07c715d7
- MD5 f63588916f612ee89db4b09f8608f62a
- SHA1 9fad4dff7931b75546783fa89034dc433648eca0
- SHA512 3acb69767518cd3451f56a124083ebf83009e4478042eccf9041219624e674cb352ee706d1fce17d5c926fe896f5adb54475a75c4b147fa9981f91a2d320de4a
- MD5 SHA1 SHA512