Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 00:27
Static task
static1
Behavioral task
behavioral1
Sample
0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
0492f8c8547711f75e0ab55be38474d8
-
SHA1
8ce0c24d626f4f72d87d45937aadbba964960cc3
-
SHA256
99ed9696332eab95e0de439fa61c1f7e6bb8235ec5e40b679bb003dd7413500a
-
SHA512
58ed8415a0448fbfc5c75c3e105e06ed8cac7c7dd29a2d4e7e9d969f44e235c77a2cec27e313079250f521f33ce69d1654d438cd99be3c86689cc2a467ad16fb
-
SSDEEP
24576:SqjN1QF2EgNbpSrAg2hrrBoBKNsmNHRilFSqdvwsH6qdfmDwY5neO:Sqh6F2Eaplv6BiHwDR7m8ieO
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" Exporer32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Exporer32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" Exporer32.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} Exporer32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ Exporer32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" Exporer32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe -
resource yara_rule behavioral1/files/0x0036000000015c93-47.dat aspack_v212_v242 -
Executes dropped EXE 3 IoCs
pid Process 2764 Exporer32.exe 2636 fservice.exe 2656 services.exe -
Loads dropped DLL 8 IoCs
pid Process 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2764 Exporer32.exe 2764 Exporer32.exe 2656 services.exe 2656 services.exe 2636 fservice.exe 2764 Exporer32.exe -
resource yara_rule behavioral1/files/0x0035000000015c7f-7.dat upx behavioral1/memory/2176-14-0x0000000005C10000-0x0000000005E0C000-memory.dmp upx behavioral1/memory/2764-17-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2764-23-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2636-33-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2636-34-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2636-43-0x0000000003420000-0x000000000361C000-memory.dmp upx behavioral1/memory/2656-46-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2636-65-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2764-67-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-70-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-72-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-74-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-75-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-77-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-79-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-81-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-83-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-85-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-87-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-89-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-91-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-93-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-95-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2656-97-0x0000000000400000-0x00000000005FC000-memory.dmp upx -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 151.164.23.201 Destination IP 151.164.23.201 -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Exporer32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Exporer32.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe Exporer32.exe File opened for modification C:\Windows\system\sservice.exe Exporer32.exe File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 2656 services.exe 2656 services.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2764 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 28 PID 2176 wrote to memory of 2764 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 28 PID 2176 wrote to memory of 2764 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 28 PID 2176 wrote to memory of 2764 2176 0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe 28 PID 2764 wrote to memory of 2636 2764 Exporer32.exe 29 PID 2764 wrote to memory of 2636 2764 Exporer32.exe 29 PID 2764 wrote to memory of 2636 2764 Exporer32.exe 29 PID 2764 wrote to memory of 2636 2764 Exporer32.exe 29 PID 2636 wrote to memory of 2656 2636 fservice.exe 30 PID 2636 wrote to memory of 2656 2636 fservice.exe 30 PID 2636 wrote to memory of 2656 2636 fservice.exe 30 PID 2636 wrote to memory of 2656 2636 fservice.exe 30 PID 2656 wrote to memory of 2536 2656 services.exe 31 PID 2656 wrote to memory of 2536 2656 services.exe 31 PID 2656 wrote to memory of 2536 2656 services.exe 31 PID 2656 wrote to memory of 2536 2656 services.exe 31 PID 2656 wrote to memory of 2548 2656 services.exe 32 PID 2656 wrote to memory of 2548 2656 services.exe 32 PID 2656 wrote to memory of 2548 2656 services.exe 32 PID 2656 wrote to memory of 2548 2656 services.exe 32 PID 2764 wrote to memory of 2880 2764 Exporer32.exe 35 PID 2764 wrote to memory of 2880 2764 Exporer32.exe 35 PID 2764 wrote to memory of 2880 2764 Exporer32.exe 35 PID 2764 wrote to memory of 2880 2764 Exporer32.exe 35 PID 2548 wrote to memory of 3016 2548 NET.exe 36 PID 2548 wrote to memory of 3016 2548 NET.exe 36 PID 2548 wrote to memory of 3016 2548 NET.exe 36 PID 2548 wrote to memory of 3016 2548 NET.exe 36 PID 2536 wrote to memory of 2996 2536 NET.exe 38 PID 2536 wrote to memory of 2996 2536 NET.exe 38 PID 2536 wrote to memory of 2996 2536 NET.exe 38 PID 2536 wrote to memory of 2996 2536 NET.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0492f8c8547711f75e0ab55be38474d8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\services.exeC:\Windows\services.exe -XP4⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\NET.exeNET STOP srservice5⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP srservice6⤵PID:2996
-
-
-
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc5⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc6⤵PID:3016
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Exporer32.exe.bat3⤵PID:2880
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133B
MD5e83340ddc821c94bf7927e4c03855430
SHA1e58d3d9aa5c582aacd499472c70f1b44b1e58237
SHA2561f4cb7f8aba8f62f950364993929c564dd1f717fbc97f0686c8735398d4a7b1f
SHA51234ccad0991f1bf1cb15ed21a7a4d99265bd44916780049e7c99093f40fef2a008e99799a3c770797a950ca9befc1b6f34c3520b17f53575a120acb4b612d24c8
-
Filesize
342KB
MD52403a5c1d025497c9b65f738fae744be
SHA12e66befa455197f49b444697c9e8a32a72edf994
SHA256eb26194e0129d527ff6d9bdab894af9aaa7685273bf5ba6b75064b1803a3fb06
SHA512a0a1b14a9649799629fd61d4e45823f347a6f82d8d91ad63c3c651be2a57723bb990181bc7e473a1752397c91a1d5227d303b1345f9691a6c6709ce1b0e5383a
-
Filesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
Filesize
13KB
MD5b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA25645d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066