Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
1bfa2bcd09f8fdf25eb6599f995b6854_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1bfa2bcd09f8fdf25eb6599f995b6854_JaffaCakes118.dll
-
Size
274KB
-
MD5
1bfa2bcd09f8fdf25eb6599f995b6854
-
SHA1
44e3b59790bccbb8650f5115bb07f4dd4b3bab60
-
SHA256
de04393109575f0710d6f61a4076d5c7c9cdf763c8d3ce6db7f0a6ef0beebda6
-
SHA512
1190793d21714602dbf5fd496add3407f2944e9596e616a99c3025cb1ff27bb2e8390ca7dd696705a163cfae29781407b3071d3ee7fa57840faaf8f014801faa
-
SSDEEP
6144:OenFgacc+pFf+q0Pj52cuaZf/EFpkXsDePGaqqqBmMfujPu:OenFlcc+pFYLuO/UDQGEQuC
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\lyfoevyb\\tfwbovfo.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tfwbovfo.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tfwbovfo.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
rundll32mgr.exelkuyqxhxvmshqiqp.exepid process 3000 rundll32mgr.exe 2168 lkuyqxhxvmshqiqp.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exerundll32mgr.exepid process 3004 rundll32.exe 3004 rundll32.exe 3000 rundll32mgr.exe 3000 rundll32mgr.exe 3000 rundll32mgr.exe 3000 rundll32mgr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\TfwBovfo = "C:\\Users\\Admin\\AppData\\Local\\lyfoevyb\\tfwbovfo.exe" svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1216 3004 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe 2952 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 472 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
rundll32mgr.exesvchost.exesvchost.exelkuyqxhxvmshqiqp.exedescription pid process Token: SeSecurityPrivilege 3000 rundll32mgr.exe Token: SeDebugPrivilege 3000 rundll32mgr.exe Token: SeSecurityPrivilege 2772 svchost.exe Token: SeSecurityPrivilege 2952 svchost.exe Token: SeDebugPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeSecurityPrivilege 2168 lkuyqxhxvmshqiqp.exe Token: SeLoadDriverPrivilege 2168 lkuyqxhxvmshqiqp.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe Token: SeBackupPrivilege 2952 svchost.exe Token: SeRestorePrivilege 2952 svchost.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exedescription pid process target process PID 1572 wrote to memory of 3004 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 3004 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 3004 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 3004 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 3004 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 3004 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 3004 1572 rundll32.exe rundll32.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe rundll32mgr.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe rundll32mgr.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe rundll32mgr.exe PID 3004 wrote to memory of 3000 3004 rundll32.exe rundll32mgr.exe PID 3004 wrote to memory of 1216 3004 rundll32.exe WerFault.exe PID 3004 wrote to memory of 1216 3004 rundll32.exe WerFault.exe PID 3004 wrote to memory of 1216 3004 rundll32.exe WerFault.exe PID 3004 wrote to memory of 1216 3004 rundll32.exe WerFault.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2772 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2952 3000 rundll32mgr.exe svchost.exe PID 3000 wrote to memory of 2168 3000 rundll32mgr.exe lkuyqxhxvmshqiqp.exe PID 3000 wrote to memory of 2168 3000 rundll32mgr.exe lkuyqxhxvmshqiqp.exe PID 3000 wrote to memory of 2168 3000 rundll32mgr.exe lkuyqxhxvmshqiqp.exe PID 3000 wrote to memory of 2168 3000 rundll32mgr.exe lkuyqxhxvmshqiqp.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bfa2bcd09f8fdf25eb6599f995b6854_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bfa2bcd09f8fdf25eb6599f995b6854_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\lkuyqxhxvmshqiqp.exe"C:\Users\Admin\AppData\Local\Temp\lkuyqxhxvmshqiqp.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 2243⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
111KB
MD510d2e087710c80d11a2e482cd3a13731
SHA15623e43b4ac7c528449e67bc11cedabe369df54c
SHA256607b206b4baecc7a0be6c0518b8733fb5c4364b7098a262a03befbbfd0d30335
SHA51268b991baad83dc781e8a5ba69d0edfad7e90122618b5c1f178a01a0481a8f43e200cbd7f5702449ec758361ac8f1a1596e7400bd9561a86cbeff31a876a2f65a
-
memory/2168-89-0x0000000000400000-0x0000000000437E08-memory.dmpFilesize
223KB
-
memory/2168-95-0x0000000000400000-0x0000000000437E08-memory.dmpFilesize
223KB
-
memory/2772-29-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2772-33-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2772-31-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2772-34-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2772-32-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2772-30-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2772-25-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2772-21-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2772-19-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2952-100-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-44-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-101-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-102-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-103-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-104-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-98-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-37-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-97-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-99-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-54-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-53-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-60-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-63-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-61-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-96-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2952-105-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/3000-43-0x0000000077B1F000-0x0000000077B20000-memory.dmpFilesize
4KB
-
memory/3000-87-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3000-88-0x0000000000400000-0x0000000000437E08-memory.dmpFilesize
223KB
-
memory/3000-79-0x0000000002940000-0x0000000002978000-memory.dmpFilesize
224KB
-
memory/3000-36-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/3000-17-0x0000000000400000-0x0000000000437E08-memory.dmpFilesize
223KB
-
memory/3000-16-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/3000-14-0x0000000000400000-0x0000000000437E08-memory.dmpFilesize
223KB
-
memory/3000-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3000-12-0x0000000000400000-0x0000000000437E08-memory.dmpFilesize
223KB
-
memory/3004-2-0x0000000034F20000-0x0000000034F69000-memory.dmpFilesize
292KB
-
memory/3004-10-0x00000000006C0000-0x00000000006F8000-memory.dmpFilesize
224KB
-
memory/3004-3-0x00000000006C0000-0x00000000006F8000-memory.dmpFilesize
224KB