0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493

Resubmissions

31/07/2026, 13:22

260731-qmjmgsbc2610

19/10/2024, 10:36

241019-mnkdmatdnl7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c373c2116ab4a615e622f577e22e9be_JaffaCakes118.dll
Size 304KB
Sample241019-mnkdmatdnl
SHA256 0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493
MD5 5c373c2116ab4a615e622f577e22e9be
SHA1 ea940cc09b54b9ec060e65d9ccc3a00c3cb00921
SHA512 0d015fce2a7caa87f51b298f3dcce96875b3e6c710b9f9fd0b440a8b889c4f0e7fb5cf7112a4bef9c3d54d3c03e398df894b7ee2289c5539192ca02655311f59
SSDEEP 6144:Y5KVAtFaFoGI0fJtnnDeCXhc0pASzJBjo:Y5Ky7aGGVznD7XFLJBjo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1008	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderAutoUpdate = "regsvr32.exe /s \"C:\\ProgramData\\Software\\Microsoft\\Windows\\Defender\\AutoUpdate.dll\""	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderAutoUpdate = "regsvr32.exe /s \"C:\\ProgramData\\Software\\Microsoft\\Windows\\Defender\\AutoUpdate.dll\""	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3644	2720	regsvr32.exe	84
PID 2720 wrote to memory of 3644	2720	regsvr32.exe	84
PID 2720 wrote to memory of 3644	2720	regsvr32.exe	84
PID 3644 wrote to memory of 3784	3644	regsvr32.exe	85
PID 3644 wrote to memory of 3784	3644	regsvr32.exe	85
PID 3644 wrote to memory of 3784	3644	regsvr32.exe	85
PID 3644 wrote to memory of 2688	3644	regsvr32.exe	86
PID 3644 wrote to memory of 2688	3644	regsvr32.exe	86
PID 3644 wrote to memory of 2688	3644	regsvr32.exe	86
PID 3644 wrote to memory of 1008	3644	regsvr32.exe	87
PID 3644 wrote to memory of 1008	3644	regsvr32.exe	87
PID 3644 wrote to memory of 1008	3644	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c373c2116ab4a615e622f577e22e9be_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5c373c2116ab4a615e622f577e22e9be_JaffaCakes118.dll
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\ProgramData\temp\857D.tmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\ProgramData\temp\858D.tmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\ProgramData\Software\Microsoft\Windows\Defender\AutoUpdate.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdate.dll

Path C:\ProgramData\Software\Microsoft\Windows\Defender\AutoUpdate.dll
Size 304KB
SHA256 0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493
MD5 5c373c2116ab4a615e622f577e22e9be
SHA1 ea940cc09b54b9ec060e65d9ccc3a00c3cb00921
SHA512 0d015fce2a7caa87f51b298f3dcce96875b3e6c710b9f9fd0b440a8b889c4f0e7fb5cf7112a4bef9c3d54d3c03e398df894b7ee2289c5539192ca02655311f59
SSDEEP 6144:Y5KVAtFaFoGI0fJtnnDeCXhc0pASzJBjo:Y5Ky7aGGVznD7XFLJBjo
MD5 SHA1 SHA512 SSDEEP

Submit Download

857D.tmp.bat

Path C:\ProgramData\temp\857D.tmp.bat
Size 126B
SHA256 cd9c93153d22871f634c67a7ec72d36679f305365aa4d68ca7e2259de05cfb44
MD5 87aeeb4d6f4d9c4508a86332bf0a323c
SHA1 af45a2f9aa5ba4652a6bf055b6b14f5d67392306
SHA512 7d1cfc7ace5fd587abb3324c3a3c8a7e369c2ee59dc81388863b9d973c75c54b9ae3b1abeafd0910bbd3dc3ffba0d945ea4668964140a368d09f0b81ff6bfef5
MD5 SHA1 SHA512

Submit Download

858D.tmp.bat

Path C:\ProgramData\temp\858D.tmp.bat
Size 238B
SHA256 60b48573b88fe9e497de3a1da4e0c1cb3a653737f0d836d7db3e33e93e55f573
MD5 bf1b64c141e19794ad053fc2ba33d8ea
SHA1 139c0f50e8e14104c8e9266da3b9a1e09554f3f6
SHA512 9037d49ac5272d5a67cd93d04db50a9c103ae1e3ebd476abf1356de0088c567f9e26bf92f77bc57067ebb179da48810c9780f01e045588c9ff6ffa2ef6e6f43f
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads