1bc58c075709daa3a2666a49811069642ba5ea4db9ea26dbc463c947b22bb946

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
Size

539KB
MD5

2bea73a92753703a9080f55c5fd5e06f
SHA1

a787af44eb3f1d1a1fe2ada0d4b14fad4c7a9ec2
SHA256

1bc58c075709daa3a2666a49811069642ba5ea4db9ea26dbc463c947b22bb946
SHA512

81479f1c248b047d82d604ab5499af162d4b5b63dfa0edf1a931247f9fffcc229d268a42c8bc31e509e9f2b3073677b5feac7299ee8c35cf38401bebc00da834
SSDEEP

12288:KDTpfOv6g6Zc2Yl1YcEOF3Z4mxxP8E7PIxyJ00riPeZdRLq:4TEucFl1nQmXP8E7wxn9

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BRC_Services\Parameters\ServiceDll = "C:\\Windows\\system32\\system32gh.dll"	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3020	svchost.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system32gh.exe	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\system32gh.exe	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\system32gh.dll	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\brc_Server.dat	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\brc_Server.dat	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
2212	2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2bea73a92753703a9080f55c5fd5e06f_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2212

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\brc_Server.dat

Filesize
234B

MD5
a3ccecbf3fa5e007e202470952697feb

SHA1
bd03605d799e4b1172dfe6d487669e4079009060

SHA256
8dc6d1159907298a5ab1e1b7545c26291f3d7b49fbaae14055c20e06706b81c2

SHA512
a9cfc5ffe167c934c9da9afc518bbe17cf103fb385f40962135d3bfbf647d40982ef3bdf7009d4fcbcb29c7ed249dd67ccfa2da2a064ff6719721d564728aa99

Download Submit
\??\c:\windows\SysWOW64\system32gh.dll

Filesize
331KB

MD5
527216a12481dd603cbba283a3c88856

SHA1
9c5d0eda2d2341effbb94afe4b6dddbe77dc2618

SHA256
0df820215a60d2c3889c568428867b585d5f133e6a8dd2d0e67138e9d785fdfd

SHA512
509926c2844ff895aa536e97ffad171888f4b6343d999b2bd8e1f50fc37c02b3b274ff08a0cf2de13823951069d776043132092dcdeb8bbbcb7f6377401094a9

Download Submit
memory/2212-8-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2212-7-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/2212-12-0x0000000003310000-0x0000000003312000-memory.dmp

Filesize
8KB

Download
memory/2212-16-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2212-15-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2212-14-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2212-13-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/2212-11-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/2212-10-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2212-6-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2212-2-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2212-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2212-9-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2212-5-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2212-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2212-3-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/2212-24-0x0000000002150000-0x00000000021A4000-memory.dmp

Filesize
336KB

Download
memory/2212-23-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2212-1-0x0000000002150000-0x00000000021A4000-memory.dmp

Filesize
336KB

Download
memory/3020-26-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3020-28-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3020-29-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download