87306c6bb1a048408d12ac101e7c1d83c1556a3fda29d7d430dc5667fc1ea1d5

General

Target

4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Size

73KB
MD5

4ae8a5ce179eaefe40c694f9fae8bd48
SHA1

84ee6882afef02f81b4ff1284809567600320179
SHA256

87306c6bb1a048408d12ac101e7c1d83c1556a3fda29d7d430dc5667fc1ea1d5
SHA512

4cd3753e22f4d5f592e3782404e59679ecba56d73a68732289d3851d079dc9b6532a6bf733150efd15c71c4f0a149933a515ddc3032e7216a76c8dbaf5ed31d9
SSDEEP

1536:cB/Mz7IPM8QX41zUIF5uM2IHSlrd0SIivppoNn:cB/MI0X42ILutIorRONn

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe

Loads dropped DLL 24 IoCs

pid	Process
2680	svchost.exe
2680	svchost.exe
2644	svchost.exe
2644	svchost.exe
2552	svchost.exe
2552	svchost.exe
3004	svchost.exe
3004	svchost.exe
2716	svchost.exe
2716	svchost.exe
2576	svchost.exe
2576	svchost.exe
2068	svchost.exe
2068	svchost.exe
1224	svchost.exe
1224	svchost.exe
1696	svchost.exe
1696	svchost.exe
1760	svchost.exe
1760	svchost.exe
1044	svchost.exe
1044	svchost.exe
1040	svchost.exe
1040	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3048	4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ae8a5ce179eaefe40c694f9fae8bd48_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3048

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2644

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:3004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2716

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2576

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2068

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
PID:1840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1224

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1696

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1760

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
73KB

MD5
591b98460855033cc339e5fff3ae037d

SHA1
f8622d2cfcf9d98fb904c20007123d460f09d1c3

SHA256
e5cb57fdc92aae9925627ba5af71ae631bce4834253c32e16503c07941bce169

SHA512
63ad1d4edeadf02801389b49586d14b5514de754b0880740c1246803a66c7fbf280e5bfa27e22fa0dbd4d672e5c3a7a9cfdbaad633d90523f09f6b829a95d9ae

Download Submit
memory/1044-65-0x0000000074260000-0x000000007427F000-memory.dmp

Filesize
124KB

Download
memory/1224-50-0x0000000074260000-0x000000007427F000-memory.dmp

Filesize
124KB

Download
memory/1696-56-0x0000000074280000-0x000000007429F000-memory.dmp

Filesize
124KB

Download
memory/2552-25-0x0000000074260000-0x000000007427F000-memory.dmp

Filesize
124KB

Download
memory/2552-24-0x0000000074280000-0x000000007429F000-memory.dmp

Filesize
124KB

Download
memory/2644-17-0x0000000073D30000-0x0000000073D4F000-memory.dmp

Filesize
124KB

Download
memory/2644-18-0x0000000073D10000-0x0000000073D2F000-memory.dmp

Filesize
124KB

Download
memory/2680-10-0x0000000074280000-0x000000007429F000-memory.dmp

Filesize
124KB

Download
memory/2680-11-0x0000000074260000-0x000000007427F000-memory.dmp

Filesize
124KB

Download
memory/3048-1-0x0000000000DF0000-0x0000000000E0F000-memory.dmp

Filesize
124KB

Download
memory/3048-5-0x0000000000E0E000-0x0000000000E0F000-memory.dmp

Filesize
4KB

Download
memory/3048-30-0x0000000000020000-0x000000000003F000-memory.dmp

Filesize
124KB

Download
memory/3048-2-0x0000000000020000-0x000000000003F000-memory.dmp

Filesize
124KB

Download
memory/3048-3-0x0000000000020000-0x000000000003F000-memory.dmp

Filesize
124KB

Download
memory/3048-4-0x0000000000020000-0x000000000003F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing