0bb3a01fad359230762d7dcb5c2e7b38acff448c50885366148e3bdd5a23b11d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
Size

27KB
MD5

17c6fb96f1285dd2d7f2b7e0f46e989d
SHA1

c082195c06a379ce02f35ba3c8c16fc4779e8eea
SHA256

0bb3a01fad359230762d7dcb5c2e7b38acff448c50885366148e3bdd5a23b11d
SHA512

752e29de32cc69e38f1fb3d3c0d4d84469aa77e329a48fb39ca7c939a3922b3c929c457f3c2bb65e80bdc1fc2b2189f61b3585e2648f641091c903a4ee3c71ad
SSDEEP

384:iXpGP+MQ9aBfDnnWI1k/9lMFSf0Z9xFMJ5irw6+Tdkn3ouoQXeOBfWB0n6nqWj:CGP+3aBLnFk/XMtZrCiSTdkuOBfuqW

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tyjxcm\Parameters\ServiceDll = "%SystemRoot%\\System32\\tyjxcm.dll"	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3872	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
4664	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
3872	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tyjxcm.dll	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4664	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
4664	17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17c6fb96f1285dd2d7f2b7e0f46e989d_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4664

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k tyjxcm
1⤵
- Deletes itself
- Loads dropped DLL
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tyjxcm.dll

Filesize
20KB

MD5
2796e5c1d196472d4047f9dae6620062

SHA1
3088c4297c08a1c61b4557a2a99cec8d381b8b0d

SHA256
c126136c61439133c99f683d211345a6c748c034c05f8fdd7dceefedeb471e8b

SHA512
f8143f4fe154d2589a2d65c388901cb37452723eb05aede5ed22236528ee3a3f74642f13dc58911fec912f90d35bbb38942c1941af27180cf6c7e630144b0d23

Download Submit