Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 06:33
Static task
static1
Behavioral task
behavioral1
Sample
1e524926125b5f806e29c875793b700d_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
1e524926125b5f806e29c875793b700d_JaffaCakes118.exe
-
Size
98KB
-
MD5
1e524926125b5f806e29c875793b700d
-
SHA1
46146b88f3f4612d7b4c8a41960e8deaf8c5ea29
-
SHA256
09de3060405b01829519ddbe1d725286c4eb07da3ae75928043051bd9c441ef8
-
SHA512
703ac82c9e9b32c7d0676b15d34bcf5febb26ba9290d303e65755df6ce182d0d56b9aaa2562b878e4c20f0ceca669ab7f2737668fc2ebf9eae8c892ba8790d20
-
SSDEEP
3072:8gDAWPChFSAahTGkk8jwaaHw7Koj4rDcgy0/4:VD+rSAprI
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\wagsijad\\fgxfsmjq.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fgxfsmjq.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fgxfsmjq.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
wlvauoiammrxnkdc.exepid process 2588 wlvauoiammrxnkdc.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 5 IoCs
Processes:
1e524926125b5f806e29c875793b700d_JaffaCakes118.exepid process 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\FgxFsmjq = "C:\\Users\\Admin\\AppData\\Local\\wagsijad\\fgxfsmjq.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe 2740 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 480 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1e524926125b5f806e29c875793b700d_JaffaCakes118.exesvchost.exesvchost.exewlvauoiammrxnkdc.exedescription pid process Token: SeSecurityPrivilege 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe Token: SeDebugPrivilege 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe Token: SeSecurityPrivilege 2596 svchost.exe Token: SeSecurityPrivilege 2740 svchost.exe Token: SeDebugPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeSecurityPrivilege 2588 wlvauoiammrxnkdc.exe Token: SeLoadDriverPrivilege 2588 wlvauoiammrxnkdc.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe Token: SeBackupPrivilege 2740 svchost.exe Token: SeRestorePrivilege 2740 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
1e524926125b5f806e29c875793b700d_JaffaCakes118.exedescription pid process target process PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2596 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2740 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe svchost.exe PID 2232 wrote to memory of 2588 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe wlvauoiammrxnkdc.exe PID 2232 wrote to memory of 2588 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe wlvauoiammrxnkdc.exe PID 2232 wrote to memory of 2588 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe wlvauoiammrxnkdc.exe PID 2232 wrote to memory of 2588 2232 1e524926125b5f806e29c875793b700d_JaffaCakes118.exe wlvauoiammrxnkdc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e524926125b5f806e29c875793b700d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e524926125b5f806e29c875793b700d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\wlvauoiammrxnkdc.exe"C:\Users\Admin\AppData\Local\Temp\wlvauoiammrxnkdc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\wagsijad\fgxfsmjq.exeFilesize
98KB
MD51e524926125b5f806e29c875793b700d
SHA146146b88f3f4612d7b4c8a41960e8deaf8c5ea29
SHA25609de3060405b01829519ddbe1d725286c4eb07da3ae75928043051bd9c441ef8
SHA512703ac82c9e9b32c7d0676b15d34bcf5febb26ba9290d303e65755df6ce182d0d56b9aaa2562b878e4c20f0ceca669ab7f2737668fc2ebf9eae8c892ba8790d20
-
memory/2232-73-0x0000000002C00000-0x0000000002C3B000-memory.dmpFilesize
236KB
-
memory/2232-58-0x0000000000400000-0x000000000043A00C-memory.dmpFilesize
232KB
-
memory/2232-0-0x0000000000400000-0x000000000043A00C-memory.dmpFilesize
232KB
-
memory/2232-59-0x0000000002C00000-0x0000000002C3B000-memory.dmpFilesize
236KB
-
memory/2232-5-0x0000000000400000-0x000000000043A00C-memory.dmpFilesize
232KB
-
memory/2232-4-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2232-3-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2232-75-0x0000000002C00000-0x0000000002C3B000-memory.dmpFilesize
236KB
-
memory/2232-14-0x0000000000400000-0x000000000043A00C-memory.dmpFilesize
232KB
-
memory/2232-13-0x0000000000400000-0x000000000043A00C-memory.dmpFilesize
232KB
-
memory/2232-1-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2232-76-0x0000000002C00000-0x0000000002C3B000-memory.dmpFilesize
236KB
-
memory/2232-54-0x0000000077120000-0x0000000077121000-memory.dmpFilesize
4KB
-
memory/2232-31-0x0000000077120000-0x0000000077121000-memory.dmpFilesize
4KB
-
memory/2232-64-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2232-32-0x000000007711F000-0x0000000077120000-memory.dmpFilesize
4KB
-
memory/2588-81-0x0000000000400000-0x000000000043A00C-memory.dmpFilesize
232KB
-
memory/2588-80-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2588-85-0x0000000000400000-0x000000000043A00C-memory.dmpFilesize
232KB
-
memory/2588-84-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/2596-16-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2596-17-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2596-9-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2596-7-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2596-15-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2596-29-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2596-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2596-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2596-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2740-27-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2740-46-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2740-36-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2740-52-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2740-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2740-86-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2740-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB