dbeed2ecd1d1c86e5d27184aee98ff18deac5e7e2d1844e5dcb0623a757c8b1d

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

565790850645ee6840c37522734a17ec_JaffaCakes118.exe
Size

63KB
MD5

565790850645ee6840c37522734a17ec
SHA1

7cf22920946acea4e2ee9bd0d4c938b0938398cf
SHA256

dbeed2ecd1d1c86e5d27184aee98ff18deac5e7e2d1844e5dcb0623a757c8b1d
SHA512

8dacbe8c487ce4f53208d735ff49b06a0caff4e1fe533f4b3f652b7900ce2c8474d1dc0e5167d2a08ec38b50708cfa7ee5ac930da9784b8115a67a7536a45ff0
SSDEEP

1536:2vh/qLphPixZ+60+EmVDLH4zaaaEIE9xEda18m3H+:+hyMxZU+LH4zadxC/3H+

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\dzadsa.SYS	565790850645ee6840c37522734a17ec_JaffaCakes118.exe

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\htcthf\Parameters\ServiceDll = "%SystemRoot%\\System32\\dzadsa.dll"	565790850645ee6840c37522734a17ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\htcthf\Parameters\ServiceDll = "%SystemRoot%\\System32\\dzadsa.dll"	565790850645ee6840c37522734a17ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\htcthf\Parameters\ServiceDll = "%SystemRoot%\\System32\\dzadsa.dll"	565790850645ee6840c37522734a17ec_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2752	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2088	565790850645ee6840c37522734a17ec_JaffaCakes118.exe
2752	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\50fcb.log	565790850645ee6840c37522734a17ec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dzadsa.dll	565790850645ee6840c37522734a17ec_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	565790850645ee6840c37522734a17ec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2752	svchost.exe
2752	svchost.exe
2752	svchost.exe

C:\Users\Admin\AppData\Local\Temp\565790850645ee6840c37522734a17ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\565790850645ee6840c37522734a17ec_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k htcthf
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\dzadsa.dll

Filesize
90KB

MD5
a1730cd1e2c4d526d1a99855191d6b47

SHA1
407b7efa811665574049e5afa9afda336c4c42b3

SHA256
5a027352608b5ea03681aaec21ea37e7a9c7e818244e46e9e1910fcc2b62d5f0

SHA512
53832d5125a087c9822788d7fdc0bce009df127801814086e01fdc8b7622292e8cbdf3805fe48554223999cd258963db1093523fce4026f1790dbc6c4fb52037

Download Submit