2e3d35453a1ed0a391c14c519e2e1ef7e28d831955c5a2245782e07e749416a8

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe
Size

42KB
MD5

487b4c879d7ab30fc8fa0e69265bcc47
SHA1

7578979a956f257acf118aa7c6f583b04a4b9039
SHA256

2e3d35453a1ed0a391c14c519e2e1ef7e28d831955c5a2245782e07e749416a8
SHA512

55de921d2992443d76f32f3ba34a7751db625f0356405b3fc6413996b108d46b980d7e1d6f0a96df1984b55de7a0f1946b8daace891e0bd94e164957dce9de7c
SSDEEP

768:70zaaeHtngTNP5eNnaz8MaLbfFQX8eNEbmy9PQTvOjZESeouNuGyQLtpJ:7ianHGxwRMaLxoypQTvOVP5mtT

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetServiceMDM365\Parameters\ServiceDll = "C:\\Windows\\system32\\DDserviceMDM365.dll"	487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3220	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DDserviceMDM365.dll	487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3220	svchost.exe
3220	svchost.exe
3220	svchost.exe

C:\Users\Admin\AppData\Local\Temp\487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\487b4c879d7ab30fc8fa0e69265bcc47_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
PID:212

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k NetServiceMDM365
1⤵
PID:4564

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k NetServiceMDM365
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\ddservicemdm365.dll

Filesize
31KB

MD5
00c34b3e51b17d0cdd5526fd1a9a2b16

SHA1
c35f90b28b5733e6d1d596d4e000b94fc64d8e3e

SHA256
08d4816766b4811a71e9c31023d68aadfa7d87e6b50c58ee943abade90eef40b

SHA512
483de39b09a4daecbf0d5a071e8f927c32a1913664b7c83a964f392b42b1ff594195017f83e76f20f733b418e2a3630cd1bf5931df8499409b0231768fa67549

Download Submit
memory/212-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3220-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download