df39062472a59fb27f9951169229053a7cd2c49d1fe0bc1abe1d10548c44695d

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe
Size

220KB
MD5

165a4ffdc2704770eeef07e1e5146c94
SHA1

db54b38dff50e311e8edb4653443ef4b38600f5d
SHA256

df39062472a59fb27f9951169229053a7cd2c49d1fe0bc1abe1d10548c44695d
SHA512

3c3786853e4ac4ae35f86c364bb8be4757961651b039b9b1a8630e25f53572c73c3012db1f07f335dbc3a2fd654bb58700138f527bf2631c7d7428dbc182afc1
SSDEEP

3072:yOkEXFtVI7huijzivefSjIeVXcJZn+ehHcNeBS1SNmiH3jDfRtoJpUCIwZ1ApqKw:fkEXFtV6ncxXcJZkNe6fQB2zUDw

Score

8^/10

discovery evasion execution persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\imapioko.sys	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2720	netsh.exe
2560	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\cpqoko6\Parameters\ServiceDll = "C:\\Windows\\system32\\erokosvc.dll"	reg.exe

Deletes itself 1 IoCs

pid	Process
2864	cMd.exe

Executes dropped EXE 1 IoCs

pid	Process
2908	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe

Loads dropped DLL 3 IoCs

pid	Process
2708	CmD.exe
2708	CmD.exe
2992	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\erokosvc.dll	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2988	sc.exe
1032	sc.exe
2672	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CmD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cMd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CmD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1968	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\TP = "1000"	reg.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	svchost.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2232	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2232	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2232	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2232	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2708	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2708	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2708	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2708	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	32
PID 2708 wrote to memory of 2908	2708	CmD.exe	34
PID 2708 wrote to memory of 2908	2708	CmD.exe	34
PID 2708 wrote to memory of 2908	2708	CmD.exe	34
PID 2708 wrote to memory of 2908	2708	CmD.exe	34
PID 3048 wrote to memory of 2864	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2864	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2864	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2864	3048	165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2716	2864	cMd.exe	37
PID 2864 wrote to memory of 2716	2864	cMd.exe	37
PID 2864 wrote to memory of 2716	2864	cMd.exe	37
PID 2864 wrote to memory of 2716	2864	cMd.exe	37
PID 2864 wrote to memory of 2720	2864	cMd.exe	38
PID 2864 wrote to memory of 2720	2864	cMd.exe	38
PID 2864 wrote to memory of 2720	2864	cMd.exe	38
PID 2864 wrote to memory of 2720	2864	cMd.exe	38
PID 2864 wrote to memory of 2560	2864	cMd.exe	39
PID 2864 wrote to memory of 2560	2864	cMd.exe	39
PID 2864 wrote to memory of 2560	2864	cMd.exe	39
PID 2864 wrote to memory of 2560	2864	cMd.exe	39
PID 2864 wrote to memory of 2672	2864	cMd.exe	40
PID 2864 wrote to memory of 2672	2864	cMd.exe	40
PID 2864 wrote to memory of 2672	2864	cMd.exe	40
PID 2864 wrote to memory of 2672	2864	cMd.exe	40
PID 2864 wrote to memory of 2984	2864	cMd.exe	41
PID 2864 wrote to memory of 2984	2864	cMd.exe	41
PID 2864 wrote to memory of 2984	2864	cMd.exe	41
PID 2864 wrote to memory of 2984	2864	cMd.exe	41
PID 2864 wrote to memory of 2980	2864	cMd.exe	42
PID 2864 wrote to memory of 2980	2864	cMd.exe	42
PID 2864 wrote to memory of 2980	2864	cMd.exe	42
PID 2864 wrote to memory of 2980	2864	cMd.exe	42
PID 2864 wrote to memory of 1308	2864	cMd.exe	43
PID 2864 wrote to memory of 1308	2864	cMd.exe	43
PID 2864 wrote to memory of 1308	2864	cMd.exe	43
PID 2864 wrote to memory of 1308	2864	cMd.exe	43
PID 2864 wrote to memory of 2988	2864	cMd.exe	44
PID 2864 wrote to memory of 2988	2864	cMd.exe	44
PID 2864 wrote to memory of 2988	2864	cMd.exe	44
PID 2864 wrote to memory of 2988	2864	cMd.exe	44
PID 2864 wrote to memory of 1032	2864	cMd.exe	46
PID 2864 wrote to memory of 1032	2864	cMd.exe	46
PID 2864 wrote to memory of 1032	2864	cMd.exe	46
PID 2864 wrote to memory of 1032	2864	cMd.exe	46
PID 2864 wrote to memory of 1968	2864	cMd.exe	47
PID 2864 wrote to memory of 1968	2864	cMd.exe	47
PID 2864 wrote to memory of 1968	2864	cMd.exe	47
PID 2864 wrote to memory of 1968	2864	cMd.exe	47

