0bb3a01fad359230762d7dcb5c2e7b38acff448c50885366148e3bdd5a23b11d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
Size

27KB
MD5

17c6fb96f1285dd2d7f2b7e0f46e989d
SHA1

c082195c06a379ce02f35ba3c8c16fc4779e8eea
SHA256

0bb3a01fad359230762d7dcb5c2e7b38acff448c50885366148e3bdd5a23b11d
SHA512

752e29de32cc69e38f1fb3d3c0d4d84469aa77e329a48fb39ca7c939a3922b3c929c457f3c2bb65e80bdc1fc2b2189f61b3585e2648f641091c903a4ee3c71ad
SSDEEP

384:iXpGP+MQ9aBfDnnWI1k/9lMFSf0Z9xFMJ5irw6+Tdkn3ouoQXeOBfWB0n6nqWj:CGP+3aBLnFk/XMtZrCiSTdkuOBfuqW

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tyjxcm\Parameters\ServiceDll = "%SystemRoot%\\System32\\tyjxcm.dll"	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1676	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1788	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
1676	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tyjxcm.dll	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
552	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
552	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
1788	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
1788	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1788	552	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe	28
PID 552 wrote to memory of 1788	552	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe	28
PID 552 wrote to memory of 1788	552	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe	28
PID 552 wrote to memory of 1788	552	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe" TWO
  2⤵
  - Server Software Component: Terminal Services DLL
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1788

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k tyjxcm
1⤵
- Deletes itself
- Loads dropped DLL
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\tyjxcm.dll

Filesize
20KB

MD5
b3e8b904b45ed84a73b1581723be7777

SHA1
c0548d188155749359742969925b7f3d93510ea1

SHA256
d6b8bd01d5516dcbfe3697ed426103fbaeaed85c60a0283321b4a9149aa7bfa9

SHA512
ba0eefb3225d4be973932449937acc6d3af1ae2005b8544cf7535da1b02d5fda1bb7279b8230f371c601280955618f00ea58fa6261850129782ed2f2539652fd

Download Submit