32ef9328bcea6a90ab941f9ff8a462b15ea53fcf95bba9f8f81ae9f2123dae00

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe
Size

127KB
MD5

3827ae1205e3e0cb35d3b0aeebb8fef4
SHA1

09ca91f12007289f3149e416f4b8696c52dc34cc
SHA256

32ef9328bcea6a90ab941f9ff8a462b15ea53fcf95bba9f8f81ae9f2123dae00
SHA512

932a88fb829e8b6567ba023329b873d03a6c1ca7591ca029274a1b931aee1ee69141f94ab8ecb8763ba3bdce091920f8793c120cc637b467806c8bdc2b81903d
SSDEEP

3072:bpga6wBiZjPxzB0zURg3tSiZPNe5sXhpMaHKEc2JN:bpgmBixf04mDeCHB

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\BITS\Parameters\ServiceDll = "C:\\Windows\\system32\\1.dll"	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\1.dll	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\1.dll	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
976	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2348	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe
Token: SeDebugPrivilege	976	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 976	2348	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe	31
PID 2348 wrote to memory of 976	2348	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe	31
PID 2348 wrote to memory of 976	2348	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe	31
PID 2348 wrote to memory of 976	2348	3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3827ae1205e3e0cb35d3b0aeebb8fef4_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im 360tray.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download