Analysis
-
max time kernel
140s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 08:10
Static task
static1
Behavioral task
behavioral1
Sample
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe
-
Size
107KB
-
MD5
1a8c526fef68c1289cd41addf512d9d8
-
SHA1
69f8ce5e596deefa1046042b7e75ffbb510bb4bd
-
SHA256
f2416b31c7a3b9671b5a90fea79c0c0830f5c7bf8735f0ff7af250214bf18192
-
SHA512
d88c19848b58ce9ade01ab89d6fbee4cfa23698dc00832d34dba7950009710c936aae9d935f75042f4b74ae3bff649b84a3272ccdc4c6d8f1a733104f8c1a63b
-
SSDEEP
1536:Pm8RjUcxYb9qlkommTck3TXC0crM1D+gV8g8p/yNfxoUwoGR9Hql:e8+PA3mmTcuS0crM1TNNfrwn
Malware Config
Extracted
gozi
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exepid process 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Processes:
resource yara_rule C:\Windows\SysWOW64\blphcv4mj0e158.scr upx behavioral2/memory/5000-16-0x0000000002E10000-0x0000000002EC4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lphcv4mj0e158 = "C:\\Windows\\system32\\lphcv4mj0e158.exe" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\phcv4mj0e158.bmp 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe File created C:\Windows\SysWOW64\blphcv4mj0e158.scr 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\system32\\phcv4mj0e158.bmp" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000eb40c78f8f3426de0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000eb40c78f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900eb40c78f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1deb40c78f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000eb40c78f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Modifies Control Panel 8 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Colors\Background = "0 0 255" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "0" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\TileWallpaper = "0" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\OriginalWallpaper = "C:\\Windows\\system32\\phcv4mj0e158.bmp" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\system32\\phcv4mj0e158.bmp" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\blphcv4mj0e158.scr" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveActive = "1" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Modifies registry class 1 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exepid process 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exepid process 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
vssvc.exesrtasks.exedescription pid process Token: SeBackupPrivilege 3236 vssvc.exe Token: SeRestorePrivilege 3236 vssvc.exe Token: SeAuditPrivilege 3236 vssvc.exe Token: SeBackupPrivilege 2196 srtasks.exe Token: SeRestorePrivilege 2196 srtasks.exe Token: SeSecurityPrivilege 2196 srtasks.exe Token: SeTakeOwnershipPrivilege 2196 srtasks.exe Token: SeBackupPrivilege 2196 srtasks.exe Token: SeRestorePrivilege 2196 srtasks.exe Token: SeSecurityPrivilege 2196 srtasks.exe Token: SeTakeOwnershipPrivilege 2196 srtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exedescription pid process target process PID 5000 wrote to memory of 4604 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe WScript.exe PID 5000 wrote to memory of 4604 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe WScript.exe PID 5000 wrote to memory of 4604 5000 1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe WScript.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a8c526fef68c1289cd41addf512d9d8_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\.tt4093.tmp.vbs"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.tt4093.tmp.vbsFilesize
1002B
MD59df700c8f6fd43fac0a89aef04214bbd
SHA16ec8bc6d4041ccf19757757c0da6592469f71c57
SHA2569ab6f2c3cc3965cd05f81d859bdfac3b25a5e70178f61ea677d31987c4e142fd
SHA5128bbcd322f3998c0f7d81884737ca313c1353ac7e3899f168fc8d44eafbe064193353b8b16f92113288ff2102c47623b542861440c414b8acf36d75c4ad645d4d
-
C:\Windows\SysWOW64\blphcv4mj0e158.scrFilesize
59KB
MD5538f9ead95eba12134d95b4fe7082331
SHA1527c50b92b5cededdd5b7e3edda71cb13d108dac
SHA256a416bab39037854c14540edaaf80cff7b5f2e9db31eee235527574e8dedd54e6
SHA5124631ff7cf868348585ee0e26591b95be3ee8b232c7980f5013f4464f285b0fbdef41794c44cb8653d6fb6dc815c0c0a9f4af780bfeb9b23d2f4c3bdc62bf4581
-
memory/5000-0-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/5000-1-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/5000-2-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/5000-5-0x0000000000404000-0x0000000000406000-memory.dmpFilesize
8KB
-
memory/5000-4-0x00000000006A0000-0x00000000006D0000-memory.dmpFilesize
192KB
-
memory/5000-16-0x0000000002E10000-0x0000000002EC4000-memory.dmpFilesize
720KB
-
memory/5000-17-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB