8ac76b543829cbcce5bb7cc247971c410d3f92b6fb2383c0c68502b84e668c7a

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26c50667c923309f38f25785459da04b_JaffaCakes118.exe
Size

460KB
MD5

26c50667c923309f38f25785459da04b
SHA1

4bb8b1ba0d126bac273f9379ade4278858d74c79
SHA256

8ac76b543829cbcce5bb7cc247971c410d3f92b6fb2383c0c68502b84e668c7a
SHA512

c566013f444fbe89b731862ada04ea38bc41f09aeda771df6c2e4d0e729035d0c2d407c57f1065e6ac0435c7ef13f18b6575c0689451a1a3c00c481f9835da93
SSDEEP

12288:yUbeSeGI0Q0dKkUpyGGfhsVNz8fZs4Ea:yU6JG+kUju8YBsz

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

wcntfysvc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" wcntfysvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	wcntfysvc.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wcntfysvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wcntfysvc.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

26c50667c923309f38f25785459da04b_JaffaCakes118.exewcntfysvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	26c50667c923309f38f25785459da04b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	wcntfysvc.exe

Deletes itself 1 IoCs

Processes:

wcntfysvc.exe

pid process

2652 wcntfysvc.exe
Executes dropped EXE 1 IoCs

Processes:

wcntfysvc.exe

pid process

2652 wcntfysvc.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

26c50667c923309f38f25785459da04b_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine 26c50667c923309f38f25785459da04b_JaffaCakes118.exe

pid	process
2652	wcntfysvc.exe

pid	process
2652	wcntfysvc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine	26c50667c923309f38f25785459da04b_JaffaCakes118.exe

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wcntfysvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wcntfysvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wcntfysvc.exe

Drops file in System32 directory 1 IoCs

Processes:

wcntfysvc.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat wcntfysvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wcntfysvc.exe

Drops file in Windows directory 2 IoCs

Processes:

26c50667c923309f38f25785459da04b_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\system\wcntfysvc.exe	26c50667c923309f38f25785459da04b_JaffaCakes118.exe
File created	C:\Windows\system\wcntfysvc.exe	26c50667c923309f38f25785459da04b_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

wcntfysvc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wcntfysvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wcntfysvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wcntfysvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wcntfysvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wcntfysvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wcntfysvc.exe

C:\Users\Admin\AppData\Local\Temp\26c50667c923309f38f25785459da04b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26c50667c923309f38f25785459da04b_JaffaCakes118.exe"
1⤵
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Drops file in Windows directory
PID:2888

C:\Windows\system\wcntfysvc.exe
"C:\Windows\system\wcntfysvc.exe"
1⤵
- Modifies security service
- Windows security bypass
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2652

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\wcntfysvc.exe
Filesize
460KB

MD5
26c50667c923309f38f25785459da04b

SHA1
4bb8b1ba0d126bac273f9379ade4278858d74c79

SHA256
8ac76b543829cbcce5bb7cc247971c410d3f92b6fb2383c0c68502b84e668c7a

SHA512
c566013f444fbe89b731862ada04ea38bc41f09aeda771df6c2e4d0e729035d0c2d407c57f1065e6ac0435c7ef13f18b6575c0689451a1a3c00c481f9835da93

Download Submit
memory/2652-17-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-31-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-16-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-30-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-29-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-28-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-9-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-11-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-12-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-13-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-14-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-15-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-27-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-18-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-26-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-19-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-20-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-21-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-23-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-24-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2652-25-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2888-2-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2888-3-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2888-1-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/2888-7-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2888-6-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2888-0-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download