Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 11:31
Static task
static1
Behavioral task
behavioral1
Sample
1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll
-
Size
156KB
-
MD5
1b20af19468f2385be2da8436febb0ac
-
SHA1
496ea51803ff20573208403f8cedaa28831d1fc1
-
SHA256
5724dff81bdade2b6fe5e858b73421f8f1b1d9aca48dfffce8f5cc18cfcfb8b5
-
SHA512
2c612cb9ebfdc59c76c228f29d2af703a4edb0e5e5337cec23ce19b21af117d449f18f172da02b0a3b68a905086f7c7b7bfeee1f811484b19af575f1d17736e1
-
SSDEEP
3072:lGttwyTViRa7B7xtAYC5jwZgFRnnMbabYwN4jYvhY6:lGXwyRN71xmnhwybnMs
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\soqivwyn\\buiugaie.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\buiugaie.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\buiugaie.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
qRP9q23sagpichktptlrdkm.exepid process 2004 qRP9q23 1204 sagpichktptlrdkm.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exeqRP9q23pid process 2804 rundll32.exe 2804 rundll32.exe 2004 qRP9q23 2004 qRP9q23 2004 qRP9q23 2004 qRP9q23 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\BuiUgaie = "C:\\Users\\Admin\\AppData\\Local\\soqivwyn\\buiugaie.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3000 2804 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 480 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
qRP9q23svchost.exesvchost.exesagpichktptlrdkm.exedescription pid process Token: SeSecurityPrivilege 2004 qRP9q23 Token: SeDebugPrivilege 2004 qRP9q23 Token: SeSecurityPrivilege 2652 svchost.exe Token: SeSecurityPrivilege 2728 svchost.exe Token: SeDebugPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeSecurityPrivilege 1204 sagpichktptlrdkm.exe Token: SeLoadDriverPrivilege 1204 sagpichktptlrdkm.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe Token: SeBackupPrivilege 2728 svchost.exe Token: SeRestorePrivilege 2728 svchost.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
rundll32.exerundll32.exeqRP9q23description pid process target process PID 2232 wrote to memory of 2804 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 2804 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 2804 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 2804 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 2804 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 2804 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 2804 2232 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2004 2804 rundll32.exe qRP9q23 PID 2804 wrote to memory of 2004 2804 rundll32.exe qRP9q23 PID 2804 wrote to memory of 2004 2804 rundll32.exe qRP9q23 PID 2804 wrote to memory of 2004 2804 rundll32.exe qRP9q23 PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2804 wrote to memory of 3000 2804 rundll32.exe WerFault.exe PID 2804 wrote to memory of 3000 2804 rundll32.exe WerFault.exe PID 2804 wrote to memory of 3000 2804 rundll32.exe WerFault.exe PID 2804 wrote to memory of 3000 2804 rundll32.exe WerFault.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2652 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 2728 2004 qRP9q23 svchost.exe PID 2004 wrote to memory of 1204 2004 qRP9q23 sagpichktptlrdkm.exe PID 2004 wrote to memory of 1204 2004 qRP9q23 sagpichktptlrdkm.exe PID 2004 wrote to memory of 1204 2004 qRP9q23 sagpichktptlrdkm.exe PID 2004 wrote to memory of 1204 2004 qRP9q23 sagpichktptlrdkm.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qRP9q23"qRP9q23"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\sagpichktptlrdkm.exe"C:\Users\Admin\AppData\Local\Temp\sagpichktptlrdkm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 2283⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qRP9q23Filesize
95KB
MD57fc51f7f09344a3dbeb28e14c35ce39d
SHA1c8a9082351f5edcd3012d5379caa33e0804e954f
SHA25691eceecf4fdcaff36652a1a3a5d25ee37fff70796e71438c60446a2ea72c0a78
SHA512b40a5743a212038161065af0dbfd0aa7b386b9bd8ae080e621459465e6f6dd888cb9ee35b4f152e5f6931446ad3f1696f6b98b9494903d02ab86493939cae508
-
memory/1204-99-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/2004-15-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/2004-12-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/2004-86-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/2004-93-0x0000000002E00000-0x0000000002E3B000-memory.dmpFilesize
236KB
-
memory/2004-47-0x00000000775CF000-0x00000000775D0000-memory.dmpFilesize
4KB
-
memory/2004-14-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2004-17-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2004-18-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2004-78-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2004-67-0x00000000775D0000-0x00000000775D1000-memory.dmpFilesize
4KB
-
memory/2004-26-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/2004-46-0x00000000775D0000-0x00000000775D1000-memory.dmpFilesize
4KB
-
memory/2652-20-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2652-29-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2652-33-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2652-27-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2652-28-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2652-22-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2652-36-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2652-35-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2652-34-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2728-68-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-64-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-58-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-57-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-109-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-48-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-40-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-108-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-107-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-106-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-62-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-103-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-104-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2728-105-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2804-2-0x0000000074C00000-0x0000000074C2A000-memory.dmpFilesize
168KB
-
memory/2804-1-0x0000000074BE0000-0x0000000074C0A000-memory.dmpFilesize
168KB
-
memory/2804-11-0x00000000001F0000-0x000000000022B000-memory.dmpFilesize
236KB
-
memory/2804-3-0x0000000074BD0000-0x0000000074BFA000-memory.dmpFilesize
168KB