ca12969d9f3d561bbd293b4be403d5cece51502057d77543c07ee5c7a2c529d1

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
Size

71KB
MD5

640862354aae3af139b9a5e7f79c3a43
SHA1

b9e3a7f6a04714480e9677d78e22a801a405938b
SHA256

ca12969d9f3d561bbd293b4be403d5cece51502057d77543c07ee5c7a2c529d1
SHA512

fc3a8979465c3e7437dfbeadd477e4d0ca884a84c957a2b2bd2442adae37af928b6d1baebd212b4254a02b3849d140cc574341de8b7a50b6ef88533775e11e09
SSDEEP

1536:MJQleeZZ+b9mWIGpNhwqyoz3DakRC0Rug:2ueerq9xzhwXK3DJRC0R/

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\reritq\Parameters\ServiceDll = "%SystemRoot%\\System32\\ourhxb.dll"	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\reritq\Parameters\ServiceDll = "%SystemRoot%\\System32\\ourhxb.dll"	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\reritq\Parameters\ServiceDll = "%SystemRoot%\\System32\\ourhxb.dll"	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
4616	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
856	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
4616	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0004b25d.001	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ourhxb.dll	640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\640862354aae3af139b9a5e7f79c3a43_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
PID:856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k reritq
1⤵
- Deletes itself
- Loads dropped DLL
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ourhxb.dll

Filesize
105KB

MD5
95b21a9fd51d129901a712c70e3a37d2

SHA1
1124171566b8acd6ef01b4e4642f21d367648baa

SHA256
2bb553474c85f00e43da28b7d25e300dbf5cf90b396d6f1d6d2fa612db91f859

SHA512
2567d3b02f4b957f2a15844bcb668787ed3bd73305e241fe4093c398848b80292059415fea2fc46679ba145d1e4efe5c12f80cb264d342dd8814754c29111e8e

Download Submit
memory/856-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/856-6-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/856-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4616-9-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4616-11-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download