65d3a7c6a1e5be10b82d04551e32a6042caf800f262f49544a4b4771e5e3a989

General

Target

44e3bd972337842562352af27a0789f2_JaffaCakes118.exe
Size

92KB
MD5

44e3bd972337842562352af27a0789f2
SHA1

920c7bb8b63ef1db2654398b31532157708774d3
SHA256

65d3a7c6a1e5be10b82d04551e32a6042caf800f262f49544a4b4771e5e3a989
SHA512

560d86cc12f55c313a145fb951d527dcb26477c7a45b485930e2168ca2da0e729974c286398e17e0cf1005556df42293fb422324205ba663436c55ff6f21ee62
SSDEEP

1536:hmPURyl7jCtfA6VuMVUOJnqQ5JgF7YEQmgo59ZODChKlRMPKlg2j9oH78:hQUR86tfA6VvVUop5CjI82DChKlyy2b8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe
2804	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qmadusefubemo = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\guxoxit.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe
2188	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2188	2412	44e3bd972337842562352af27a0789f2_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2188	2412	44e3bd972337842562352af27a0789f2_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2188	2412	44e3bd972337842562352af27a0789f2_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2188	2412	44e3bd972337842562352af27a0789f2_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2188	2412	44e3bd972337842562352af27a0789f2_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2188	2412	44e3bd972337842562352af27a0789f2_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2188	2412	44e3bd972337842562352af27a0789f2_JaffaCakes118.exe	30
PID 2188 wrote to memory of 2804	2188	rundll32.exe	32
PID 2188 wrote to memory of 2804	2188	rundll32.exe	32
PID 2188 wrote to memory of 2804	2188	rundll32.exe	32
PID 2188 wrote to memory of 2804	2188	rundll32.exe	32
PID 2188 wrote to memory of 2804	2188	rundll32.exe	32
PID 2188 wrote to memory of 2804	2188	rundll32.exe	32
PID 2188 wrote to memory of 2804	2188	rundll32.exe	32

C:\Users\Admin\AppData\Local\Temp\44e3bd972337842562352af27a0789f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44e3bd972337842562352af27a0789f2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\guxoxit.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\guxoxit.dll",iep
    3⤵
    - Loads dropped DLL
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\guxoxit.dll

Filesize
92KB

MD5
ec1ee86206290cfba1f1d75befe2c87d

SHA1
f3adcba6e33a3cc2b7b3f5848c89784d66f97106

SHA256
9750af89a7e85500914ef34871f1f7bdb2fddacf3eb7031e5f71fd0c9a855a38

SHA512
aa249f9038f7d99ea981b6b6f8cf7f10a6e1dfac64c844bfc184d458bbd6f42ea45cb403477ea62afe8c738c8923fa73509fc3cf2db9901026228f057631676b

Download Submit
memory/2188-14-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2188-19-0x00000000003A0000-0x00000000003E0000-memory.dmp

Filesize
256KB

Download
memory/2188-29-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2188-10-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2188-12-0x00000000003A0000-0x00000000003E0000-memory.dmp

Filesize
256KB

Download
memory/2188-11-0x00000000003A0000-0x00000000003E0000-memory.dmp

Filesize
256KB

Download
memory/2188-26-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2412-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2412-4-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/2412-17-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/2412-18-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/2412-13-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2412-3-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/2804-27-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download
memory/2804-28-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download
memory/2804-30-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2804-33-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download
memory/2804-34-0x0000000002A80000-0x0000000002AC0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads