9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f

General

Target
jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
Size 43KB
Sample260925-3sshsszaqa
SHA256 9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f
MD5 f6dac0467485f19dcd2cfdac5edda4fa
SHA1 1529de90c0d90d39033f621ba4c477e5229a0186
SHA512 e3b781e9f98797e53a929caa7206c7f3950e625b2c9274348d00e6d310ebdd4b47cbff0784cab700edd6349ecc6433766dfdac412d4a4dc85d5915d23347c198
SSDEEP 768:oPDtlpXxAZK9l59OD9dRfj7lojXuI5AQt:oP3AU9O9dxj7lAuc
TLSH
T117134D07A60D85F1E1EF0674745A9F3B9B6DA9381AA094E7CF73438698F02426C7970F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4752	isndntio.exe

Loads dropped DLL 2 IoCs

pid	Process
2016	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
4752	isndntio.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\isndntio = "C:\\Windows\\isndntio.exe"	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\isndntio.dll	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
File created	C:\Windows\SysWOW64\isndntio.dll	isndntio.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\isndntio.exe	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
File opened for modification	C:\Windows\isndntio.exe	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isndntio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2016	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
2016	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
4752	isndntio.exe
4752	isndntio.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2016	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
4752	isndntio.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3308	2016	jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe	56
PID 4752 wrote to memory of 3308	4752	isndntio.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3308
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2016

C:\Windows\isndntio.exe
C:\Windows\isndntio.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

isndntio.dll

Path C:\Windows\SysWOW64\isndntio.dll
Size 36KB
SHA256 fbd9f2a1df30b9535d8dc0f3d38b664ba21a8ad764a47ab8388b9a8c7ddb5149
MD5 1a02d2779873c985dacbe23aa7ee00ff
SHA1 e7b702adefd9056efa6685c86dbe674bf86aa4af
SHA512 a0c2b931da4c54b4e52d90051293e4f15be01ce772a02bc3ce146accb2deef2d8c1bfb0f3daef29e7e3533d38f88ea6cad8ebac81681fc31b10fa8e21fa816cb
SSDEEP 384:FC3w0TqK9l51u74OD9h71TTXfw1y7lojnnj5JfNkMr5YBfIt:wAZK9l59OD9dRfj7lojXuI5AQt
TLSH
T1C0F24D06920DC5F1E1AB1674B45A9F2B5B6DAC3858E09497DF73039A58F0342AC7970F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isndntio.exe

Path C:\Windows\isndntio.exe
Size 43KB
SHA256 9ea68ed96fd1be548254555462d0e9bee60528c8f637657fa79b74ee6e7bb75f
MD5 f6dac0467485f19dcd2cfdac5edda4fa
SHA1 1529de90c0d90d39033f621ba4c477e5229a0186
SHA512 e3b781e9f98797e53a929caa7206c7f3950e625b2c9274348d00e6d310ebdd4b47cbff0784cab700edd6349ecc6433766dfdac412d4a4dc85d5915d23347c198
SSDEEP 768:oPDtlpXxAZK9l59OD9dRfj7lojXuI5AQt:oP3AU9O9dxj7lAuc
TLSH
T117134D07A60D85F1E1EF0674745A9F3B9B6DA9381AA094E7CF73438698F02426C7970F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2016-7-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/2016-5-0x0000000000540000-0x0000000000541000-memory.dmp

Download

memory/3308-2-0x0000000002710000-0x0000000002711000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads