Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 06:21
Static task
static1
Behavioral task
behavioral1
Sample
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe
-
Size
97KB
-
MD5
19183a37407083e404ae86fce8a7f6e9
-
SHA1
18d3fa080e2e91b859d7fca57ccf99754f89501f
-
SHA256
2fe47063e431776d6ab6dbda3b27959dd5632fe8d2680f414a66ff207d687fd1
-
SHA512
c122cd0c8ea71922dcbe6c748fec85dcd4ec7e3b8a7023c8d9ec2113c02c27a505cfe3a945f9eabf99c012a038f5d8f9515594d67eb98e1520110d4ad73d1a84
-
SSDEEP
3072:jgeWPCmabC3YUSlr6WzA9dLy/R5jwaaHw7Koj4rH:c4PtUSlrdydm/4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\emnjwfdx\\mscvhfmo.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscvhfmo.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mscvhfmo.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
exaqjhouyckpddni.exepid process 780 exaqjhouyckpddni.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exepid process 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MscVhfmo = "C:\\Users\\Admin\\AppData\\Local\\emnjwfdx\\mscvhfmo.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe 2900 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 476 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exesvchost.exesvchost.exeexaqjhouyckpddni.exedescription pid process Token: SeSecurityPrivilege 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe Token: SeDebugPrivilege 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe Token: SeSecurityPrivilege 3068 svchost.exe Token: SeSecurityPrivilege 2900 svchost.exe Token: SeDebugPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeSecurityPrivilege 780 exaqjhouyckpddni.exe Token: SeLoadDriverPrivilege 780 exaqjhouyckpddni.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe Token: SeBackupPrivilege 2900 svchost.exe Token: SeRestorePrivilege 2900 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exedescription pid process target process PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 3068 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2900 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 780 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe exaqjhouyckpddni.exe PID 1712 wrote to memory of 780 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe exaqjhouyckpddni.exe PID 1712 wrote to memory of 780 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe exaqjhouyckpddni.exe PID 1712 wrote to memory of 780 1712 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe exaqjhouyckpddni.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\exaqjhouyckpddni.exe"C:\Users\Admin\AppData\Local\Temp\exaqjhouyckpddni.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\emnjwfdx\mscvhfmo.exeFilesize
97KB
MD519183a37407083e404ae86fce8a7f6e9
SHA118d3fa080e2e91b859d7fca57ccf99754f89501f
SHA2562fe47063e431776d6ab6dbda3b27959dd5632fe8d2680f414a66ff207d687fd1
SHA512c122cd0c8ea71922dcbe6c748fec85dcd4ec7e3b8a7023c8d9ec2113c02c27a505cfe3a945f9eabf99c012a038f5d8f9515594d67eb98e1520110d4ad73d1a84
-
memory/780-90-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/780-89-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/780-87-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/780-86-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/780-84-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/1712-53-0x0000000077140000-0x0000000077141000-memory.dmpFilesize
4KB
-
memory/1712-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1712-0-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/1712-4-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1712-3-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1712-13-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/1712-80-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/1712-12-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/1712-82-0x0000000002900000-0x000000000293A000-memory.dmpFilesize
232KB
-
memory/1712-79-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1712-72-0x0000000002900000-0x000000000293A000-memory.dmpFilesize
232KB
-
memory/1712-34-0x000000007713F000-0x0000000077140000-memory.dmpFilesize
4KB
-
memory/1712-33-0x0000000077140000-0x0000000077141000-memory.dmpFilesize
4KB
-
memory/2900-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-51-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-60-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-58-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-56-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-55-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-27-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2900-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/3068-14-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3068-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3068-8-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/3068-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3068-20-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/3068-19-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/3068-18-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/3068-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3068-6-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB