Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 09:01
Static task
static1
Behavioral task
behavioral1
Sample
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe
-
Size
91KB
-
MD5
198c3d7beef8f5107eb884dd35a6bf07
-
SHA1
fedc3200cac20e80ec712b9a72346540cff454ef
-
SHA256
cef6fb469154c9805fa9ca778a7919840695f9bc074e1d2e484d0c8dcb70cfe3
-
SHA512
3a8a1123d8b7b0ddad271191985858be23591976887a54a7215e3ad78fcdd9e9d8ba0041d31e873c1231b42a58d83f867040cb96171e12b21f09ccd1435fde2a
-
SSDEEP
1536:duteSLtAYHRNGu2+NICv3DU3ei1tE7jwaaHw7Koj4rL/OpNGiY:IY8tHHRNGV+eCfkLgjwaaHw7Koj4rK
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\vlebbwdg\\ervnlamt.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ervnlamt.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ervnlamt.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
vwqlqcldkjlplsww.exepid process 3036 vwqlqcldkjlplsww.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exepid process 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ErvNlamt = "C:\\Users\\Admin\\AppData\\Local\\vlebbwdg\\ervnlamt.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe 2284 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 480 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exesvchost.exesvchost.exevwqlqcldkjlplsww.exedescription pid process Token: SeSecurityPrivilege 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe Token: SeDebugPrivilege 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe Token: SeSecurityPrivilege 2984 svchost.exe Token: SeSecurityPrivilege 2284 svchost.exe Token: SeDebugPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeSecurityPrivilege 3036 vwqlqcldkjlplsww.exe Token: SeLoadDriverPrivilege 3036 vwqlqcldkjlplsww.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe Token: SeBackupPrivilege 2284 svchost.exe Token: SeRestorePrivilege 2284 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exedescription pid process target process PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2984 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 2284 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 2392 wrote to memory of 3036 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe vwqlqcldkjlplsww.exe PID 2392 wrote to memory of 3036 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe vwqlqcldkjlplsww.exe PID 2392 wrote to memory of 3036 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe vwqlqcldkjlplsww.exe PID 2392 wrote to memory of 3036 2392 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe vwqlqcldkjlplsww.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\vwqlqcldkjlplsww.exe"C:\Users\Admin\AppData\Local\Temp\vwqlqcldkjlplsww.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\vlebbwdg\ervnlamt.exeFilesize
91KB
MD5198c3d7beef8f5107eb884dd35a6bf07
SHA1fedc3200cac20e80ec712b9a72346540cff454ef
SHA256cef6fb469154c9805fa9ca778a7919840695f9bc074e1d2e484d0c8dcb70cfe3
SHA5123a8a1123d8b7b0ddad271191985858be23591976887a54a7215e3ad78fcdd9e9d8ba0041d31e873c1231b42a58d83f867040cb96171e12b21f09ccd1435fde2a
-
memory/2284-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-91-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-90-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-64-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-63-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-55-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-26-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-49-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-51-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-52-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2284-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2392-83-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/2392-5-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2392-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2392-29-0x0000000077810000-0x0000000077811000-memory.dmpFilesize
4KB
-
memory/2392-54-0x0000000077810000-0x0000000077811000-memory.dmpFilesize
4KB
-
memory/2392-30-0x000000007780F000-0x0000000077810000-memory.dmpFilesize
4KB
-
memory/2392-25-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2392-2-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/2392-13-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/2392-4-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2392-73-0x0000000002BA0000-0x0000000002BDA000-memory.dmpFilesize
232KB
-
memory/2392-72-0x0000000002BA0000-0x0000000002BDA000-memory.dmpFilesize
232KB
-
memory/2392-80-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2392-0-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/2984-20-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2984-14-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2984-15-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2984-16-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2984-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2984-9-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2984-7-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2984-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2984-28-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/3036-84-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/3036-88-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/3036-89-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3036-85-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB