7bedb2b96fdd9e645eaa1eefefc30f116102b887ca6c707e8675ad8618e955e1

General

Target

08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
Size

31KB
MD5

08e2acedfafd16f9265a4a7ae879d403
SHA1

df9c4c8355d4f55de7c07789b8f64190fe8f5b95
SHA256

7bedb2b96fdd9e645eaa1eefefc30f116102b887ca6c707e8675ad8618e955e1
SHA512

0155bde4aaabaf3c5126c82178e015b0bc1a13e2c7737fa2422f1d09f10ec1b7f1a4fd523967b5c47589beff9b48970df14cece50e19af774e31479a056720b2
SSDEEP

768:bRCtZG+ZCoOC9nR3M2NvaQITXXEdV9LQQ5Z:dKYEPNvjITX0P

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Parameters\ServiceDll = "C:\\Windows\\system32\\lld.cvsvres"	reg.exe

Deletes itself 1 IoCs

pid	Process
2736	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2732	rundll32.exe
2732	rundll32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msws.dll	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msws.dll	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Driver.inf	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lld.cvsvres	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lld.cvsvres	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2092	sc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3048	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	28
PID 2928 wrote to memory of 3048	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	28
PID 2928 wrote to memory of 3048	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	28
PID 2928 wrote to memory of 3048	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	28
PID 2928 wrote to memory of 2192	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	29
PID 2928 wrote to memory of 2192	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	29
PID 2928 wrote to memory of 2192	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	29
PID 2928 wrote to memory of 2192	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	29
PID 2928 wrote to memory of 2092	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	31
PID 2928 wrote to memory of 2092	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	31
PID 2928 wrote to memory of 2092	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	31
PID 2928 wrote to memory of 2092	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	31
PID 2928 wrote to memory of 2732	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	34
PID 2928 wrote to memory of 2732	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	34
PID 2928 wrote to memory of 2732	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	34
PID 2928 wrote to memory of 2732	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	34
PID 2928 wrote to memory of 2732	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	34
PID 2928 wrote to memory of 2732	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	34
PID 2928 wrote to memory of 2732	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	34
PID 2928 wrote to memory of 2736	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	35
PID 2928 wrote to memory of 2736	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	35
PID 2928 wrote to memory of 2736	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	35
PID 2928 wrote to memory of 2736	2928	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver" /v DelayedAutoStart /t REG_DWORD /d 0 /f
  2⤵
  PID:3048
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d C:\Windows\system32\lld.cvsvres /f
  2⤵
  - Server Software Component: Terminal Services DLL
  PID:2192
- C:\Windows\SysWOW64\sc.exe
  sc config lanmanserver start= auto
  2⤵
  - Launches sc.exe
  PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\lld.cvsvres StartUpA
  2⤵
  - Loads dropped DLL
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
  2⤵
  - Deletes itself
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Driver.inf

Filesize
192B

MD5
e2b127da80c9f0e027562592b213766c

SHA1
707576dd9620ac9646544996b01e6ced45639867

SHA256
6e34e0e930c24a31b33ec48fb94d069e9c765b671f199852aecb0ea82616595e

SHA512
971787891317e8533a19872621c0afcd491fd266b8663f5b6aa9508a05e0dcf586300274cbc5ae530e3bb56dded4a36505f6e2392b2431251dce5efbedf1f5bd

Download Submit
C:\Windows\SysWOW64\lld.cvsvres

Filesize
24KB

MD5
766c1ad36519f7e484c2effcfac292d6

SHA1
657d6effaa6eaa63d0f4b45770f25fb8c85c73e4

SHA256
45157cc3e155fe7c3b42e2ef4adfc9ed227793f6f3414a89e18a5f761032cfb6

SHA512
5547628a31dd8ae53aab76bddd34c9328bedf2a0a08bd78b56ad903ac1e6e200e97ab9a1f92bc7fa601a091a04e08a0ea98491aa6efa53f296d609d45ff69998

Download Submit
C:\Windows\SysWOW64\msws.dll

Filesize
202KB

MD5
7ff15a4f092cd4a96055ba69f903e3e9

SHA1
a3d338a38c2b92f95129814973f59446668402a8

SHA256
1b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627

SHA512
4b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae

Download Submit

Analysis

Sharing