9e8604e30c32f7975efb0773e8ab04485840685312d0f3623824af0407c539a0

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe
Size

66KB
MD5

70789b0e45a82b9a0915d1900dc16d66
SHA1

a14fc70b59a35381f1baa32557e92bb67eba8971
SHA256

9e8604e30c32f7975efb0773e8ab04485840685312d0f3623824af0407c539a0
SHA512

8f395d1f6b903847accc6fa8b48b1d46f14a924b92acf880884c287c2145684adeb8468ff567a7751595c79a42605a17ae9e62052503edc26bdc55970fb75aec
SSDEEP

1536:5MPXEmAiRm2VfvmNFnToIf6HTRLar5ZINrWKym:m9Vfv6tTBfoTRLar5ZINrWKym

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MediaCenter\Parameters\ServiceDll = "C:\\Windows\\system32\\RemttwC.dll"	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2464	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2264	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe
1936	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RemttwC.dll	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2264	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2464	2264	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2464	2264	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2464	2264	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2464	2264	70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70789b0e45a82b9a0915d1900dc16d66_JaffaCakes118.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\70789B~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2464

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
PID:2460

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
- Loads dropped DLL
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\RemttwC.dll

Filesize
60KB

MD5
71d4e061549c64eb4cf18548d1050f96

SHA1
0f5244db96cc5f93c2e1ec20b139fae3378721fd

SHA256
d7b94347d41bc6898248f9b1b679cb75795e50757fddff09f134bc91c84bdaef

SHA512
27f0f44db2c5ad37f629c7c115561286ef40a9838375a0e47da2f953fca782e40b748b136eebbf4211ce4cb0ccfb05b2352e40ff88789137ce24bc50f9f7d431

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads