7bedb2b96fdd9e645eaa1eefefc30f116102b887ca6c707e8675ad8618e955e1

General

Target

08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
Size

31KB
MD5

08e2acedfafd16f9265a4a7ae879d403
SHA1

df9c4c8355d4f55de7c07789b8f64190fe8f5b95
SHA256

7bedb2b96fdd9e645eaa1eefefc30f116102b887ca6c707e8675ad8618e955e1
SHA512

0155bde4aaabaf3c5126c82178e015b0bc1a13e2c7737fa2422f1d09f10ec1b7f1a4fd523967b5c47589beff9b48970df14cece50e19af774e31479a056720b2
SSDEEP

768:bRCtZG+ZCoOC9nR3M2NvaQITXXEdV9LQQ5Z:dKYEPNvjITX0P

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\ServiceDll = "C:\\Windows\\system32\\lld.cvsvres"	reg.exe

Loads dropped DLL 2 IoCs

pid	Process
5116	rundll32.exe
5116	rundll32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msws.dll	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Driver.inf	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lld.cvsvres	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lld.cvsvres	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msws.dll	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4100	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4208	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	86
PID 1948 wrote to memory of 4208	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	86
PID 1948 wrote to memory of 4208	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	86
PID 1948 wrote to memory of 384	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	87
PID 1948 wrote to memory of 384	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	87
PID 1948 wrote to memory of 384	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	87
PID 1948 wrote to memory of 4100	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	88
PID 1948 wrote to memory of 4100	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	88
PID 1948 wrote to memory of 4100	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	88
PID 1948 wrote to memory of 5116	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	96
PID 1948 wrote to memory of 5116	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	96
PID 1948 wrote to memory of 5116	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	96
PID 1948 wrote to memory of 1756	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	97
PID 1948 wrote to memory of 1756	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	97
PID 1948 wrote to memory of 1756	1948	08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver" /v DelayedAutoStart /t REG_DWORD /d 0 /f
  2⤵
  PID:4208
- C:\Windows\SysWOW64\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d C:\Windows\system32\lld.cvsvres /f
  2⤵
  - Server Software Component: Terminal Services DLL
  PID:384
- C:\Windows\SysWOW64\sc.exe
  sc config lanmanserver start= auto
  2⤵
  - Launches sc.exe
  PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\lld.cvsvres StartUpA
  2⤵
  - Loads dropped DLL
  PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\08e2acedfafd16f9265a4a7ae879d403_JaffaCakes118.exe
  2⤵
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Driver.inf

Filesize
192B

MD5
e2b127da80c9f0e027562592b213766c

SHA1
707576dd9620ac9646544996b01e6ced45639867

SHA256
6e34e0e930c24a31b33ec48fb94d069e9c765b671f199852aecb0ea82616595e

SHA512
971787891317e8533a19872621c0afcd491fd266b8663f5b6aa9508a05e0dcf586300274cbc5ae530e3bb56dded4a36505f6e2392b2431251dce5efbedf1f5bd

Download Submit
C:\Windows\SysWOW64\lld.cvsvres

Filesize
24KB

MD5
766c1ad36519f7e484c2effcfac292d6

SHA1
657d6effaa6eaa63d0f4b45770f25fb8c85c73e4

SHA256
45157cc3e155fe7c3b42e2ef4adfc9ed227793f6f3414a89e18a5f761032cfb6

SHA512
5547628a31dd8ae53aab76bddd34c9328bedf2a0a08bd78b56ad903ac1e6e200e97ab9a1f92bc7fa601a091a04e08a0ea98491aa6efa53f296d609d45ff69998

Download Submit
C:\Windows\SysWOW64\msws.dll

Filesize
388KB

MD5
8d7db101a7211fe3309dc4dc8cf2dd0a

SHA1
6c2781eadf53b3742d16dab2f164baf813f7ac85

SHA256
93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a

SHA512
8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

Download Submit

Analysis

Sharing