C:\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\CmD.exe
  CmD /c copy "C:\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- C:\Windows\SysWOW64\CmD.exe
  CmD /c ""C:\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe" /okoarg > "C:\Users\Admin\AppData\Local\Temp\w3oko.bat""
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe" /okoarg
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2908
- C:\Windows\SysWOW64\cMd.exe
  cMd /c "C:\Users\Admin\AppData\Local\Temp\w3oko.bat"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\reg.exe
    reG aDd "hklm\SOFTWARE\Microsoft\Internet Explorer\Main" /v TP /t ReG_Sz /d 1000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:2716
- - C:\Windows\SysWOW64\netsh.exe
    NetSh FIReWAlL Add allOweDPrOgrAm naMe="BlueSoleil OKO" prOGram="C:\Windows\system32\svchost.exe" mode=ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2720
- - C:\Windows\SysWOW64\netsh.exe
    nETsH fIrEwaLl aDD pOrToPEnIng tcP 8085 "OKOToGate" eNABLe
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2560
- - C:\Windows\SysWOW64\sc.exe
    Sc CreATe "cpqoko6" tyPE= share start= auto binPaTh= "C:\Windows\system32\svchost.exe -k tapisrvs" DisplayName= "Service Serenum Temporary CPL Search HID Bluetooth SyncMgr"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2672
- - C:\Windows\SysWOW64\reg.exe
    rEg adD "hkLm\sYsTEm\CuRrenTcoNtRoLSeT\seRvIcES\cpqoko6\Parameters" /v ServiceDll /t ReG_EXpaND_Sz /d "C:\Windows\system32\erokosvc.dll" /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - System Location Discovery: System Language Discovery
    PID:2984
- - C:\Windows\SysWOW64\reg.exe
    rEg adD "hkLm\sYsTEm\CuRrenTcoNtRoLSeT\seRvIcES\cpqoko6" /v FailureActions /t rEG_BInaRY /d 00000000000000000000000003000000140000000100000060EA00000100000060EA00000100000060EA0000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
- - C:\Windows\SysWOW64\reg.exe
    ReG adD "hklm\SOfTwaRe\mIcrOSoFt\WiNdoWs nt\CURrENtveRSiOn\svcHoSt" /v tapisrvs /t rEg_mULti_sz /d "cpqoko6\0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1308
- - C:\Windows\SysWOW64\sc.exe
    sc start "cpqoko6"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc boot ok
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1032
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:1968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k tapisrvs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\w3oko.bat

Filesize
1KB

MD5
32d89c786932f0318196c0126a9cf5e6

SHA1
cf4dab005a3f3e694e02138d01edd127d839f5ec

SHA256
a0f88bc3fbba04a78a7f40cd2f8ae3534e001d05b07159e9141fd3e9c23620aa

SHA512
4f7daf36cec56d081c4daf69ec5f5a39ea717daebe37d69f829d8e88aa52989e89e2e682c625cc6483452c285258820ed28ec1e9b801271f953c23f7eb4bd5d6

Download Submit
\??\c:\windows\SysWOW64\erokosvc.dll

Filesize
118KB

MD5
14947076c826c1ae5cb965cd1bd2efcb

SHA1
550a0115ad401ce0c37ec45de94c9004ff46cc4b

SHA256
f49a73b3006891c7fcf38157f3923c44fe89e4f298429b2df6139c2e2964f9e0

SHA512
6cf84506bc1e8c045e61eea107c36809f246d1a535d01d77760f8cba3e57a32028254fc053afae30342f18adb164b3fb10bdcbeb0c3520923a16d9b7f1c19169

Download Submit
\Users\Admin\AppData\Local\Temp\165a4ffdc2704770eeef07e1e5146c94_JaffaCakes118.exe.exe

Filesize
220KB

MD5
165a4ffdc2704770eeef07e1e5146c94

SHA1
db54b38dff50e311e8edb4653443ef4b38600f5d

SHA256
df39062472a59fb27f9951169229053a7cd2c49d1fe0bc1abe1d10548c44695d

SHA512
3c3786853e4ac4ae35f86c364bb8be4757961651b039b9b1a8630e25f53572c73c3012db1f07f335dbc3a2fd654bb58700138f527bf2631c7d7428dbc182afc1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads