Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe
-
Size
98KB
-
MD5
1e28c46f8669b44ca935f37e96ed6b7b
-
SHA1
3c6c67eb6eb9cb43fb662c07f54ce28ff6e2742a
-
SHA256
7204534a0a9814ac77455281c46413898cef64d463d2299e03084ab7f4d0d292
-
SHA512
9e4d4f2e6ed0f972ec2a1fb55892dafc0c3212eb8e87de434e32a0c336ad1f80fe21ee30a3bd950256b85a5fe2521d15a94234bffb57b038acd8ace281d92a51
-
SSDEEP
3072:QVWf9dbtKjpO14qkdzlgZSpGbTzjwaaHw7Koj4ri:iwj5KjZqSyT3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\xpwsvhdv\\gvofgkjm.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gvofgkjm.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gvofgkjm.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
xbioglfjuxyikqfj.exepid process 2560 xbioglfjuxyikqfj.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exepid process 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\GvoFgkjm = "C:\\Users\\Admin\\AppData\\Local\\xpwsvhdv\\gvofgkjm.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 484 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exesvchost.exesvchost.exexbioglfjuxyikqfj.exedescription pid process Token: SeSecurityPrivilege 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe Token: SeDebugPrivilege 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe Token: SeSecurityPrivilege 1144 svchost.exe Token: SeSecurityPrivilege 2656 svchost.exe Token: SeDebugPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeSecurityPrivilege 2560 xbioglfjuxyikqfj.exe Token: SeLoadDriverPrivilege 2560 xbioglfjuxyikqfj.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exedescription pid process target process PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 1144 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2656 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe svchost.exe PID 1708 wrote to memory of 2560 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe xbioglfjuxyikqfj.exe PID 1708 wrote to memory of 2560 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe xbioglfjuxyikqfj.exe PID 1708 wrote to memory of 2560 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe xbioglfjuxyikqfj.exe PID 1708 wrote to memory of 2560 1708 1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe xbioglfjuxyikqfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e28c46f8669b44ca935f37e96ed6b7b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\xbioglfjuxyikqfj.exe"C:\Users\Admin\AppData\Local\Temp\xbioglfjuxyikqfj.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\xpwsvhdv\gvofgkjm.exeFilesize
98KB
MD51e28c46f8669b44ca935f37e96ed6b7b
SHA13c6c67eb6eb9cb43fb662c07f54ce28ff6e2742a
SHA2567204534a0a9814ac77455281c46413898cef64d463d2299e03084ab7f4d0d292
SHA5129e4d4f2e6ed0f972ec2a1fb55892dafc0c3212eb8e87de434e32a0c336ad1f80fe21ee30a3bd950256b85a5fe2521d15a94234bffb57b038acd8ace281d92a51
-
memory/1144-23-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1144-19-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1144-22-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1144-14-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1144-21-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1144-7-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1144-9-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1144-18-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1144-20-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1708-26-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1708-34-0x0000000076FAF000-0x0000000076FB0000-memory.dmpFilesize
4KB
-
memory/1708-69-0x0000000002B70000-0x0000000002BA9000-memory.dmpFilesize
228KB
-
memory/1708-5-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1708-4-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1708-13-0x0000000000400000-0x0000000000438B40-memory.dmpFilesize
226KB
-
memory/1708-0-0x0000000000400000-0x0000000000438B40-memory.dmpFilesize
226KB
-
memory/1708-2-0x0000000000400000-0x0000000000438B40-memory.dmpFilesize
226KB
-
memory/1708-33-0x0000000076FB0000-0x0000000076FB1000-memory.dmpFilesize
4KB
-
memory/1708-84-0x0000000002B80000-0x0000000002BB9000-memory.dmpFilesize
228KB
-
memory/1708-85-0x0000000002B80000-0x0000000002BB9000-memory.dmpFilesize
228KB
-
memory/1708-1-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1708-74-0x0000000000400000-0x0000000000438B40-memory.dmpFilesize
226KB
-
memory/1708-75-0x0000000002B70000-0x0000000002BA9000-memory.dmpFilesize
228KB
-
memory/1708-67-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1708-54-0x0000000076FB0000-0x0000000076FB1000-memory.dmpFilesize
4KB
-
memory/2560-89-0x0000000000400000-0x0000000000438B40-memory.dmpFilesize
226KB
-
memory/2560-86-0x0000000000400000-0x0000000000438B40-memory.dmpFilesize
226KB
-
memory/2560-92-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2560-93-0x0000000000400000-0x0000000000438B40-memory.dmpFilesize
226KB
-
memory/2560-88-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2656-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-49-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-27-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-52-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-55-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-58-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-61-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-101-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-102-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2656-103-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB