002218dfeba3bda2b11c2bf68aca6a9fc349aa695815491839e16ae67eab2b92

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
Size

99KB
MD5

5daedb7a50ffd6bdb2515a37bed8c266
SHA1

c548094c98f4874f649b61f08e79ed4b053d1d9c
SHA256

002218dfeba3bda2b11c2bf68aca6a9fc349aa695815491839e16ae67eab2b92
SHA512

206d0ba7c01530beefa3c6921535c791d933c245300117b56a0cda18e4ae9dcc6bc58e0d6474c97dcd3bdc8bfd6d3788b78d5bcde7d790c185bf77a7f56b9618
SSDEEP

1536:fUpnlrU/rBTprOyNmTJMgwRba9SnX9tEfcp5LTE2f2AxwNuxhgWZ3ejDiZ4TmR8I:qn6/rvOyUwJaktUc/LY02AxPxjemtdlb

Score

8^/10

persistence vmprotect

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\hycpfi.sys	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WLaA\Parameters\ServiceDll = "%SystemRoot%\\System32\\hycpfi.dll"	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WLaA\Parameters\ServiceDll = "%SystemRoot%\\System32\\hycpfi.dll"	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\WLaA\Parameters\ServiceDll = "%SystemRoot%\\System32\\hycpfi.dll"	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3872	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
4976	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
3872	svchost.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4976-0-0x0000000000400000-0x000000000040E200-memory.dmp	vmprotect
behavioral2/memory/4976-11-0x0000000000400000-0x000000000040E200-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\00044f52.ini	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hycpfi.dll	5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3872	svchost.exe
3872	svchost.exe
3872	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5daedb7a50ffd6bdb2515a37bed8c266_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
PID:4976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k WLaA
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hycpfi.dll

Filesize
59KB

MD5
59e09788d904f6d7a5061c0f33f85dd1

SHA1
2a66a74391f23e9f8812137a0540d1ef09dd1663

SHA256
295efc93e188be8501780ebb6b6b7f073938702bf120ca2ef76c927f84549425

SHA512
07e8740095f97cdc0eb88e3d2efe2515168d02f7b6d19fb586cc218ea6e2761d6fa7f3efb537f54a7651054f39630b494f16b45fff3fc67450a8341a5a568a85

Download Submit
memory/3872-10-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/4976-0-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download
memory/4976-5-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/4976-11-0x0000000000400000-0x000000000040E200-memory.dmp

Filesize
56KB

Download