8b3ae17386ae847357a22c80cc6c9799645a5a24af9f93178d360770248808af

General

Target

1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe
Size

579KB
MD5

1c8bda0e685c254113cd0cc2bdee1f0b
SHA1

dc5b5ad0eb6b14a138d62013b740a862680530d3
SHA256

8b3ae17386ae847357a22c80cc6c9799645a5a24af9f93178d360770248808af
SHA512

f3dc4fe3053fb927b4ec0dfaf50f59a1594d18fcc11cc766411aa8f4c7738b556efe448ac2ba47b0c547bea664a997747837216097c3597f916b691621dd5b61
SSDEEP

12288:HcL/XWgCYvGazyQodZ2ZuIFF3Z4mxxLI5YB2l0ag+G:HcL/XdHu12sIFQmXs5YAlfgt

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\enent\Parameters\ServiceDll = "C:\\Windows\\system32\\event.dll"	1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2896	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2900	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\event.dll	1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\event.dll	1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2896	2960	1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe	29
PID 2960 wrote to memory of 2896	2960	1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe	29
PID 2960 wrote to memory of 2896	2960	1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe	29
PID 2960 wrote to memory of 2896	2960	1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\1c8bda0e685c254113cd0cc2bdee1f0b_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:2896

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\event.dll

Filesize
526KB

MD5
c877cd7acb3bc425e8dfda0800d019fc

SHA1
fb3dbc189bdff76b0c3f75e0b8ded77ba22af127

SHA256
513be135ed6387bad21a4ba5670d4c0ee61c06eb8acbb170bc25fb34712cc4de

SHA512
398dcc41288cd9aa87cedba426e4a1b7649ea3de1b0f82b63afa472c3fdb9b80402c302f8d4ff1b8cdbf935597ced0a0208eb4575aeb82de7cf2033626fa9d9b

Download Submit
memory/2900-40-0x00000000005A0000-0x000000000062B000-memory.dmp

Filesize
556KB

Download
memory/2900-37-0x00000000005A0000-0x000000000062B000-memory.dmp

Filesize
556KB

Download
memory/2960-16-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2960-29-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2960-30-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/2960-14-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2960-28-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2960-13-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2960-26-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/2960-25-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/2960-24-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/2960-23-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2960-22-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/2960-20-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2960-19-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2960-18-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2960-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2960-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2960-39-0x0000000000330000-0x0000000000384000-memory.dmp

Filesize
336KB

Download
memory/2960-31-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/2960-27-0x0000000002020000-0x0000000002021000-memory.dmp

Filesize
4KB

Download
memory/2960-12-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2960-11-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2960-10-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2960-9-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2960-8-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2960-7-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2960-6-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2960-5-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2960-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2960-3-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2960-2-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2960-32-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2960-21-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2960-38-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2960-15-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2960-1-0x0000000000330000-0x0000000000384000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing