2e3d35453a1ed0a391c14c519e2e1ef7e28d831955c5a2245782e07e749416a8

General

Target

487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe
Size

42KB
MD5

487b4c879d7ab30fc8fa0e69265bcc47
SHA1

7578979a956f257acf118aa7c6f583b04a4b9039
SHA256

2e3d35453a1ed0a391c14c519e2e1ef7e28d831955c5a2245782e07e749416a8
SHA512

55de921d2992443d76f32f3ba34a7751db625f0356405b3fc6413996b108d46b980d7e1d6f0a96df1984b55de7a0f1946b8daace891e0bd94e164957dce9de7c
SSDEEP

768:70zaaeHtngTNP5eNnaz8MaLbfFQX8eNEbmy9PQTvOjZESeouNuGyQLtpJ:7ianHGxwRMaLxoypQTvOVP5mtT

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NetServiceMDM365\Parameters\ServiceDll = "C:\\Windows\\system32\\DDserviceMDM365.dll"	487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2304	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\SysWOW64\DDserviceMDM365.dll	487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-52-4a-65-51-aa	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-52-4a-65-51-aa\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-52-4a-65-51-aa\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82877E74-F820-4A96-A027-23B3FD1282CD}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82877E74-F820-4A96-A027-23B3FD1282CD}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82877E74-F820-4A96-A027-23B3FD1282CD}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82877E74-F820-4A96-A027-23B3FD1282CD}\82-52-4a-65-51-aa	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-52-4a-65-51-aa\WpadDecisionTime = 400510b97ad6da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82877E74-F820-4A96-A027-23B3FD1282CD}\WpadDecisionTime = 400510b97ad6da01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82877E74-F820-4A96-A027-23B3FD1282CD}\WpadNetworkName = "Network 3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2304	svchost.exe
2304	svchost.exe
2304	svchost.exe

C:\Users\Admin\AppData\Local\Temp\487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
PID:1488

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k NetServiceMDM365
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\DDserviceMDM365.dll

Filesize
31KB

MD5
00c34b3e51b17d0cdd5526fd1a9a2b16

SHA1
c35f90b28b5733e6d1d596d4e000b94fc64d8e3e

SHA256
08d4816766b4811a71e9c31023d68aadfa7d87e6b50c58ee943abade90eef40b

SHA512
483de39b09a4daecbf0d5a071e8f927c32a1913664b7c83a964f392b42b1ff594195017f83e76f20f733b418e2a3630cd1bf5931df8499409b0231768fa67549

Download Submit
memory/1488-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2304-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2304-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing