3b9dde091d39fa8c99225f1e128170cec036b6f5d5f10f0c899f89f1f5c8356b

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe
Size

19KB
MD5

17d1235a8d9a35912cfeb30bb1505f9e
SHA1

b50a0c3b59130c9156876ab18dd0a97ab43dea87
SHA256

3b9dde091d39fa8c99225f1e128170cec036b6f5d5f10f0c899f89f1f5c8356b
SHA512

1b6e4f27b4489dc0a5f0a5d99e476edc67e3ab009e11daff8f82c93415cdad60e6b46e9a53e0b5a7738ba6b680774e06e20840c4ca4be9eacd699c2527d6c6f8
SSDEEP

384:gO1EI1f1qxvlqxzBoIc4O5EaJDPHO0TCVp9/P3iOUIHAPfBoG/KQ6j1McF5v7wC:gIrx1qxv0xzy5bEaFu9VpVTUboGiRMcP

Score

8^/10

execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Deletes itself 1 IoCs

pid	Process
2700	lsserv.exe

Executes dropped EXE 1 IoCs

pid	Process
2700	lsserv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lsserv.exe	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lsserv.exe	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2308	sc.exe
2096	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe
2700	lsserv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2096	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	29
PID 764 wrote to memory of 2096	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	29
PID 764 wrote to memory of 2096	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	29
PID 764 wrote to memory of 2096	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	29
PID 764 wrote to memory of 2308	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	30
PID 764 wrote to memory of 2308	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	30
PID 764 wrote to memory of 2308	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	30
PID 764 wrote to memory of 2308	764	17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17d1235a8d9a35912cfeb30bb1505f9e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\sc.exe
  sc create "Network service" binPath= "C:\Windows\system32\lsserv.exe" start= auto error= ignore
  2⤵
  - Launches sc.exe
  PID:2096
- C:\Windows\SysWOW64\sc.exe
  sc config "Network service" start= auto
  2⤵
  - Launches sc.exe
  PID:2308

C:\Windows\SysWOW64\lsserv.exe
C:\Windows\SysWOW64\lsserv.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\lsserv.exe

Filesize
19KB

MD5
17d1235a8d9a35912cfeb30bb1505f9e

SHA1
b50a0c3b59130c9156876ab18dd0a97ab43dea87

SHA256
3b9dde091d39fa8c99225f1e128170cec036b6f5d5f10f0c899f89f1f5c8356b

SHA512
1b6e4f27b4489dc0a5f0a5d99e476edc67e3ab009e11daff8f82c93415cdad60e6b46e9a53e0b5a7738ba6b680774e06e20840c4ca4be9eacd699c2527d6c6f8

Download Submit