Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
31-08-2024 02:05
Static task
static1
Behavioral task
behavioral1
Sample
cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe
-
Size
94KB
-
MD5
cc0f419b4212c779e1497cc03f205ed9
-
SHA1
9412095cb8a97d28c0cca70342dded68a3f53fe2
-
SHA256
9f20f77fa8aa934eb5feb69e8dd790ec7444fc83a0e57db203d59e5c7e33b60e
-
SHA512
a7f6f19ba763e38823ad8af6403f6437913fe3fd92dcf26918b93aa120d113974e58f24a866c726f71756ea35434eca9dc68b55cd444d886a638db25faabe7fe
-
SSDEEP
1536:Z3gE1QqpotGEN5u0qjGKNr/Y2mminsCBOWrkFYF78LoitKcBajxkAWG5E8k8jwak:xgE1QqvENWp6nsErTCoF+ajxkzGFk8ju
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\laalljfq\\tgrxauqf.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgrxauqf.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgrxauqf.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
llpscwplcnqidnuh.exepid process 2656 llpscwplcnqidnuh.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exepid process 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\TgrXauqf = "C:\\Users\\Admin\\AppData\\Local\\laalljfq\\tgrxauqf.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exesvchost.exesvchost.exellpscwplcnqidnuh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llpscwplcnqidnuh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe 1220 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 472 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exesvchost.exesvchost.exellpscwplcnqidnuh.exedescription pid process Token: SeSecurityPrivilege 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe Token: SeDebugPrivilege 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe Token: SeSecurityPrivilege 1708 svchost.exe Token: SeSecurityPrivilege 1220 svchost.exe Token: SeDebugPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeSecurityPrivilege 2656 llpscwplcnqidnuh.exe Token: SeLoadDriverPrivilege 2656 llpscwplcnqidnuh.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe Token: SeBackupPrivilege 1220 svchost.exe Token: SeRestorePrivilege 1220 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exedescription pid process target process PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1708 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 1220 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe svchost.exe PID 1700 wrote to memory of 2656 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe llpscwplcnqidnuh.exe PID 1700 wrote to memory of 2656 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe llpscwplcnqidnuh.exe PID 1700 wrote to memory of 2656 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe llpscwplcnqidnuh.exe PID 1700 wrote to memory of 2656 1700 cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe llpscwplcnqidnuh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cc0f419b4212c779e1497cc03f205ed9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\llpscwplcnqidnuh.exe"C:\Users\Admin\AppData\Local\Temp\llpscwplcnqidnuh.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
3Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\laalljfq\tgrxauqf.exeFilesize
94KB
MD5cc0f419b4212c779e1497cc03f205ed9
SHA19412095cb8a97d28c0cca70342dded68a3f53fe2
SHA2569f20f77fa8aa934eb5feb69e8dd790ec7444fc83a0e57db203d59e5c7e33b60e
SHA512a7f6f19ba763e38823ad8af6403f6437913fe3fd92dcf26918b93aa120d113974e58f24a866c726f71756ea35434eca9dc68b55cd444d886a638db25faabe7fe
-
memory/1220-53-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-46-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-104-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-66-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-58-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-29-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-65-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-47-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1220-37-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1700-27-0x00000000772DF000-0x00000000772E0000-memory.dmpFilesize
4KB
-
memory/1700-85-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/1700-5-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1700-36-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/1700-0-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/1700-6-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/1700-26-0x00000000772E0000-0x00000000772E1000-memory.dmpFilesize
4KB
-
memory/1700-2-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/1700-56-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/1700-4-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1700-57-0x00000000772E0000-0x00000000772E1000-memory.dmpFilesize
4KB
-
memory/1700-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1700-70-0x00000000772DF000-0x00000000772E0000-memory.dmpFilesize
4KB
-
memory/1700-72-0x0000000002BA0000-0x0000000002BDA000-memory.dmpFilesize
232KB
-
memory/1700-83-0x0000000002BA0000-0x0000000002BDA000-memory.dmpFilesize
232KB
-
memory/1700-35-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1700-86-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1708-17-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1708-14-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1708-15-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1708-8-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1708-20-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1708-10-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1708-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1708-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1708-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2656-89-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/2656-94-0x0000000000400000-0x0000000000439BD8-memory.dmpFilesize
230KB
-
memory/2656-93-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2656-88-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB