2884e5c022948d9471d32d60e4786b05551eaaa2aaa0432efeb52b0f89ac7f67

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe
Size

842KB
MD5

220f5a59f14b31c2f8028a761f223d08
SHA1

8d457b29c1c0b0e76096a3bc967328174009ec02
SHA256

2884e5c022948d9471d32d60e4786b05551eaaa2aaa0432efeb52b0f89ac7f67
SHA512

5937410b64d701f958a529a90e015fb242589c665db6fb543e478a454cd3f79a37cf1ffb32c248bdbf840dbea29eaf5bb3b8692846431fe770b5cacaf8983813
SSDEEP

12288:qswwgWxMmoZ+XCGTtjmHDdqMe8q2MsSha79xIWAN9Ftf3Juh5Exnj:n7NMmoZVst6pqL2Wha7zANbtPohOj

Score

8^/10

execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sys_temtrayr.exe	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sys_temtray.ini	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sys_temtray.ini	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sys_temtray.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sys_temtray.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sys_temtray.exe	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2660	sc.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
2772	net.exe

Runs net.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2100	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2100	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2100	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2100	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2660	2100	cmd.exe	30
PID 2100 wrote to memory of 2660	2100	cmd.exe	30
PID 2100 wrote to memory of 2660	2100	cmd.exe	30
PID 2100 wrote to memory of 2660	2100	cmd.exe	30
PID 2484 wrote to memory of 2304	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2304	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2304	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2304	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2708	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	33
PID 2484 wrote to memory of 2708	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	33
PID 2484 wrote to memory of 2708	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	33
PID 2484 wrote to memory of 2708	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	33
PID 2708 wrote to memory of 2772	2708	cmd.exe	35
PID 2708 wrote to memory of 2772	2708	cmd.exe	35
PID 2708 wrote to memory of 2772	2708	cmd.exe	35
PID 2708 wrote to memory of 2772	2708	cmd.exe	35
PID 2772 wrote to memory of 2840	2772	net.exe	36
PID 2772 wrote to memory of 2840	2772	net.exe	36
PID 2772 wrote to memory of 2840	2772	net.exe	36
PID 2772 wrote to memory of 2840	2772	net.exe	36
PID 2484 wrote to memory of 2696	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	37
PID 2484 wrote to memory of 2696	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	37
PID 2484 wrote to memory of 2696	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	37
PID 2484 wrote to memory of 2696	2484	220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe	37

C:\Users\Admin\AppData\Local\Temp\220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc create WinServerView binpath= "C:\Windows\system32\sys_temtray.exe" type= share start= auto displayname= "systemtray" depend= RPCSS/Tcpip/IPSec
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc create WinServerView binpath= "C:\Windows\system32\sys_temtray.exe" type= share start= auto displayname= "systemtray" depend= RPCSS/Tcpip/IPSec
    3⤵
    - Launches sc.exe
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\220f5a59f14b31c2f8028a761f223d08_JaffaCakes118.exe" "C:\Windows\system32\sys_temtray.exe"
  2⤵
  - Drops file in System32 directory
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start WinServerView
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\net.exe
    net start WinServerView
    3⤵
    - Discovers systems in the same network
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start WinServerView
      4⤵
      PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\del.bat
  2⤵
  - Deletes itself
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\del.bat

Filesize
212B

MD5
711c94b97baf6b9ccb970d7eeb378057

SHA1
b07df8cc8fdd8c4e75a6ad335849bbd35119e73e

SHA256
48006e44531e2a137f607fa320317b065e0f871dbd3e30f7626bae054e50a74c

SHA512
8ca3d1481874ccd6e40cd06bb582d8a7be4cf46cba0c229e2c3ec52583f521a815a54667ec4055893ea262db2e15e22fb9b4a32b06bd2ce6deb3735ecd0ea2dc

Download Submit
memory/2484-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2484-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download