be110e097917d3533004447dec2821fa461fbb22a908e6d591a5fd45565bfa25

General

Target

53bd0e6557bdd9596dfcf2a2490f9167_JaffaCakes118.exe
Size

92KB
MD5

53bd0e6557bdd9596dfcf2a2490f9167
SHA1

c52af0d10941bb9348f994d9614972f105dd9716
SHA256

be110e097917d3533004447dec2821fa461fbb22a908e6d591a5fd45565bfa25
SHA512

e078b976dbd7905aeafbde5c98dc2e7b336621905706e18caf6f1bea5a889e6dffaf33619aafd8b0f6bdf65da12b65d876c6030a3fdca30a8d0361cd76a6325c
SSDEEP

1536:hRLFB/HeWt/Y/6WpKdVikluoqZVUIkDrQS8DiulgrL4Fmtjff:hRLFB/x/NnR3qfdkPMikdFAjff

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1932	rundll32.exe
4748	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ukeneve = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\NHRNCZ10.dll\",Startup"	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53bd0e6557bdd9596dfcf2a2490f9167_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe
1932	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1932	3848	53bd0e6557bdd9596dfcf2a2490f9167_JaffaCakes118.exe	84
PID 3848 wrote to memory of 1932	3848	53bd0e6557bdd9596dfcf2a2490f9167_JaffaCakes118.exe	84
PID 3848 wrote to memory of 1932	3848	53bd0e6557bdd9596dfcf2a2490f9167_JaffaCakes118.exe	84
PID 1932 wrote to memory of 4748	1932	rundll32.exe	103
PID 1932 wrote to memory of 4748	1932	rundll32.exe	103
PID 1932 wrote to memory of 4748	1932	rundll32.exe	103

C:\Users\Admin\AppData\Local\Temp\53bd0e6557bdd9596dfcf2a2490f9167_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\53bd0e6557bdd9596dfcf2a2490f9167_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\NHRNCZ10.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\NHRNCZ10.dll",iep
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\NHRNCZ10.dll

Filesize
92KB

MD5
09659bc0a4b1784a3a4952575b5b67e0

SHA1
43dfcf489acadc8ded6c8b3be3ace2dd4e69f4a2

SHA256
0ebe273f84484099d3c6bb0ea8004304a7f237143ec85654110020f5cab47717

SHA512
c2905845e2757c8cbca3ae7b8b13a6dbd4ad58598bd465ae8577604c862c57dd77659d92f590bbb3a92af1bfe22a13e8478eb7cfe28febc1205fcc97eab1fd1d

Download Submit
memory/1932-13-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download
memory/1932-15-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1932-12-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download
memory/1932-7-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1932-8-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download
memory/1932-9-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download
memory/1932-26-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1932-20-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/3848-0-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/3848-2-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/3848-11-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/3848-14-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/3848-1-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/3848-10-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/4748-27-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4748-24-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Filesize
64KB

Download
memory/4748-25-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Filesize
64KB

Download
memory/4748-21-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Filesize
64KB

Download
memory/4748-22-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads