ece0f89cad1f72ac16baf12bb983d0dd905d9b38d4b6b83649c93b56f73cc720

General

Target

465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe
Size

217KB
MD5

465a7c96ab506e8b1b8b206453f70c77
SHA1

1b08300d756c31c0e4f29599d80467dd962a3edc
SHA256

ece0f89cad1f72ac16baf12bb983d0dd905d9b38d4b6b83649c93b56f73cc720
SHA512

f6df7128ec99e2f5850c6eeab70fc67aa80c0b2ea130cb5429712008ea5d4bebd76deed12a9085cb759817b9739b1837844ca67341a02507746f7c8b97c8b7a4
SSDEEP

6144:vOJfFOCTyGmvaRu39kXIVw2xQkkqh5eYqGGLTsfO7:mJcCTyqLXxkkOHqBsO7

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Metropolis = "rundll32.exe C:\\Windows\\system32\\sshnas21.dll,GetHandle"	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe
2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe
2124	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2124	2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2124	2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2124	2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2124	2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2124	2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2124	2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2124	2528	465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\465a7c96ab506e8b1b8b206453f70c77_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sshnas21.dll

Filesize
180KB

MD5
cc832824a9f57e5e9e30e5e2e29ce2e1

SHA1
074360b6744e6014a10c769dbb7e270940f18fe6

SHA256
751222f25065c4a5835e2bf4a4a22d74e7ef1701592b10ffdc8889fe796d8853

SHA512
1f91212d86e23b66b2531d4b53c5d8ca49e83a8ff866cd21ef2e28f2c3815dc61ebc085b9d9644b124b3228b2c94037bbf1f151dcc91a44fe157388013dd85fa

Download Submit
memory/2124-23-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-18-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-45-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-43-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-41-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-16-0x00000000001E0000-0x0000000000208000-memory.dmp

Filesize
160KB

Download
memory/2124-17-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-25-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-39-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-20-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-37-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-21-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-19-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/2124-27-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-29-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-31-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-33-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2124-35-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2528-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2528-0-0x0000000000230000-0x0000000000255000-memory.dmp

Filesize
148KB

Download
memory/2528-9-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2528-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2528-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads