Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe
-
Size
35KB
-
MD5
9b9da065249e8fe54710e673923b7cd5
-
SHA1
855744b965629510b6929fa1d2e19cd6c796f030
-
SHA256
56290c2104affa1cf206123446540929c031486b6c3b3519b2de9a96963c9710
-
SHA512
4a38a4bc84911ece6042746aa631e5077373197b2cec269c3b89b7bbb4bf0b0fd992b080f69d7c1daab608b9653be9f48cbce0c9bb9ac6a89a3ca2ffc566d1f3
-
SSDEEP
768:Di/8POyOVXowzUyQ9EKa2Fi9k13ebvMSPIl1R3R:DNPlOVXowzUL+KOOMb0P33R
Malware Config
Signatures
-
R77 family
-
r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule behavioral2/files/0x0007000000023cd6-35.dat r77_payload -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4220 powershell.exe 2824 powershell.exe 644 powershell.exe 760 powershell.exe -
Downloads MZ/PE file
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4852 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation $77-SystemProcessor.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe $77-SystemProcessor.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe $77-SystemProcessor.exe -
Executes dropped EXE 1 IoCs
pid Process 4104 $77-SystemProcessor.exe -
Loads dropped DLL 11 IoCs
pid Process 2168 Process not Found 644 powershell.exe 1064 Process not Found 760 powershell.exe 1720 Process not Found 4220 powershell.exe 3976 Process not Found 4496 Process not Found 2824 powershell.exe 2540 Process not Found 4852 netsh.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\$77-SystemProcessor.exe" $77-SystemProcessor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\$77-SystemProcessor.exe" $77-SystemProcessor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" $77-SystemProcessor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" $77-SystemProcessor.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 25 raw.githubusercontent.com 26 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe 644 powershell.exe 644 powershell.exe 644 powershell.exe 644 powershell.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 760 powershell.exe 760 powershell.exe 760 powershell.exe 760 powershell.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 4220 powershell.exe 4220 powershell.exe 4220 powershell.exe 4220 powershell.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 2824 powershell.exe 2824 powershell.exe 2824 powershell.exe 2824 powershell.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 4104 $77-SystemProcessor.exe 4852 netsh.exe 4852 netsh.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe Token: SeDebugPrivilege 644 powershell.exe Token: SeDebugPrivilege 4104 $77-SystemProcessor.exe Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 4220 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe Token: 33 4104 $77-SystemProcessor.exe Token: SeIncBasePriorityPrivilege 4104 $77-SystemProcessor.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 548 wrote to memory of 620 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe 85 PID 548 wrote to memory of 620 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe 85 PID 620 wrote to memory of 4024 620 cmd.exe 87 PID 620 wrote to memory of 4024 620 cmd.exe 87 PID 548 wrote to memory of 4104 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe 88 PID 548 wrote to memory of 4104 548 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe 88 PID 4104 wrote to memory of 1704 4104 $77-SystemProcessor.exe 101 PID 4104 wrote to memory of 1704 4104 $77-SystemProcessor.exe 101 PID 1704 wrote to memory of 644 1704 cmd.exe 103 PID 1704 wrote to memory of 644 1704 cmd.exe 103 PID 4104 wrote to memory of 3000 4104 $77-SystemProcessor.exe 106 PID 4104 wrote to memory of 3000 4104 $77-SystemProcessor.exe 106 PID 3000 wrote to memory of 760 3000 cmd.exe 108 PID 3000 wrote to memory of 760 3000 cmd.exe 108 PID 4104 wrote to memory of 1272 4104 $77-SystemProcessor.exe 109 PID 4104 wrote to memory of 1272 4104 $77-SystemProcessor.exe 109 PID 1272 wrote to memory of 4220 1272 cmd.exe 111 PID 1272 wrote to memory of 4220 1272 cmd.exe 111 PID 4104 wrote to memory of 3256 4104 $77-SystemProcessor.exe 113 PID 4104 wrote to memory of 3256 4104 $77-SystemProcessor.exe 113 PID 3256 wrote to memory of 2824 3256 cmd.exe 115 PID 3256 wrote to memory of 2824 3256 cmd.exe 115 PID 4104 wrote to memory of 4852 4104 $77-SystemProcessor.exe 116 PID 4104 wrote to memory of 4852 4104 $77-SystemProcessor.exe 116 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4024 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c attrib -h -r -s "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\system32\attrib.exeattrib -h -r -s "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"3⤵
- Views/modifies file attributes
PID:4024
-
-
-
C:\ProgramData\Microsoft\$77-SystemProcessor.exe"C:\ProgramData\Microsoft\$77-SystemProcessor.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft'3⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft'4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe'3⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x64.dll'3⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x64.dll'4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x86.dll'3⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x86.dll'4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall delete allowedprogram "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"3⤵
- Modifies Windows Firewall
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD59b9da065249e8fe54710e673923b7cd5
SHA1855744b965629510b6929fa1d2e19cd6c796f030
SHA25656290c2104affa1cf206123446540929c031486b6c3b3519b2de9a96963c9710
SHA5124a38a4bc84911ece6042746aa631e5077373197b2cec269c3b89b7bbb4bf0b0fd992b080f69d7c1daab608b9653be9f48cbce0c9bb9ac6a89a3ca2ffc566d1f3
-
Filesize
147KB
MD51b8bd653321cf3cbc786e563555fbc75
SHA15638efe0476c8c1b74c6604db419be814d1d90a0
SHA256919a332e85d7c32a6f0a1bdd15b211b8b273b73fe05a553ea0f230a0958586c7
SHA512bafdbc8413828c5427983fa0e9403a2d9a88d0ad2f27f92842310852d273f2d2c9a0c6f9f64e1aac03fadf49f9a3bcf58c6b7c8b06debcce46536114cde0175b
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82