748dc183e83381d023ded644e4a51a73e944a44b6646671c28548d23edc4393d

General

Target

c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe
Size

297KB
MD5

c1b95fdae5f875d52e92f08d28cc72b5
SHA1

c179b22e26fef6b2b6cc2f15db018033931d09f9
SHA256

748dc183e83381d023ded644e4a51a73e944a44b6646671c28548d23edc4393d
SHA512

39275a27eaf05f16412c49a62080af699bc799cafd392c487eb58bbe86c762c5dcc63d58e32e6237c6891ebca67455adfd703d14fa3ed6f7389dbf50fd91a769
SSDEEP

3072:X+SnAh4leg3EXMaKcSs3QOzB0eGwAPWpy39A4MLw472vkqNG:pAh4leorXcSsgOeeGwAB36B3uN

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fmtlp = "{5cd37d4b-d45b-29a0-e56c-d45bf5c32cc1}"	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
5056	rundll32.exe
5056	rundll32.exe
5056	rundll32.exe
5056	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gpcugnaw.dat	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\szgyc.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\szgyc.dll	rundll32.exe
File created	C:\Windows\SysWOW64\elsko.dll	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5cd37d4b-d45b-29a0-e56c-d45bf5c32cc1}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5cd37d4b-d45b-29a0-e56c-d45bf5c32cc1}\InprocServer32\ = "C:\\Windows\\SysWow64\\ahogk.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5cd37d4b-d45b-29a0-e56c-d45bf5c32cc1}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5cd37d4b-d45b-29a0-e56c-d45bf5c32cc1}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5cd37d4b-d45b-29a0-e56c-d45bf5c32cc1}\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe
2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe
2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe
2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 5056	2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe	90
PID 2924 wrote to memory of 5056	2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe	90
PID 2924 wrote to memory of 5056	2924	c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1b95fdae5f875d52e92f08d28cc72b5_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\gpcugnaw.dat" ajhatv
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\elsko.dll

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Windows\SysWOW64\gpcugnaw.dat

Filesize
237KB

MD5
7711564992f682d87ef183721a7724d6

SHA1
d44a0e04b1cb97d9de170814731351c9f7deca60

SHA256
febaf14a7d85fe1ea7c545b674b6c658bd6595e6da5dd0ae1dcff18e605089dd

SHA512
7855eb3ed077905c72d071ad2c65651ecfb91e119abec8240582bfa6766c7c55f2137709386201e87397c902bbdf52d23f2b3595f2816819f99bdd550079f894

Download Submit
C:\Windows\SysWOW64\szgyc.dll

Filesize
478KB

MD5
e99416267b61f52fa5ab994019efd359

SHA1
86d31eae707db7fe51d2556394fcf0e8e9f6b0fd

SHA256
768c286674371564b5e6095edb56e0a4231f341be895da69cfccca5160029774

SHA512
0a1c7579a9c787c2c1bef35f0660e72e74b42824e14ebea63b87ed25ddaf107e3746567bb431cab41a2f6719fad2c22d96e0715a1fe085d75805d7d66f7f05ae

Download Submit
memory/2924-22-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/5056-4-0x0000000002210000-0x0000000002255000-memory.dmp

Filesize
276KB

Download
memory/5056-6-0x0000000002211000-0x0000000002219000-memory.dmp

Filesize
32KB

Download
memory/5056-13-0x0000000002210000-0x0000000002255000-memory.dmp

Filesize
276KB

Download
memory/5056-18-0x0000000002210000-0x0000000002255000-memory.dmp

Filesize
276KB

Download
memory/5056-21-0x0000000002210000-0x0000000002255000-memory.dmp

Filesize
276KB

Download
memory/5056-19-0x0000000002210000-0x0000000002255000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads