bc27f9ca4f1a712de85b14a5dc8c960cd5e7a155a5e4b82d1c902a9638991d2d

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
Size

59KB
MD5

ebd2eeb6c62f12f11f1575c74bbc1d6a
SHA1

68259fbd1936268e78779f1634970d574d677a36
SHA256

bc27f9ca4f1a712de85b14a5dc8c960cd5e7a155a5e4b82d1c902a9638991d2d
SHA512

64dce2109a32dafb6d50c061e5aa421feea37deb1840ecb6846c1a970424bcf5c130c2409b1decf815f2914479973e50f5f52100c794ff42bd73db441cbf8eee
SSDEEP

1536:RKSQdiVKKCdp/gc8O9Lj2K8tf+wZRKopW:85uKNdp/gD6YZ+AU5

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Runtime\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\czlblt.dll"	ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\Runtime\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\czlblt.dll"	ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Runtime\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\czlblt.dll"	ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
4604	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1332	ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
4604	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\czlblt.dll	ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\000540fe.001	ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1332

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k Runtime
1⤵
- Deletes itself
- Loads dropped DLL
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\czlblt.dll

Filesize
89KB

MD5
25432b335e005a2267e117a2bec80636

SHA1
725514d54be2d78d037e982132822a6fdc8c5a77

SHA256
7a212e8c1a3415022b6b93c37f542377a26fd49a5991d36d3a9a0cdf820e4f29

SHA512
010c1cec8fe88beb7ea55f0f34f84825520dcb50e1d4bf9698bd8330aaa4d301efa3d19656a09f44c60c4d983af764f937ad799bd05f7d39366cf5eebaff97b0

Download Submit
memory/1332-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads