92a1c788f8930f6dbfe20a980f644f2710501c520639d09f81afa5ff2cca9cff

General

Target

791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Size

88KB
MD5

791f79bd0d45d2e0034ca9ecfa6c2d78
SHA1

9c58f35a202257aa6e54d83b23b89d6d6a68b426
SHA256

92a1c788f8930f6dbfe20a980f644f2710501c520639d09f81afa5ff2cca9cff
SHA512

1a645a601e7f03a1ce9ed70bfe534f7e3d8265d7a93ae3895151479324ee00be83ea4d0a81d11379cbcdd62a4a639f33025c6271731db135d6e6a9bbeaefddb4
SSDEEP

1536:dtZHJGPKZi+unw3uzV1c/D6t5YppoNr9hTcOujjwGTr0aIiksSaV1K7ZNK:n3GCZi+u93SCNNr9hoOVGToadTutNK

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe

Loads dropped DLL 36 IoCs

pid	Process
3104	svchost.exe
3104	svchost.exe
3104	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
5108	svchost.exe
5108	svchost.exe
5108	svchost.exe
3240	svchost.exe
3240	svchost.exe
3240	svchost.exe
2260	svchost.exe
2260	svchost.exe
2260	svchost.exe
1596	svchost.exe
1596	svchost.exe
1596	svchost.exe
2124	svchost.exe
2124	svchost.exe
2124	svchost.exe
2776	svchost.exe
2776	svchost.exe
2776	svchost.exe
1012	svchost.exe
1012	svchost.exe
1012	svchost.exe
1968	svchost.exe
1968	svchost.exe
1968	svchost.exe
4688	svchost.exe
4688	svchost.exe
4688	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nla.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
468	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
468	791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\791f79bd0d45d2e0034ca9ecfa6c2d78_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:468

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3104

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1188

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2620

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5108

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3240

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1596

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2124

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2776

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
88KB

MD5
293f7952dab84125e3aa85985c53187c

SHA1
69cfa83aacccc838ec22d1b8894c8ec269726a4d

SHA256
6ab2a512b04b6a0deb229e033f533b7ecef500dcad44bc4796d25f982a9a22d4

SHA512
8bc2772ebdbdd574aea60fe74f9118d751ee95ba3584dddc93587e6f5e4e903513bb47ba93b2661c239b407e1349b9e315543df3769228374f49836f87f9b4c9

Download Submit
memory/468-0-0x0000000000410000-0x0000000000432000-memory.dmp

Filesize
136KB

Download
memory/468-25-0x0000000000410000-0x0000000000432000-memory.dmp

Filesize
136KB

Download
memory/1188-16-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/1188-15-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/1188-17-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/1596-56-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/1596-55-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/1968-81-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/1968-82-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2124-60-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2260-44-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2260-48-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2260-47-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2620-49-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2620-24-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2620-21-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2776-69-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/2776-70-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/3104-36-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/3104-9-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/3104-7-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/3104-8-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/3240-39-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/4688-88-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/5108-32-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download
memory/5108-31-0x0000000075050000-0x0000000075072000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing