General
- Target eeb519eaefb64bc433463231d840bf14_JaffaCakes118
- Size 3.0MB
- Sample240921-ag2ccawdkj
- SHA256 ed41bd0246b8f3ff6ed065d29c2dd8507d106fb5186e0ceb0bebc6339e5375b8
Score
10/10
Malware Config
Targets
-
- Target eeb519eaefb64bc433463231d840bf14_JaffaCakes118
- Size 3.0MB
- SHA256 ed41bd0246b8f3ff6ed065d29c2dd8507d106fb5186e0ceb0bebc6339e5375b8
Score10/10-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Remote Service Session Hijacking: RDP Hijacking
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
-
Indicator Removal: Network Share Connection Removal
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
-
Modifies RDP port number used by Windows
-
Possible privilege escalation attempt
-
Server Software Component: Terminal Services DLL
-
Deletes itself
-
Loads dropped DLL
-
Modifies file permissions
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Server Software Component
1Terminal Services DLL
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
2File Deletion
1Network Share Connection Removal
1Modify Registry
1