Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 16:28
Static task
static1
Behavioral task
behavioral1
Sample
02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe
-
Size
10.6MB
-
MD5
02efa58022f21dab1d400e8ddc3620c4
-
SHA1
e805af3f400abe91974ad3a2b544a6e3b5f77b1a
-
SHA256
61dbcf0adaa64a67b42678fbdfffac4035ef4eb947f455d6bda7dc807e4a589c
-
SHA512
16ec166259460e33a60482212ce9cff12967add5a4fa0a5cb1ed3c0658e3627f6f9fe1990d509e48653920cd383e3d3e4ecd4d0c55778579beb626c9e8250a9e
-
SSDEEP
196608:d3qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqP:d
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2784 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wnociewt\ImagePath = "C:\\Windows\\SysWOW64\\wnociewt\\xjqkpviq.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2780 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
xjqkpviq.exepid process 2788 xjqkpviq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
xjqkpviq.exedescription pid process target process PID 2788 set thread context of 2780 2788 xjqkpviq.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2696 sc.exe 2648 sc.exe 2896 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exexjqkpviq.exedescription pid process target process PID 1940 wrote to memory of 2232 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2232 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2232 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2232 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2992 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2992 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2992 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2992 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe cmd.exe PID 1940 wrote to memory of 2696 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2696 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2696 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2696 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2648 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2648 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2648 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2648 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2896 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2896 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2896 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2896 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe sc.exe PID 1940 wrote to memory of 2784 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe netsh.exe PID 1940 wrote to memory of 2784 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe netsh.exe PID 1940 wrote to memory of 2784 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe netsh.exe PID 1940 wrote to memory of 2784 1940 02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe netsh.exe PID 2788 wrote to memory of 2780 2788 xjqkpviq.exe svchost.exe PID 2788 wrote to memory of 2780 2788 xjqkpviq.exe svchost.exe PID 2788 wrote to memory of 2780 2788 xjqkpviq.exe svchost.exe PID 2788 wrote to memory of 2780 2788 xjqkpviq.exe svchost.exe PID 2788 wrote to memory of 2780 2788 xjqkpviq.exe svchost.exe PID 2788 wrote to memory of 2780 2788 xjqkpviq.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wnociewt\2⤵PID:2232
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xjqkpviq.exe" C:\Windows\SysWOW64\wnociewt\2⤵PID:2992
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create wnociewt binPath= "C:\Windows\SysWOW64\wnociewt\xjqkpviq.exe /d\"C:\Users\Admin\AppData\Local\Temp\02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2696 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description wnociewt "wifi internet conection"2⤵
- Launches sc.exe
PID:2648 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start wnociewt2⤵
- Launches sc.exe
PID:2896 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2784
-
C:\Windows\SysWOW64\wnociewt\xjqkpviq.exeC:\Windows\SysWOW64\wnociewt\xjqkpviq.exe /d"C:\Users\Admin\AppData\Local\Temp\02efa58022f21dab1d400e8ddc3620c4_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:2780
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\xjqkpviq.exeFilesize
12.2MB
MD51ecb54cce714174b2df65a278027fb46
SHA1c511435dc98d6e70ad8aea2f2b84e363b5430dab
SHA256289ce48111099170aa8bebcaf0b24363c204aadab03059113edb6268b845f6d9
SHA512abe9858e02b36315b36f9266974581c9698e67043ec9c2750d4ac8eb9a1e35cfa5c219488c46dc594b5381682fb0e60a00bef4c4bc8a015471a7948756bd999a
-
memory/1940-1-0x0000000000980000-0x0000000000A80000-memory.dmpFilesize
1024KB
-
memory/1940-3-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1940-2-0x0000000000020000-0x0000000000033000-memory.dmpFilesize
76KB
-
memory/1940-8-0x0000000000400000-0x0000000000871000-memory.dmpFilesize
4.4MB
-
memory/1940-9-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/2780-10-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2780-13-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2780-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2780-16-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2780-17-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2788-15-0x0000000000400000-0x0000000000871000-memory.dmpFilesize
4.4MB