8ad40127b256406070ebc5effac5186590b890d8cc79d1a923f0dd3c701b0490

General

Target

f9df718f7508506e9ebdda7a2ea5dd5c_JaffaCakes118.dll
Size

386KB
MD5

f9df718f7508506e9ebdda7a2ea5dd5c
SHA1

6a17c548ba8487e340d67dccb95b4b185cd470bd
SHA256

8ad40127b256406070ebc5effac5186590b890d8cc79d1a923f0dd3c701b0490
SHA512

1c2f1ba6973c2cf589e27ed0b1de18f3cfe1dedea681ea667ac71b351a4ee29c78395f3826341b67ce983f8c16838c7bc8f02fa402fa0cc0077aa7bf1e947421
SSDEEP

6144:cZKxNfFKd8zaxQaEyoIXNxeoSnrBH83BAUxwotPkJSGHILCSNiUl:BfYd8z1a0oeoclH8VKJ/HIm/a

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\AppData\\Roaming\\isass.exe \""	reg.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2860	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2928	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2928	rundll32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2928	2716	rundll32.exe	29
PID 2716 wrote to memory of 2928	2716	rundll32.exe	29
PID 2716 wrote to memory of 2928	2716	rundll32.exe	29
PID 2716 wrote to memory of 2928	2716	rundll32.exe	29
PID 2716 wrote to memory of 2928	2716	rundll32.exe	29
PID 2716 wrote to memory of 2928	2716	rundll32.exe	29
PID 2716 wrote to memory of 2928	2716	rundll32.exe	29
PID 2928 wrote to memory of 2332	2928	rundll32.exe	30
PID 2928 wrote to memory of 2332	2928	rundll32.exe	30
PID 2928 wrote to memory of 2332	2928	rundll32.exe	30
PID 2928 wrote to memory of 2332	2928	rundll32.exe	30
PID 2928 wrote to memory of 2332	2928	rundll32.exe	30
PID 2928 wrote to memory of 2332	2928	rundll32.exe	30
PID 2928 wrote to memory of 2332	2928	rundll32.exe	30
PID 2332 wrote to memory of 2784	2332	cmd.exe	32
PID 2332 wrote to memory of 2784	2332	cmd.exe	32
PID 2332 wrote to memory of 2784	2332	cmd.exe	32
PID 2332 wrote to memory of 2784	2332	cmd.exe	32
PID 2784 wrote to memory of 2860	2784	cmd.exe	33
PID 2784 wrote to memory of 2860	2784	cmd.exe	33
PID 2784 wrote to memory of 2860	2784	cmd.exe	33
PID 2784 wrote to memory of 2860	2784	cmd.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9df718f7508506e9ebdda7a2ea5dd5c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9df718f7508506e9ebdda7a2ea5dd5c_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c setup.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V lsass /D "\"C:\Users\Admin\AppData\Roaming\isass.exe \"" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V lsass /D "\"C:\Users\Admin\AppData\Roaming\isass.exe \"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\setup.bat

Filesize
145B

MD5
09b39ac5213820d74ff5b2e309021086

SHA1
cbc786e7c806db7f6e9bd02fdf18cb7c98ca512e

SHA256
4ebe83a1fe4896fd9481fe8d003e3436fb58410b3016c9dd715c57348c981b2d

SHA512
c30d5165f3c21a31a37b128e499f788265d64227b94107d95ae1f0fdc737db143e5094cf75dda13cbedbab8e06a88e5d9ecae04fc134f39350a4e0efe860a44f

Download Submit
memory/2928-0-0x0000000000230000-0x0000000000295000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads