Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe
-
Size
110KB
-
MD5
3c94ee098037b888f88c7ea65b9c5ed1
-
SHA1
0bac3faa29a4ff5e4296d580eada161b8a4d32bf
-
SHA256
d7b17290ba970623904bf700ba778968c1484a7facc423f91dd6fc791c6a7f61
-
SHA512
b8e6dcbbee6529fb4e698381f876f239ea4063f8f00ad9897f84c320e2cb057c58fff0751ebea2463ae63ce59fd2c793ee1b3e489aec6cdabdf36eb9e895e0e3
-
SSDEEP
1536:6R7lzRRGRsScPctAoqZL3Ve++4LCEh8V/chaohOJQZoUzdaywYV8:6RNfGROWA1A+/L60CJQZoKMyp8
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List svcnost.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\xsjw1hlwjfgyksydcpaxbijhzgo3zaer2\svcnost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\xsjw1hlwjfgyksydcpaxbijhzgo3zaer2\\svcnost.exe:*:Enabled:ldrsoft" svcnost.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 2420 svcnost.exe 2420 svcnost.exe -
resource yara_rule behavioral1/memory/2932-3-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/2932-0-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/2420-7-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/2932-9-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/2420-22-0x0000000000400000-0x0000000000462000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Init = "\"C:\\Users\\Admin\\AppData\\Roaming\\xsjw1hlwjfgyksydcpaxbijhzgo3zaer2\\svcnost.exe\"" 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\desktop.ini svcnost.exe File opened for modification C:\Users\Admin\AppData\Roaming\desktop.ini svcnost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry svcnost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\SavedLegacySettingsML = 363338363236343235 svcnost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2932 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2932 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2932 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe 2420 svcnost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2420 2932 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2420 2932 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2420 2932 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2420 2932 3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c94ee098037b888f88c7ea65b9c5ed1_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Roaming\xsjw1hlwjfgyksydcpaxbijhzgo3zaer2\svcnost.exe"C:\Users\Admin\AppData\Roaming\xsjw1hlwjfgyksydcpaxbijhzgo3zaer2\svcnost.exe"2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD54a27242b307c6a836993353035fafc16
SHA15fea7a41b8f9071848108015d8a952e6f944eea0
SHA25602fd93f64bda51e1e2991184cac13f077d509712e462c9e44be9cf8e22c06de1
SHA51235e9c87642b82df2bf0a9312bb0e9abfb98282db1e34032a4d0150d82c5e2f2e13150ddc896f1e954f02288a1e696a4306ee595b94b1e404c6ec17bac64c44be
-
Filesize
54KB
MD57e8e966927e04a35aec644602b8a9e05
SHA1d201b0b41e8701818d60ddbf9f334332a512c4da
SHA25646f18d9fbf63f378d86962cbf24f5ce57ce257555acd4effdcc41c1e2f1adf5c
SHA512246777c79129a5076b71ca5d3f7e59b06d344f6b5e771892ae8ee68c0b5af9207cd1868b1336b49e6a84665309ad379a33ec6c8e72d7ce41de72153637921a51