Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 09:43
Static task
static1
Behavioral task
behavioral1
Sample
19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe
-
Size
120KB
-
MD5
19aadd28e0448ed853eb0e15baa91a00
-
SHA1
5d7dd8892cf3229a64570187d6da381bee674cbc
-
SHA256
8027347670d5a7aae0dc4edc85d9faf22f6ec4bfc66c67381e71cfce4a6c0963
-
SHA512
05690fc49f85e6515927bd2c6a7309558f2a2e82c67b2df5444501ec81c6783db5b48763d78ad8054750343af7607d8493d7153dc03daf96c742d467530068e9
-
SSDEEP
3072:L4uvdzGfptdgPVKWVzc5jwaaHw7Koj4rRPUs4Y/xAp:Opvg8WVzc0Pn4Y/xAp
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\xwsdeoke\\gakpootu.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gakpootu.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gakpootu.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
xifntqvbpgogcqqk.exepid process 668 xifntqvbpgogcqqk.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exepid process 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\GakPootu = "C:\\Users\\Admin\\AppData\\Local\\xwsdeoke\\gakpootu.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 472 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exesvchost.exesvchost.exexifntqvbpgogcqqk.exedescription pid process Token: SeSecurityPrivilege 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe Token: SeDebugPrivilege 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe Token: SeSecurityPrivilege 2492 svchost.exe Token: SeSecurityPrivilege 2788 svchost.exe Token: SeDebugPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeSecurityPrivilege 668 xifntqvbpgogcqqk.exe Token: SeLoadDriverPrivilege 668 xifntqvbpgogcqqk.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe Token: SeBackupPrivilege 2788 svchost.exe Token: SeRestorePrivilege 2788 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exedescription pid process target process PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2492 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 2788 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe svchost.exe PID 2516 wrote to memory of 668 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe xifntqvbpgogcqqk.exe PID 2516 wrote to memory of 668 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe xifntqvbpgogcqqk.exe PID 2516 wrote to memory of 668 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe xifntqvbpgogcqqk.exe PID 2516 wrote to memory of 668 2516 19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe xifntqvbpgogcqqk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19aadd28e0448ed853eb0e15baa91a00_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\xifntqvbpgogcqqk.exe"C:\Users\Admin\AppData\Local\Temp\xifntqvbpgogcqqk.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\xwsdeoke\gakpootu.exeFilesize
120KB
MD519aadd28e0448ed853eb0e15baa91a00
SHA15d7dd8892cf3229a64570187d6da381bee674cbc
SHA2568027347670d5a7aae0dc4edc85d9faf22f6ec4bfc66c67381e71cfce4a6c0963
SHA51205690fc49f85e6515927bd2c6a7309558f2a2e82c67b2df5444501ec81c6783db5b48763d78ad8054750343af7607d8493d7153dc03daf96c742d467530068e9
-
memory/668-92-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/668-93-0x0000000000400000-0x000000000043A060-memory.dmpFilesize
232KB
-
memory/668-86-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/668-87-0x0000000000400000-0x000000000043A060-memory.dmpFilesize
232KB
-
memory/668-88-0x0000000000400000-0x000000000043A060-memory.dmpFilesize
232KB
-
memory/2492-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2492-25-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2492-9-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2492-15-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2492-14-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2492-17-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2492-7-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2492-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2492-20-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2516-1-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2516-83-0x0000000002BB0000-0x0000000002BEB000-memory.dmpFilesize
236KB
-
memory/2516-27-0x00000000778EF000-0x00000000778F0000-memory.dmpFilesize
4KB
-
memory/2516-2-0x0000000000400000-0x000000000043A060-memory.dmpFilesize
232KB
-
memory/2516-13-0x0000000000400000-0x000000000043A060-memory.dmpFilesize
232KB
-
memory/2516-0-0x0000000000400000-0x000000000043A060-memory.dmpFilesize
232KB
-
memory/2516-4-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2516-5-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/2516-6-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2516-54-0x00000000778F0000-0x00000000778F1000-memory.dmpFilesize
4KB
-
memory/2516-82-0x0000000002BB0000-0x0000000002BEB000-memory.dmpFilesize
236KB
-
memory/2516-26-0x00000000778F0000-0x00000000778F1000-memory.dmpFilesize
4KB
-
memory/2516-73-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2516-68-0x0000000002360000-0x000000000239B000-memory.dmpFilesize
236KB
-
memory/2516-75-0x0000000002360000-0x000000000239B000-memory.dmpFilesize
236KB
-
memory/2516-74-0x0000000000400000-0x000000000043A060-memory.dmpFilesize
232KB
-
memory/2788-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-55-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-29-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-103-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-64-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-51-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2788-63-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB