ca12969d9f3d561bbd293b4be403d5cece51502057d77543c07ee5c7a2c529d1

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
Size

71KB
MD5

640862354aae3af139b9a5e7f79c3a43
SHA1

b9e3a7f6a04714480e9677d78e22a801a405938b
SHA256

ca12969d9f3d561bbd293b4be403d5cece51502057d77543c07ee5c7a2c529d1
SHA512

fc3a8979465c3e7437dfbeadd477e4d0ca884a84c957a2b2bd2442adae37af928b6d1baebd212b4254a02b3849d140cc574341de8b7a50b6ef88533775e11e09
SSDEEP

1536:MJQleeZZ+b9mWIGpNhwqyoz3DakRC0Rug:2ueerq9xzhwXK3DJRC0R/

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\reritq\Parameters\ServiceDll = "%SystemRoot%\\System32\\oyumzf.dll"	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\reritq\Parameters\ServiceDll = "%SystemRoot%\\System32\\oyumzf.dll"	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\reritq\Parameters\ServiceDll = "%SystemRoot%\\System32\\oyumzf.dll"	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1664	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
3012	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
1664	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0004b25d.001	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oyumzf.dll	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
PID:3012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k reritq
1⤵
- Deletes itself
- Loads dropped DLL
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\oyumzf.dll

Filesize
105KB

MD5
12aac8db0c6b1b3a3e05b6df8686654e

SHA1
325a0125cb83b0102b954912e8b0bb7839bb892f

SHA256
2028e16e02f64a534cc169a2bdd7560748d1a56285d2c8429aae0d43129dd6d6

SHA512
a01d9afccd52a81494b37ae9ea98a8b3844a7ecb08fc4f7cda409664f5fe6996c7bebaa22ff86d0b311b5ff3f67b7ed8df7dc5763311b04a069d9f6d37420715

Download Submit
memory/1664-9-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3012-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3012-5-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3012-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download