Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe
-
Size
109KB
-
MD5
1c05965a8dab71cc291c0a33e5540fb1
-
SHA1
7fd1eb08f73ab6d7567d4c94e5b4852a904e2d11
-
SHA256
0d79c451f87019dc24daa921b731eae6df9ab3b4d4dd5a1b21c8b2f023831a1a
-
SHA512
4b5a8fae42e64271602a178250f8958d063b08d10050091394ddc8268982b946307f15ef12fd2824dcdad89d6b6a7fca89f98f168bd79b8565ca0d37ce646a61
-
SSDEEP
3072:JDSKi/uBZqt1xZiYGBXp8zzpFk8jwaaHw7Koj4rLM:pSK+wS17aiHh
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\ncleeffh\\wtfruuuk.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtfruuuk.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtfruuuk.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
oydmwwtqfnrdidcg.exepid process 1664 oydmwwtqfnrdidcg.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exepid process 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WtfRuuuk = "C:\\Users\\Admin\\AppData\\Local\\ncleeffh\\wtfruuuk.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 476 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exesvchost.exesvchost.exeoydmwwtqfnrdidcg.exedescription pid process Token: SeSecurityPrivilege 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe Token: SeDebugPrivilege 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe Token: SeSecurityPrivilege 1952 svchost.exe Token: SeSecurityPrivilege 2600 svchost.exe Token: SeDebugPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeSecurityPrivilege 1664 oydmwwtqfnrdidcg.exe Token: SeLoadDriverPrivilege 1664 oydmwwtqfnrdidcg.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe Token: SeBackupPrivilege 2600 svchost.exe Token: SeRestorePrivilege 2600 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exedescription pid process target process PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1952 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 2600 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe svchost.exe PID 1780 wrote to memory of 1664 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe oydmwwtqfnrdidcg.exe PID 1780 wrote to memory of 1664 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe oydmwwtqfnrdidcg.exe PID 1780 wrote to memory of 1664 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe oydmwwtqfnrdidcg.exe PID 1780 wrote to memory of 1664 1780 1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe oydmwwtqfnrdidcg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c05965a8dab71cc291c0a33e5540fb1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\oydmwwtqfnrdidcg.exe"C:\Users\Admin\AppData\Local\Temp\oydmwwtqfnrdidcg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ncleeffh\wtfruuuk.exeFilesize
109KB
MD51c05965a8dab71cc291c0a33e5540fb1
SHA17fd1eb08f73ab6d7567d4c94e5b4852a904e2d11
SHA2560d79c451f87019dc24daa921b731eae6df9ab3b4d4dd5a1b21c8b2f023831a1a
SHA5124b5a8fae42e64271602a178250f8958d063b08d10050091394ddc8268982b946307f15ef12fd2824dcdad89d6b6a7fca89f98f168bd79b8565ca0d37ce646a61
-
memory/1664-92-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1664-93-0x0000000000400000-0x0000000000439C28-memory.dmpFilesize
231KB
-
memory/1664-87-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1664-88-0x0000000000400000-0x0000000000439C28-memory.dmpFilesize
231KB
-
memory/1780-55-0x0000000077D30000-0x0000000077D31000-memory.dmpFilesize
4KB
-
memory/1780-13-0x0000000000400000-0x0000000000439C28-memory.dmpFilesize
231KB
-
memory/1780-14-0x0000000000400000-0x0000000000439C28-memory.dmpFilesize
231KB
-
memory/1780-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1780-2-0x0000000000400000-0x0000000000439C28-memory.dmpFilesize
231KB
-
memory/1780-84-0x0000000000400000-0x0000000000439C28-memory.dmpFilesize
231KB
-
memory/1780-28-0x0000000077D2F000-0x0000000077D30000-memory.dmpFilesize
4KB
-
memory/1780-27-0x0000000077D30000-0x0000000077D31000-memory.dmpFilesize
4KB
-
memory/1780-85-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1780-5-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1780-4-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1780-29-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1780-81-0x0000000002760000-0x000000000279A000-memory.dmpFilesize
232KB
-
memory/1780-73-0x0000000002760000-0x000000000279A000-memory.dmpFilesize
232KB
-
memory/1780-74-0x0000000002760000-0x000000000279A000-memory.dmpFilesize
232KB
-
memory/1780-0-0x0000000000400000-0x0000000000439C28-memory.dmpFilesize
231KB
-
memory/1952-19-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1952-25-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1952-15-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1952-26-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1952-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1952-7-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1952-24-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1952-9-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1952-20-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2600-36-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-62-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-52-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-61-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-30-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-46-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-56-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-59-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2600-103-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB