9f7e4792db4b31f0ca10f45f4ab8464454f27aea61543b420130bf96c494da5d

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
Size

231KB
MD5

d2fa4e174ff131436979732faed742f3
SHA1

dbed2056a723f80f2fcdc5616679e3cb37f372c5
SHA256

9f7e4792db4b31f0ca10f45f4ab8464454f27aea61543b420130bf96c494da5d
SHA512

d9ce9d4dc39aa6844caaab7171f506fecfb98fd15381a093b5847c121d54a6ff7f2ed4b89199148763704b9decf1ae125454ea92dfeb6c34d913ed31c89c225f
SSDEEP

6144:sF+nAqM1SSesHe8DE8Iq0vROklweCp4a+8aX:o+nAR1dHe8DjYspzaX

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Svchosts \Parameters\ServiceDll = "C:\\Windows\\system32\\RSbackup.dll "	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
4620	svchost.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\RSbackup.dll	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\perfcon016.dat	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\perfcon016.dat	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
4496	d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2fa4e174ff131436979732faed742f3_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\perfcon016.dat

Filesize
200B

MD5
21a46869bab249d7f06ae4c1870c9189

SHA1
3a910137fe95edaf0703cfa80e012e89b84f4190

SHA256
d1718a2e16bef349538f6f34ff1ed1e44d5267aa9906a6a2da1f5d92d6fb43f9

SHA512
11718328d96886842a373ea548bd4645bee3840b21c98e0696dfad9abfbaaaafd577c79766c53b7c93b56bfe0ed345e4c79027e1a4e0906b1b8e785843f280fa

Download Submit
\??\c:\windows\SysWOW64\rsbackup.dll

Filesize
480KB

MD5
9e6d2603b11f0e270e6b1a36ba404eff

SHA1
36d9100c74a41457a87229a439345a57de658b8b

SHA256
0bbfc429f0ee1025c546cf15cdd04a6205869b0f04538fd824e88f3e73eb2a7f

SHA512
5b57be4399817021b7049ed53120f53edd28b0b649018b4ef1286c3775e185f9cb40310d958930c49973e14f29f4347fd622db29ca3940780f287818326faee4

Download Submit
memory/4496-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4496-1-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/4496-2-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4496-7-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4620-9-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4620-8-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4620-11-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4620-12-0x00000000019F0000-0x00000000019F1000-memory.dmp

Filesize
4KB

Download