1cc49db56fcb88eee08cc7e751417b096a5ff712a2dd986c7653b54a1fb6f553

General

Target

f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Size

139KB
MD5

f68272c674e8ccfc9af3045a95175c38
SHA1

33e2337de43f42a9ee3e21b6ef1553024dac99de
SHA256

1cc49db56fcb88eee08cc7e751417b096a5ff712a2dd986c7653b54a1fb6f553
SHA512

f242baf36f38822a81833b36a2de3b2b8338ae7c11268aa0705cf799a4cf6781bd5d733edfc4368a824115a1629d0c23915a282b6ce776a9cd557a1ba826334b
SSDEEP

3072:zH+Mcv5JXXieDEvy1W7rkD+bnAIhRjaNG:zHl0ndEqgkCAaRGQ

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe

Loads dropped DLL 45 IoCs

pid	Process
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
4832	svchost.exe
4832	svchost.exe
4832	svchost.exe
1668	svchost.exe
1668	svchost.exe
1668	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
1096	svchost.exe
1096	svchost.exe
1096	svchost.exe
1096	svchost.exe
1096	svchost.exe
1096	svchost.exe
368	svchost.exe
368	svchost.exe
368	svchost.exe
4848	svchost.exe
4848	svchost.exe
4848	svchost.exe
1968	svchost.exe
1968	svchost.exe
1968	svchost.exe
1968	svchost.exe
1968	svchost.exe
1968	svchost.exe
3600	svchost.exe
3600	svchost.exe
3600	svchost.exe
4872	svchost.exe
4872	svchost.exe
4872	svchost.exe
4908	svchost.exe
4908	svchost.exe
4908	svchost.exe
2056	svchost.exe
2056	svchost.exe
2056	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
2080	f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f68272c674e8ccfc9af3045a95175c38_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2080

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1612

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3960,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:1712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1668

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:540

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1096

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:368

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4848

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3600

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4908

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
139KB

MD5
e3af7dfd9cd3821618a6301f28cf8437

SHA1
f905921761181d3e93125e57a8bbbb85ddac3428

SHA256
170edb78f1f6e98e35a5e0418ca3b7e2f5ae4ce6f3568a8d2f542ca2786e2771

SHA512
1b5519f2aba7a8b253adecfdb958b2cdc6ea6dda8929776683e0c901044a4d6b354e3598c21a0cadcebb574d9e38795d64d7bdaca9581e5f843d7cf5c7ebb5ca

Download Submit
memory/368-46-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1096-41-0x0000000000F50000-0x0000000000F73000-memory.dmp

Filesize
140KB

Download
memory/1096-36-0x0000000000F50000-0x0000000000F73000-memory.dmp

Filesize
140KB

Download
memory/1096-39-0x0000000000F50000-0x0000000000F73000-memory.dmp

Filesize
140KB

Download
memory/1096-40-0x0000000000F50000-0x0000000000F73000-memory.dmp

Filesize
140KB

Download
memory/1668-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1968-63-0x0000000000F60000-0x0000000000F83000-memory.dmp

Filesize
140KB

Download
memory/1968-62-0x0000000000F60000-0x0000000000F83000-memory.dmp

Filesize
140KB

Download
memory/1968-61-0x0000000000F60000-0x0000000000F83000-memory.dmp

Filesize
140KB

Download
memory/2080-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2080-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4832-16-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4832-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4832-13-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing