f80cf9326add3ab456637242fdc3310088d6ba4f7ff383b4bd1643bf8f982a67

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

075a188372d1e5295ea9df563bc0e017_JaffaCakes118.dll
Size

308KB
MD5

075a188372d1e5295ea9df563bc0e017
SHA1

9732cb15c93f0ced24bd786a0281bd8f5eac20a3
SHA256

f80cf9326add3ab456637242fdc3310088d6ba4f7ff383b4bd1643bf8f982a67
SHA512

cd37e704eccdb1ffc3923e165b6f1f1508bfcc489f76d1ec55a02fe119d5da963690f5d2f6d994a09e653c1e5d9369f4bb4309dba81b5b65ee4e9b0fc9c10a5a
SSDEEP

6144:JrwtcXdrcR/7GHck3GIRXIbDccdjNSYsmIw5LhfhYrLjn+TBpAFCrX5:t9XdrcR/6jrMcCRfhYnjn+TYQ75

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\`\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\075a188372d1e5295ea9df563bc0e017_JaffaCakes118.dll"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2140	rundll32.exe
2140	rundll32.exe
2068	svchost.exe
2068	svchost.exe
2068	svchost.exe
2068	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	rundll32.exe
Token: SeDebugPrivilege	2068	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2140	2180	rundll32.exe	29
PID 2180 wrote to memory of 2140	2180	rundll32.exe	29
PID 2180 wrote to memory of 2140	2180	rundll32.exe	29
PID 2180 wrote to memory of 2140	2180	rundll32.exe	29
PID 2180 wrote to memory of 2140	2180	rundll32.exe	29
PID 2180 wrote to memory of 2140	2180	rundll32.exe	29
PID 2180 wrote to memory of 2140	2180	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\075a188372d1e5295ea9df563bc0e017_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\075a188372d1e5295ea9df563bc0e017_JaffaCakes118.dll,#1
  2⤵
  - Server Software Component: Terminal Services DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k mysysgroup3
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...