002218dfeba3bda2b11c2bf68aca6a9fc349aa695815491839e16ae67eab2b92

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
Size

99KB
MD5

5daedb7a50ffd6bdb2515a37bed8c266
SHA1

c548094c98f4874f649b61f08e79ed4b053d1d9c
SHA256

002218dfeba3bda2b11c2bf68aca6a9fc349aa695815491839e16ae67eab2b92
SHA512

206d0ba7c01530beefa3c6921535c791d933c245300117b56a0cda18e4ae9dcc6bc58e0d6474c97dcd3bdc8bfd6d3788b78d5bcde7d790c185bf77a7f56b9618
SSDEEP

1536:fUpnlrU/rBTprOyNmTJMgwRba9SnX9tEfcp5LTE2f2AxwNuxhgWZ3ejDiZ4TmR8I:qn6/rvOyUwJaktUc/LY02AxPxjemtdlb

Score

8^/10

persistence vmprotect

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\xepemk.sys	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WLaA\Parameters\ServiceDll = "%SystemRoot%\\System32\\xepemk.dll"	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WLaA\Parameters\ServiceDll = "%SystemRoot%\\System32\\xepemk.dll"	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\WLaA\Parameters\ServiceDll = "%SystemRoot%\\System32\\xepemk.dll"	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2316	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2296	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
2316	svchost.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000400000-0x000000000040E200-memory.dmp	vmprotect
behavioral1/memory/2296-10-0x0000000000400000-0x000000000040E200-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\00044f52.ini	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xepemk.dll	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2316	svchost.exe
2316	svchost.exe
2316	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
PID:2296

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k WLaA
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\xepemk.dll

Filesize
59KB

MD5
8214161289352ea69210d9312e8dd824

SHA1
28984cf10d0129c0ae2ccec6804420874e19b17f

SHA256
c7a0cf6abbba43155e94803bc7d38e7d18107428bc50eb71f8c209794c688e63

SHA512
464986a3e7411cda4f2dbdc974255d35efb42fda26c476368d8775920ea734908a423bce04ed57e3a2c0972a7069693d5608b6ecdaf567d2029142ae21059524

Download Submit
memory/2296-0-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download
memory/2296-6-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/2296-10-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download
memory/2316-9-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download