893cea45e0aa5df170c19671d627efb327b17d4972b1997b553b3b05fe1c5918

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe
Size

60KB
MD5

be07d00c5dbb3a19b36faa2a16e9e989
SHA1

2dbd467d7d2d5c3df1ea82b0944729211b6cb6fe
SHA256

893cea45e0aa5df170c19671d627efb327b17d4972b1997b553b3b05fe1c5918
SHA512

0897bc0441db8a239cc9a9de9a3f79e1331f25d76b23ed376a8d838daa85f5f77b04d96d9e66baa2a8da9016e3d0cd1275bc31318a54d37fb804c0b230ba47fd
SSDEEP

1536:jZbQp5u398EESj+WnvkjizyqwYzq9Ouf3Exjab:NbO5jEEovkiiz3Cq

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\soaqgu.sys	be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe

Server Software Component: Terminal Services DLL 1 TTPs 6 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\soaqgu\Parameters\ServiceDll = "%SystemRoot%\\System32\\soaqgu.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\soaqgu\Parameters\ServiceDll = "%SystemRoot%\\System32\\soaqgu.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\soaqgu\Parameters\ServiceDll = "%SystemRoot%\\System32\\soaqgu.dll"	be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\soaqgu\Parameters\ServiceDll = "%SystemRoot%\\System32\\soaqgu.dll"	be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\soaqgu\Parameters\ServiceDll = "%SystemRoot%\\System32\\soaqgu.dll"	be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\soaqgu\Parameters\ServiceDll = "%SystemRoot%\\System32\\soaqgu.dll"	svchost.exe

Deletes itself 1 IoCs

pid	Process
1844	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1952	be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe
1844	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\soaqgu.dll	be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe

C:\Users\Admin\AppData\Local\Temp\be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\be07d00c5dbb3a19b36faa2a16e9e989_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1952

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k soaqgu
1⤵
- Server Software Component: Terminal Services DLL
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\soaqgu.dll

Filesize
76KB

MD5
9c8575069da2cea082e7ae7d5d0a027f

SHA1
98851b7e27d70255865988b6aa21296a842bdd27

SHA256
b5a76ea49601b1aaf4cf93cfced850caf8ca61588c554b3df7e14737804abf38

SHA512
a87e9c3465d61c69489fc41106c8c13b28bbb5b0ab6181630ba6026f635acc3983a9382994025b6f36114f3cef14e6d5e40c2f62bdc328695106906feacbc60a

Download Submit
memory/1952-0-0x0000000000400000-0x0000000000409412-memory.dmp

Filesize
37KB

Download
memory/1952-7-0x0000000000400000-0x0000000000409412-memory.dmp

Filesize
37KB

Download