110d4b321408fd74743d5884024b328bcacb33765611721d0950a4b5fb9e1388

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe
Size

226KB
MD5

6644fb1562391bae936c140da70a34d5
SHA1

50a1949bcf2993b2faee90340fbd8f7573167264
SHA256

110d4b321408fd74743d5884024b328bcacb33765611721d0950a4b5fb9e1388
SHA512

b2dff0fbe0110997c54a6f67d9e1dcb6a737a956f94ca8f7bdb81d8809e80e125b5f686e0edc87a80288d7f77205082bb8e5faa2b4cce06aa976da6d0892893b
SSDEEP

6144:y1RgeS/LXPoBQfFMCEVtqhr23CjNtr/PbMmJ/a7aSr:+geS/LoiaCcqA0PbMVae

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wind0ws\Parameters\ServiceDll = "C:\\Documents and Settings\\Local Server\\hy.dll"	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2704	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2704	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\FuckYou.txt	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2656	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeBackupPrivilege	1676	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe
Token: SeRestorePrivilege	1676	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2656	1676	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe	30
PID 1676 wrote to memory of 2656	1676	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe	30
PID 1676 wrote to memory of 2656	1676	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe	30
PID 1676 wrote to memory of 2656	1676	6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6644fb1562391bae936c140da70a34d5_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im ZhuDongFangYu.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Local Server\hy.dll

Filesize
137KB

MD5
46a3e4b288f83f46e7f3e1347909e6dc

SHA1
be772206307aba039755574dff208b7e6a78c266

SHA256
1fc9e7d9efba2e470970a1d0f564f5eef9a4863ce7a2ad2b8b2b7daf994018d7

SHA512
07f6bec3aa53d7b0463488acd43b3dcc71d59c88dd2e462429673687d4cf05f31baad17fa760c233203c99fd4e3bcfcfdab0a6c0940853f32ea4f5a9f0558453

Download Submit
memory/1676-7-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1676-15-0x00000000002A0000-0x00000000002DE000-memory.dmp

Filesize
248KB

Download
memory/1676-3-0x00000000002A0000-0x00000000002DE000-memory.dmp

Filesize
248KB

Download
memory/1676-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1676-8-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1676-6-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1676-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1676-9-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1676-5-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/1676-16-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1676-4-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1676-1-0x00000000002A0000-0x00000000002DE000-memory.dmp

Filesize
248KB

Download
memory/1676-12-0x00000000002A0000-0x00000000002DE000-memory.dmp

Filesize
248KB

Download
memory/1676-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2704-17-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download