6406c3ae90c47d1d401f61bf7ff42aa4b97f89a61a698a19ad8a324a140c5ee9

Analysis

max time kernel
140s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fab81c77a6e8d2d06bfdd3ccb40a9d3_JaffaCakes118.dll
Size

558KB
MD5

2fab81c77a6e8d2d06bfdd3ccb40a9d3
SHA1

8748dd1fc5a541aa2d9a345b8478d03935b13ead
SHA256

6406c3ae90c47d1d401f61bf7ff42aa4b97f89a61a698a19ad8a324a140c5ee9
SHA512

b611ed543f93c782b30edb4d7cdff9ca3f380fa20cdc50162d9e4f4dbec8fb04f8026ab435cec2a56b71a626b1aa6c7ab562a140ab881e1b077beda86524c469
SSDEEP

12288:wQt+YuteVRVmUX83NYrqqU0dGQq3w0hTdgIz:w8IMRVrONSqqFGQNITdgw

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogeCena\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fab81c77a6e8d2d06bfdd3ccb40a9d3_JaffaCakes118.dll"	regsvr32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 380	3536	regsvr32.exe	83
PID 3536 wrote to memory of 380	3536	regsvr32.exe	83
PID 3536 wrote to memory of 380	3536	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2fab81c77a6e8d2d06bfdd3ccb40a9d3_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2fab81c77a6e8d2d06bfdd3ccb40a9d3_JaffaCakes118.dll
  2⤵
  - Server Software Component: Terminal Services DLL
  PID:380

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k GaLoge -s LogeCena
1⤵
- Modifies data under HKEY_USERS
PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3588-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download