Analysis
- max time kernel
150s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
18/07/2024, 16:14
Behavioral task
behavioral1
Sample
5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
General
- Target 5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe
- Size 400KB
- Sample240718-tpvdjswepj
- SHA256 25b2db6412500a86c7a47ad4d88fe9d556cf677e50214355ddc0d34a620bbaf9
- MD5 5820a8e57fa4d637879cb497a8888cc1
- SHA1 069d0e2bb993df8d94bfae8d7932be4aa1926ce2
- SHA512 086bb7b98c8e948df20dbf70a5e01a24fa8a4490923fbd8e932d20e3272b76997b182f279be2e0929c2eb05fe5971e43b9619197f9bbed99b40251d672620c57
- SSDEEP 768:GsNLIk+WHQYNqPH6aRdyXDjbBJ3+seF+4WOJ:kkDH+PH9dyzj7eF/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.93/
-
http://gimmefile.top/
-
http://feedmefile.top/
-
http://gotsomefile.top/
-
http://185.215.113.66/
Wallets
-
15DBeUGFSQLbpYvWLJwzHUXSRrHNU9uQuS8c2wvFLZ7Nxz3N
-
1E5ZxnNUbbGQarWjMA7tCwp3Btm38GvRkv
-
3AcMV5pSUcxMmmcMbfSkJXRKbCrF3ysUDJ
-
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
-
XkcKjKZqNUkChwJXMj5uDjDns6etXvakir
-
D7MYki8urW3xq8sZJ8Q2v2ZrHxjzp7ACvb
-
0x76e4CB2fcf7f931Fd750e93F443536Ee068d1cdE
-
LfYFvpk2hccXw12tN3BBMWh7EcUBMbKoTG
-
rUQFcff9R1eKAwTtR1wbuQxmcoB236mz44
-
TEUaG7jyXdyrDS3JeEg1w1hotmmEMjx4TB
-
t1gTRxsrEXwky32j22jgFRZAafBzmCV2M2V
-
AT5Vm3ZrUg98s9kBue2g9YjnwK4kFKhQw3
-
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
-
44L2q3sPJ3DMJZiuSpHvehHMLbMXx3SAoVbLm5DWDw1A7PhUvcCPAGg5qAN98DWAUG7CuD4WmydP4JkewTz2aeVd4qhS822
-
GBLUYL3QTKP3NXVWCYNZ7ZH4CWFT6PVCXEYCNUNSHM34WKG2UL5EDQMV
-
bnb154sx9pdh8er33ujxlpfk3zwvlfp9rd5rskvvgc
-
bc1qn4r93am7rxxr4a5dwydhwx0p2kd4xfd7mz42f3
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Signatures
- Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" winblrsnrcs.exe - Phorphiex payload 2 IoCs
resource yara_rule behavioral2/files/0x00070000000234e1-3.dat family_phorphiex behavioral2/files/0x00120000000234ea-9.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" spoolsv.exe - Executes dropped EXE 6 IoCs
pid Process 3972 spoolsv.exe 5092 1481638898.exe 388 sylsplvc.exe 3944 2277522949.exe 4068 winblrsnrcs.exe 3784 2363714522.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\274051334913836\\spoolsv.exe" 5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe" 1481638898.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winblrsnrcs.exe" 2277522949.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\274051334913836\\spoolsv.exe" 5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\sylsplvc.exe 1481638898.exe File opened for modification C:\Windows\sylsplvc.exe 1481638898.exe File created C:\Windows\winblrsnrcs.exe 2277522949.exe File opened for modification C:\Windows\winblrsnrcs.exe 2277522949.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5028 wrote to memory of 3972 5028 5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe 92 PID 5028 wrote to memory of 3972 5028 5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe 92 PID 5028 wrote to memory of 3972 5028 5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe 92 PID 3972 wrote to memory of 5092 3972 spoolsv.exe 97 PID 3972 wrote to memory of 5092 3972 spoolsv.exe 97 PID 3972 wrote to memory of 5092 3972 spoolsv.exe 97 PID 5092 wrote to memory of 388 5092 1481638898.exe 99 PID 5092 wrote to memory of 388 5092 1481638898.exe 99 PID 5092 wrote to memory of 388 5092 1481638898.exe 99 PID 388 wrote to memory of 3944 388 sylsplvc.exe 100 PID 388 wrote to memory of 3944 388 sylsplvc.exe 100 PID 388 wrote to memory of 3944 388 sylsplvc.exe 100 PID 3944 wrote to memory of 4068 3944 2277522949.exe 101 PID 3944 wrote to memory of 4068 3944 2277522949.exe 101 PID 3944 wrote to memory of 4068 3944 2277522949.exe 101 PID 388 wrote to memory of 3784 388 sylsplvc.exe 102 PID 388 wrote to memory of 3784 388 sylsplvc.exe 102 PID 388 wrote to memory of 3784 388 sylsplvc.