Overview

overview

10

Static

static

3

3170bcf7de...18.exe

windows7-x64

10

3170bcf7de...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3170bcf7de646f8612910ab98f6d1861_JaffaCakes118

  • Size

    4.3MB

  • Sample

    240330-c2jzxaga47

  • MD5

    3170bcf7de646f8612910ab98f6d1861

  • SHA1

    71d81b3dd1747cf1c0e744fcb1809d6522eab902

  • SHA256

    bea9da3ee504f62fc074963332e96297c7fff5efb2999efc946bc518a3765c00

  • SHA512

    f232d67902f1b7fc3eb73efc7df575dcac83f5943e613e61982c78c9d4c47b18eadd6d87f2b4d040ec4125f4770a33f03b5743b3b18c34ab622b258f913b91c5

  • SSDEEP

    98304:OcaOt2a4P7cEg9j1rQT6YHyV4QWfjmRbM4rmqof6+oO+e:x4a4ndrE4QWfjm1M4rm1fqFe

Score
10/10
servhelperbackdoordiscoveryexploitpersistencetrojan

Malware Config

Targets

    • Target

      3170bcf7de646f8612910ab98f6d1861_JaffaCakes118

    • Size

      4.3MB

    • MD5

      3170bcf7de646f8612910ab98f6d1861

    • SHA1

      71d81b3dd1747cf1c0e744fcb1809d6522eab902

    • SHA256

      bea9da3ee504f62fc074963332e96297c7fff5efb2999efc946bc518a3765c00

    • SHA512

      f232d67902f1b7fc3eb73efc7df575dcac83f5943e613e61982c78c9d4c47b18eadd6d87f2b4d040ec4125f4770a33f03b5743b3b18c34ab622b258f913b91c5

    • SSDEEP

      98304:OcaOt2a4P7cEg9j1rQT6YHyV4QWfjmRbM4rmqof6+oO+e:x4a4ndrE4QWfjm1M4rm1fqFe

    Score
    10/10
    servhelperbackdoordiscoveryexploitpersistencetrojan

    • ServHelper

      ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

      trojanbackdoorservhelper

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies RDP port number used by Windows

    • Possible privilege escalation attempt

      exploit

    • Sets DLL path for service in the registry

      persistence

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

File and Directory Permissions Modification

1
T1222

Credential Access

Discovery

Lateral Movement

Remote Services

1
T1021

Remote Desktop Protocol

1
T1021.001

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks