Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 07:11
Static task
static1
Behavioral task
behavioral1
Sample
193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe
-
Size
125KB
-
MD5
193d07934ad2b28dce3a5e3b2429562e
-
SHA1
bff5ef61716b2cb864a6d646302d4881f148f38c
-
SHA256
fb1dcbd441909a9e243af4ce527a2c9c569d259a59844ee767a5772c1339fcdf
-
SHA512
38a9349104dae884af9138e0f52b7e0e96012977927971d97add41dbc25e02fb232dba5fdc418a67d1029a581084a81676e3de6401aa92a78f9e5caa4850c750
-
SSDEEP
3072:9gIpT1t2YXm8XdstQculie6qbcU5jwaaHw7Koj4rt2E:aIx1dX3XCt2bB
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\qauqipjb\\ygmgsspr.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ygmgsspr.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ygmgsspr.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
qlhbxurxryusgytd.exepid process 2784 qlhbxurxryusgytd.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exepid process 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\YgmGsspr = "C:\\Users\\Admin\\AppData\\Local\\qauqipjb\\ygmgsspr.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe 2476 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 476 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exesvchost.exesvchost.exeqlhbxurxryusgytd.exedescription pid process Token: SeSecurityPrivilege 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe Token: SeDebugPrivilege 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe Token: SeSecurityPrivilege 1956 svchost.exe Token: SeSecurityPrivilege 2476 svchost.exe Token: SeDebugPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeSecurityPrivilege 2784 qlhbxurxryusgytd.exe Token: SeLoadDriverPrivilege 2784 qlhbxurxryusgytd.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe Token: SeBackupPrivilege 2476 svchost.exe Token: SeRestorePrivilege 2476 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exedescription pid process target process PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 1956 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2476 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe svchost.exe PID 2652 wrote to memory of 2784 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe qlhbxurxryusgytd.exe PID 2652 wrote to memory of 2784 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe qlhbxurxryusgytd.exe PID 2652 wrote to memory of 2784 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe qlhbxurxryusgytd.exe PID 2652 wrote to memory of 2784 2652 193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe qlhbxurxryusgytd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\193d07934ad2b28dce3a5e3b2429562e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\qlhbxurxryusgytd.exe"C:\Users\Admin\AppData\Local\Temp\qlhbxurxryusgytd.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\qauqipjb\ygmgsspr.exeFilesize
125KB
MD5193d07934ad2b28dce3a5e3b2429562e
SHA1bff5ef61716b2cb864a6d646302d4881f148f38c
SHA256fb1dcbd441909a9e243af4ce527a2c9c569d259a59844ee767a5772c1339fcdf
SHA51238a9349104dae884af9138e0f52b7e0e96012977927971d97add41dbc25e02fb232dba5fdc418a67d1029a581084a81676e3de6401aa92a78f9e5caa4850c750
-
memory/1956-18-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1956-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1956-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1956-8-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1956-6-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1956-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1956-19-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1956-14-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1956-20-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2476-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-27-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-51-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-55-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2476-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2652-12-0x0000000000400000-0x000000000043A200-memory.dmpFilesize
232KB
-
memory/2652-33-0x0000000077A90000-0x0000000077A91000-memory.dmpFilesize
4KB
-
memory/2652-80-0x0000000000400000-0x000000000043A200-memory.dmpFilesize
232KB
-
memory/2652-83-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2652-72-0x00000000028F0000-0x000000000292B000-memory.dmpFilesize
236KB
-
memory/2652-1-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2652-81-0x0000000002900000-0x000000000293B000-memory.dmpFilesize
236KB
-
memory/2652-13-0x0000000000400000-0x000000000043A200-memory.dmpFilesize
232KB
-
memory/2652-73-0x00000000028F0000-0x000000000292B000-memory.dmpFilesize
236KB
-
memory/2652-0-0x0000000000400000-0x000000000043A200-memory.dmpFilesize
232KB
-
memory/2652-34-0x0000000077A8F000-0x0000000077A90000-memory.dmpFilesize
4KB
-
memory/2652-3-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2652-4-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2652-53-0x0000000077A90000-0x0000000077A91000-memory.dmpFilesize
4KB
-
memory/2784-85-0x0000000000400000-0x000000000043A200-memory.dmpFilesize
232KB
-
memory/2784-92-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2784-91-0x0000000000400000-0x000000000043A200-memory.dmpFilesize
232KB
-
memory/2784-86-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2784-87-0x0000000000400000-0x000000000043A200-memory.dmpFilesize
232KB