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5820a8e57fa4d637879cb497a8888cc1_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\274051334913836\spoolsv.exeC:\274051334913836\spoolsv.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\1481638898.exeC:\Users\Admin\AppData\Local\Temp\1481638898.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\sylsplvc.exeC:\Windows\sylsplvc.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\2277522949.exeC:\Users\Admin\AppData\Local\Temp\2277522949.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\winblrsnrcs.exeC:\Windows\winblrsnrcs.exe6⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:4068
-
-
-
C:\Users\Admin\AppData\Local\Temp\2363714522.exeC:\Users\Admin\AppData\Local\Temp\2363714522.exe5⤵
- Executes dropped EXE
PID:3784
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\274051334913836\spoolsv.exe
- Size 400KB
- SHA256 25b2db6412500a86c7a47ad4d88fe9d556cf677e50214355ddc0d34a620bbaf9
- MD5 5820a8e57fa4d637879cb497a8888cc1
- SHA1 069d0e2bb993df8d94bfae8d7932be4aa1926ce2
- SHA512 086bb7b98c8e948df20dbf70a5e01a24fa8a4490923fbd8e932d20e3272b76997b182f279be2e0929c2eb05fe5971e43b9619197f9bbed99b40251d672620c57
- SSDEEP 768:GsNLIk+WHQYNqPH6aRdyXDjbBJ3+seF+4WOJ:kkDH+PH9dyzj7eF/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S5KAZR04\3[1]
- Size 86KB
- SHA256 2ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f
- MD5 fe1e93f12cca3f7c0c897ef2084e1778
- SHA1 fb588491ddad8b24ea555a6a2727e76cec1fade3
- SHA512 36e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93
- SSDEEP 1536:707GMwma6WMXMlXfQlt5JfoFmIwKsWRB4qz9LtNWWNEGHGBlx2dSH:70sDfqt5JfokJ5WRB9JtcWOGmgdSH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1481638898.exe
- Size 79KB
- SHA256 3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879
- MD5 1e8a2ed2e3f35620fb6b8c2a782a57f3
- SHA1 e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a
- SHA512 ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade
- SSDEEP 1536:y3Mz8f2Z9F1nc2ZWEa5pFeStStfFPeeeeeeeeWeeeee:ZwfYFRVZWz3XtStfF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2277522949.exe
- Size 18KB
- SHA256 6e24c56691c01a191e88f193966e04000fe5b83caa9b5adb4afebbd6cc717c68
- MD5 c53b73c89515e712a301a9d17e313900
- SHA1 154b857b1ceec6938851e57baa0861b6a1fceb16
- SHA512 eeefbefd1c36f8493c58cda9dbfa9ae6580a7507fb99f1deb3f869348a7e92d702cdae50c4f035b31303717984b4282fa9777e92fdd1a0c70ec32f4e7063efc0
- SSDEEP 192:yJUjuy7lXKVIC11+SP0XwsDZaBxvAJxThDiFGPkWSctFv4bsLbnW:yJf4lO1k40AsDkHAtbcWScH4be
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2363714522.exe
- Size 10KB
- SHA256 c339b1bf9947ba07e9203ebfdd6f41cf8414f4ef795d528c8f768eab0d136586
- MD5 9d3a5017e86fd5e182ca58c8293ffa3e
- SHA1 242a24a7cda4f7c7a87c19c1ce036227b48f8235
- SHA512 009a35103362a59f83100425c702bf0072be3a3fa1afd508bc530f26a2b78f607ec70ffc4a2c929596943864b1a507a1ff4714bbfb4784d44d8dfa22084b710b
- SSDEEP 192:vdHjWf5HVZCwqHZkqOJ+iuJxTZtzthyCWr:Vaf51y5sIjLz/Wr
- MD5 SHA1 SHA512 SSDEEP