a8d607a3020ce3da9d49de9a1da87142ac0b13fe7552e654f5a94c3b5b8838b7

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe
Size

57KB
MD5

fc03b7ec7ca00fd890a7b37e8412b7d6
SHA1

e30b0aa70d41971f6bb73fbc4244541bab78435a
SHA256

a8d607a3020ce3da9d49de9a1da87142ac0b13fe7552e654f5a94c3b5b8838b7
SHA512

b38fa73b801f1f9a52da313d4852cbef4b2a28dcc7c3f8f0de230080f7f9f6a3f8bb536939cb6f23f65ec91178a24969c542f3e8b16d5fe4a0c1814826cef678
SSDEEP

1536:0jOyiu5/ab1ygcLV1wnQFi2fBtWYbT7b9fFScc:0CyidxyrwnG5d7b9dK

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\system\Parameters\ServiceDll = "%SystemRoot%\\System32\\oafsja.dll"	fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\system\Parameters\ServiceDll = "%SystemRoot%\\System32\\oafsja.dll"	fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\system\Parameters\ServiceDll = "%SystemRoot%\\System32\\oafsja.dll"	fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2632	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1664	fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe
2632	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0005e433.ini	fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oafsja.dll	fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2632	svchost.exe
2632	svchost.exe
2632	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc03b7ec7ca00fd890a7b37e8412b7d6_JaffaCakes118.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1664

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k system
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\oafsja.dll

Filesize
89KB

MD5
1daf506648498c4b8a3d02086f28d912

SHA1
c928583772f07859a320b1df670108fb88396c6e

SHA256
afadee9efd18e41fd785c91f60a3a7b9f298402249d71be23d0142e27362582d

SHA512
5cbf248847c9d7307f1c7b8357cf46956320c9247630dc5ee13e95ef659db1ff94ec5f50d73c581a278cfe620dd0a7520178885a53107282a7fa0f980b7d45a9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads