fa6287245f6cbc0b3205e9d73884e997ae9b50a356fa87e6ec274a35b628a64f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 05:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
Size

208KB
MD5

bdf59ce563f6c30c884c996ee4b53e72
SHA1

0adfd312147acba541f484c4a8b6950c565e8476
SHA256

fa6287245f6cbc0b3205e9d73884e997ae9b50a356fa87e6ec274a35b628a64f
SHA512

e0e7a94438d782ccc7f3ed23c84a00276d233c224f3034d6cebf46270dea448fee1c9f895959a63d6e2b69bda3bafc9ab5d7312c61ff151ea8d8b87156879bec
SSDEEP

6144:V1bAqtWiZLN2CfI6XZ6A82j1UKr1OeA+E3upkjf3s5alvyel:V106WiZLNZTZb8uN5E+E13FPl

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BRC_Services\Parameters\ServiceDll = "C:\\Windows\\system32\\brc_Server.dll"	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3216	svchost.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\brc_Server.dat	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\brc_Server.exe	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\brc_Server.exe	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\brc_Server.dll	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\brc_Server.dat	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
3032	bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bdf59ce563f6c30c884c996ee4b53e72_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3032

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\brc_Server.dat

Filesize
218B

MD5
fdcecb37e6cee936de73b9458400e698

SHA1
c52720965497743a76b1f151bc4c687a027f85ae

SHA256
8b60d2ad15114d8566b810925e7c43ea5f3e6e8a62c742ed8a36d7666f9982d1

SHA512
3068a8a32e76569854064c3126062e86d901127f1627faf66391c4a9a83a37297686e2e656a3634ef0911c1bb3ecd5b698353a361898989fda4192e5fb872758

Download Submit
\??\c:\windows\SysWOW64\brc_server.dll

Filesize
331KB

MD5
5a5cda772e96eb73b696a6e3686da8ed

SHA1
e7cd6f1f60e5ce4d22ba63e011b31c47d49a7689

SHA256
2725c3303a00562320e75f8fc24ff4b5bacc0300483dcb99ab48f318ba6b02a5

SHA512
aeec92a2c10c5fe8521a6e294f9bf3a8bd33d76a1a7d8eca5868c671632787a5e21bd2bb186382f3dc4ce920c42bdb0a433fd468ba27051517b769013e4aa098

Download Submit
memory/3032-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3032-1-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3032-2-0x0000000000540000-0x0000000000542000-memory.dmp

Filesize
8KB

Download
memory/3032-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3216-9-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3216-10-0x00000000020A0000-0x00000000020A2000-memory.dmp

Filesize
8KB

Download
memory/3216-12-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3216-14-0x00000000020A0000-0x00000000020A2000-memory.dmp

Filesize
8KB

Download