Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe
-
Size
12.6MB
-
MD5
ee32ada5e5b8578f25d6f2b0762d2f28
-
SHA1
d7cf1680da472199f301dcc5758c95b0c11820fc
-
SHA256
eb63b5df3fa1a0f2c6241e26e3269cf5319180d392819110d765ce5d735d1557
-
SHA512
e96ff40d526a55b0df2499dbc2df4f38f0ef5fd36440c95f939646c290410f9c95f783733e8e44d17ffc09cf52af3ed622ed87123cc7d3bee4797fe4583e613d
-
SSDEEP
393216:N88888888888888888888888888888888888888888888888888888888888888M:
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3504 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cdcmhgoq\ImagePath = "C:\\Windows\\SysWOW64\\cdcmhgoq\\ahkijjzn.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 3424 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4868 ahkijjzn.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4868 set thread context of 3424 4868 ahkijjzn.exe 102 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3464 sc.exe 3188 sc.exe 2104 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1280 3292 WerFault.exe 81 828 4868 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahkijjzn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3292 wrote to memory of 1348 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 82 PID 3292 wrote to memory of 1348 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 82 PID 3292 wrote to memory of 1348 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 82 PID 3292 wrote to memory of 896 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 86 PID 3292 wrote to memory of 896 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 86 PID 3292 wrote to memory of 896 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 86 PID 3292 wrote to memory of 3464 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 88 PID 3292 wrote to memory of 3464 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 88 PID 3292 wrote to memory of 3464 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 88 PID 3292 wrote to memory of 3188 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 92 PID 3292 wrote to memory of 3188 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 92 PID 3292 wrote to memory of 3188 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 92 PID 3292 wrote to memory of 2104 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 94 PID 3292 wrote to memory of 2104 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 94 PID 3292 wrote to memory of 2104 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 94 PID 3292 wrote to memory of 3504 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 97 PID 3292 wrote to memory of 3504 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 97 PID 3292 wrote to memory of 3504 3292 ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe 97 PID 4868 wrote to memory of 3424 4868 ahkijjzn.exe 102 PID 4868 wrote to memory of 3424 4868 ahkijjzn.exe 102 PID 4868 wrote to memory of 3424 4868 ahkijjzn.exe 102 PID 4868 wrote to memory of 3424 4868 ahkijjzn.exe 102 PID 4868 wrote to memory of 3424 4868 ahkijjzn.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cdcmhgoq\2⤵
- System Location Discovery: System Language Discovery
PID:1348
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ahkijjzn.exe" C:\Windows\SysWOW64\cdcmhgoq\2⤵
- System Location Discovery: System Language Discovery
PID:896
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create cdcmhgoq binPath= "C:\Windows\SysWOW64\cdcmhgoq\ahkijjzn.exe /d\"C:\Users\Admin\AppData\Local\Temp\ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3464
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description cdcmhgoq "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3188
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start cdcmhgoq2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2104
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 10322⤵
- Program crash
PID:1280
-
-
C:\Windows\SysWOW64\cdcmhgoq\ahkijjzn.exeC:\Windows\SysWOW64\cdcmhgoq\ahkijjzn.exe /d"C:\Users\Admin\AppData\Local\Temp\ee32ada5e5b8578f25d6f2b0762d2f28_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:3424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 5122⤵
- Program crash
PID:828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3292 -ip 32921⤵PID:3540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4868 -ip 48681⤵PID:3452
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.0MB
MD50ccf81079917c20b905eb17b721da600
SHA13786ccf5e9a1631a6ec7c2fa5e0d41c399b999a1
SHA25652de03bdd9d2ec1c531bc0f655b9bf1b7856d8dc243f8c2d9bca0a51e2a782ac
SHA512e2164c09d7375a90db9a4ce6e80be819aa47c5a76ef1f751617c39c7627e86ce8251a0fe50f7765cf7bb0c946ca89327c3f810c963a10718a0760c11a57a69a9