1a4925090106b0cc32020b8d02cc70e9768c6256811016ab58d11368d784aecc

General

Target

327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe
Size

84KB
MD5

327cb749c3e46889fc68a9fe74bdfb4c
SHA1

ab9058e83cbd948fb45ffd163d76974b949cf5f6
SHA256

1a4925090106b0cc32020b8d02cc70e9768c6256811016ab58d11368d784aecc
SHA512

0cce4fea86a4c80736125750fcc0aac94a3708017fd3573e2f125ce924214227f1952b5d739350aac41f9d72e5b2015d7337c8a31aa7877b01c7d93af815ce8b
SSDEEP

1536:KXI/v86EFSqGlv69BwU9yiQ3CJNsCuVQf4doG/Ok:KXI/ESqGJ6oU9tQcA24doJk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
2500	rundll32.exe
2500	rundll32.exe
2500	rundll32.exe
2500	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kgohazijulu = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\mgnprv.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe
3028	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3028	2356	327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3028	2356	327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3028	2356	327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3028	2356	327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3028	2356	327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3028	2356	327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3028	2356	327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2500	3028	rundll32.exe	31
PID 3028 wrote to memory of 2500	3028	rundll32.exe	31
PID 3028 wrote to memory of 2500	3028	rundll32.exe	31
PID 3028 wrote to memory of 2500	3028	rundll32.exe	31
PID 3028 wrote to memory of 2500	3028	rundll32.exe	31
PID 3028 wrote to memory of 2500	3028	rundll32.exe	31
PID 3028 wrote to memory of 2500	3028	rundll32.exe	31

C:\Users\Admin\AppData\Local\Temp\327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\327cb749c3e46889fc68a9fe74bdfb4c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\mgnprv.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\mgnprv.dll",iep
    3⤵
    - Loads dropped DLL
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\mgnprv.dll

Filesize
84KB

MD5
99b4645083971cead19e113dd73b4150

SHA1
7ce7bfd115c36f3e3d8d7b7816b5c4e5b6ff0f10

SHA256
a378bb9c48b50c5ec4cc1c458895ee9abfd87083b5d90f1c857651199901e338

SHA512
0f5d41065cb630f9c428c8d10fb5b8235e5de823f1f3745ae9b13e0def65c42f9c41eabeaffb70b702fe8b6d09d030640b505722b269d57d89d913808dcd7c82

Download Submit
memory/2356-2-0x0000000001D30000-0x0000000001D70000-memory.dmp

Filesize
256KB

Download
memory/2356-1-0x0000000001D30000-0x0000000001D70000-memory.dmp

Filesize
256KB

Download
memory/2356-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2356-13-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2356-17-0x0000000001D30000-0x0000000001D70000-memory.dmp

Filesize
256KB

Download
memory/2356-18-0x0000000001D30000-0x0000000001D70000-memory.dmp

Filesize
256KB

Download
memory/2500-28-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/2500-33-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/2500-30-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2500-27-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/3028-12-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/3028-19-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/3028-14-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/3028-26-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/3028-29-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/3028-10-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/3028-11-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads