d79b7442ad28fad82279e9ce00607494d7a7da705ece9b9b3252ef243ede06d5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
Size

10KB
MD5

0eec6756d001df54f45f77adf067a410
SHA1

ab0e36e72f6c01018eba7c6a7be534bc16d561bc
SHA256

d79b7442ad28fad82279e9ce00607494d7a7da705ece9b9b3252ef243ede06d5
SHA512

9ab1e65cb5dbf8049500e62ae5740da158c5357200c88abb467b5cce316f2636cde5415142c3eeeefbe7ca5bb03ff9e59a2253c0434facade950b6d164cf30a7
SSDEEP

192:Rmz4KZ845Yu8Q9iwZtpiuNyIG3OwMG9YJnT11OSEhWmC/Tt2R/Mzaap:Rmj84AQgUtQuFG3OBPTjWImWJ2jY

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\tscfgwmijxsj.dll = "{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}"	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2720	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tscfgwmijxsj.tmp	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\tscfgwmijxsj.tmp	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}\InProcServer32\ = "C:\\Windows\\SysWow64\\tscfgwmijxsj.dll"	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}\InProcServer32\ThreadingModel = "Apartment"	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}\InProcServer32	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2720	1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2720	1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2720	1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe	28
PID 1996 wrote to memory of 2720	1996	0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0eec6756d001df54f45f77adf067a410_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\900F.tmp.bat
  2⤵
  - Deletes itself
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\900F.tmp.bat

Filesize
207B

MD5
3a5dc49bac612753c7d63c81e9abd036

SHA1
4982fedf383add59d2663ca9e99e92c1fef0e411

SHA256
6cb30c087279e772a1447566877d928ba76d4cbd0f11a3dbbfcd84da978c964a

SHA512
5225d2fdd5769853e4d7c934ba28116048971b3eb6ef77656a068925acd44a40e1208281a1947cf54275fcb9c10a33d652942fd2a3bdccf0ae75add3c4b3ae11

Download Submit
\Windows\SysWOW64\tscfgwmijxsj.dll

Filesize
690KB

MD5
a8d3a368c51170e2ba60a9142046629f

SHA1
1a65a8d081524553203813678bd020988400d406

SHA256
0987c223dd4b8aa31ccff076fa3663734fbbb2415d7d2e0dda741bd8b64df60b

SHA512
e408aa2605d6b2c68acfbf9aa768fe2e0725eb4fbbe58c7043f4b992ce9a1294b38599ccb1f7509897b4ce6dd7ae512f82b544353a9fa36505ea48ded0b9a4ac

Download Submit
memory/1996-5-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download
memory/1996-14-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download