ec617339d68bab35602a04c1b89a3230e1e29507ad79c38e2627274a50d821ea

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe
Size

633KB
MD5

96e24ee12c6696bd23488ede6b155750
SHA1

53463b91abc01a9e2d47dba3758519707b72dda5
SHA256

ec617339d68bab35602a04c1b89a3230e1e29507ad79c38e2627274a50d821ea
SHA512

dd4d5cc9384540f3312260f574e9997b1e25efcbba74c8dd7d6a996d530985f4769a24e8fc198831afac290fc6d18ebbfb3b42f2d6c562b737f85de42bb47bbd
SSDEEP

12288:rvxeO/bMdpnct2a4BwHdp5wLe0WXlAoJ3cdWIIHuIt:bxbAct2aows8XJMdW2

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	2112	rundll32.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 14 IoCs

pid	Process
592	rundll32.exe
592	rundll32.exe
592	rundll32.exe
592	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2112	rundll32.exe
2112	rundll32.exe
2112	rundll32.exe
2112	rundll32.exe
2112	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mapirgwiz.dll_xserve = "rundll32.exe \"C:\\Windows\\SysWOW64\\mapirgwiz.dll\",xserve"	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mapirgwiz.dll	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe
2984	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 592	1592	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe	29
PID 1592 wrote to memory of 592	1592	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe	29
PID 1592 wrote to memory of 592	1592	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe	29
PID 1592 wrote to memory of 592	1592	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe	29
PID 1592 wrote to memory of 592	1592	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe	29
PID 1592 wrote to memory of 592	1592	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe	29
PID 1592 wrote to memory of 592	1592	96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe	29
PID 592 wrote to memory of 2984	592	rundll32.exe	30
PID 592 wrote to memory of 2984	592	rundll32.exe	30
PID 592 wrote to memory of 2984	592	rundll32.exe	30
PID 592 wrote to memory of 2984	592	rundll32.exe	30
PID 592 wrote to memory of 2984	592	rundll32.exe	30
PID 592 wrote to memory of 2984	592	rundll32.exe	30
PID 592 wrote to memory of 2984	592	rundll32.exe	30
PID 592 wrote to memory of 2112	592	rundll32.exe	31
PID 592 wrote to memory of 2112	592	rundll32.exe	31
PID 592 wrote to memory of 2112	592	rundll32.exe	31
PID 592 wrote to memory of 2112	592	rundll32.exe	31
PID 592 wrote to memory of 2112	592	rundll32.exe	31
PID 592 wrote to memory of 2112	592	rundll32.exe	31
PID 592 wrote to memory of 2112	592	rundll32.exe	31

C:\Users\Admin\AppData\Local\Temp\96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96e24ee12c6696bd23488ede6b155750_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\mapirgwiz.dll",install
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\mapirgwiz.dll",watch
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2984
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\mapirgwiz.dll",xserve
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\mapirgwiz.dll

Filesize
501KB

MD5
f3ee6ce37abb2bd3632b914c5b094705

SHA1
04bd66de025c451842daf4712b24f26f4c4ca5cd

SHA256
e1499cf0fcf398240c92aa43dc7ad3c77d655980d16e1e2bd73dee5b5a7f0c9f

SHA512
91e324f77d8504fae0e815803d2eee2f412bd62067ad72eb47bbd312e9dd6714d8515656662c886b75d3e345ac201db97b72880489f17dcebb9b611af3a973ec

Download Submit
memory/592-8-0x00000000742C0000-0x00000000743C7000-memory.dmp

Filesize
1.0MB

Download
memory/1592-0-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1592-1-0x00000000002C0000-0x00000000003C0000-memory.dmp

Filesize
1024KB

Download
memory/1592-37-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2112-34-0x0000000002000000-0x0000000002107000-memory.dmp

Filesize
1.0MB

Download
memory/2112-43-0x00000000742C0000-0x00000000743C7000-memory.dmp

Filesize
1.0MB

Download
memory/2112-44-0x0000000002000000-0x0000000002107000-memory.dmp

Filesize
1.0MB

Download
memory/2984-21-0x0000000002160000-0x0000000002267000-memory.dmp

Filesize
1.0MB

Download
memory/2984-24-0x0000000002270000-0x0000000002370000-memory.dmp

Filesize
1024KB

Download
memory/2984-41-0x00000000742C0000-0x00000000743C7000-memory.dmp

Filesize
1.0MB

Download
memory/2984-42-0x0000000002160000-0x0000000002267000-memory.dmp

Filesize
1.0MB

Download
memory/2984-49-0x0000000002270000-0x0000000002370000-memory.dmp

Filesize
1024KB

Download