ad03bc735021540f47db950e92aa8ba5502e2b0316326b63ac0d04788980b2a1

General

Target
jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe
Size 32KB
Sample260919-flleksbe49
SHA256 ad03bc735021540f47db950e92aa8ba5502e2b0316326b63ac0d04788980b2a1
MD5 6a5adcef2a94cdf8cc453f15b3f282d1
SHA1 68228f768d8cc6df3095715d65206efbf11e6af5
SHA512 dcfdb08be025d33cb164a06e2624894d658cce065681aeedfff61ded8a9d8ea1972bf7e904c8ef36f10600d6d150debb894b494066557edb272df650f0f79144
SSDEEP 384:RNJU2SAmx/FPy4ivenJ1P9a0Jr7nyeX56QifezVSmg:fJ7STvSgNDHyg56QifIlg
TLSH
T188E28E4E69A3647BF0038D76C7EA45DA5FFD6C573A63292FCB00610628F0294D491BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\a.bat	WinHttp.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 4964	4796	WinHttp.exe	91
PID 1224 set thread context of 4604	1224	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	93

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1452	cmd.exe
4332	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4016	4604	WerFault.exe	93
3052	4964	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHttp.exe

Runs .reg file with regedit 1 IoCs

pid	Process
5072	regedit.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1224	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4604	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 5072	1224	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	85
PID 4796 wrote to memory of 4964	4796	WinHttp.exe	91
PID 4796 wrote to memory of 4964	4796	WinHttp.exe	91
PID 1224 wrote to memory of 4604	1224	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	93
PID 1224 wrote to memory of 4604	1224	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	93
PID 4796 wrote to memory of 1452	4796	WinHttp.exe	94
PID 1224 wrote to memory of 4332	1224	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:5072
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:4604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 12
    3⤵
    - Program crash
    PID:4016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c a.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4332

C:\Users\Admin\AppData\Local\WinHttp.exe
C:\Users\Admin\AppData\Local\WinHttp.exe
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 12
    3⤵
    - Program crash
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c a.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4604 -ip 4604
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4964 -ip 4964
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.bat

Path C:\Users\Admin\AppData\Local\Temp\a.bat
Size 1024B
SHA256 403434524aa643d010abde67414dcfadd33773e374d193a663a45b68528af06f
MD5 2d10dd235c538ea1b019ae05e89d812c
SHA1 815a72042573a992935c75f159b0fa291ccc49a0
SHA512 0cbf14c0f8590ec20db30760cce6f61dcc1ffd53ab67d86c48f8daea484aaff341bf77ea50a99f2b577933db4901d820f5c0925df85f808492bac6d0ab10333d
TLSH
T16511021284D68B69CC08E83B4EB6A18DC0B618993E993A406611889E629240DF8DB602
MD5 SHA1 SHA512 TLSH

Submit Download

~dfds3.reg

Path C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
Size 166B
SHA256 767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
MD5 f44153ef26be29552cf320325ad8b72e
SHA1 74ac72ba2ff0f871e59b11c95ad707372662370c
SHA512 1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
TLSH
T100C08051D811B331F9D0B50446155992E7F3435D3DEB5740404495C569D128EC23D0F7
MD5 SHA1 SHA512 TLSH

Submit Download

WinHttp.exe.tmp1

Path C:\Users\Admin\AppData\Local\WinHttp.exe.tmp1
Size 32KB
SHA256 696c8f29b28ebb74b996689f60bc95c47abfbb358adefa061f654d467e39c95e
MD5 d2d4d9e40f5c063fe06a25eb3e5cc4a5
SHA1 0b3d1fed61c3814bcce79320f576e3a5f3506d30
SHA512 77388f49e4aa1ecbb249fa21eacde4714f18b900f53646755b0e487431ca580ccaeb5aa9a74ed9ef36b4a01c1a3f43db6c0a9461d2a3b658f31a285c0115fce2
SSDEEP 384:RNf30bYU6t73x/FPy4ivent1P9a0Jr7nyeX56QifezVSmg:TfVht73vSgpDHyg56QifIlg
TLSH
T1ECE28D0E5DA3546BF0128D75C7FA40DA4FBCAC573AA7792FCB40A10628B4298C491BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHttp.exe.tmp1

Path C:\Users\Admin\AppData\Local\WinHttp.exe.tmp1
Size 32KB
SHA256 8739d2fe2239988f6525f87600797643a1bfc76b6f5f9621ca72360cb62a9113
MD5 3c12caa6359daec2de2c5e046229fea9
SHA1 b352f349dcd93f1103e868dbb2c76b839ebd6ea5
SHA512 7607b13dfa841e5bbd22453e3e4a23d909e9c0736db0cb86a067433740ab87cc27f0a4d1e1a4c7842f26120609fe7f53117c647fd52d2f131c6592d739bfb4ec
SSDEEP 384:RCgXRmUwohx/FPy4ivenL1P9a0Jr7nyeX56QifezVSmg:DBmMvSgnDHyg56QifIlg
TLSH
T14AE28D0E59A3686BF0128D75CBFA55DA5FFCAC573AA6792FCB40610128F0198C091BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1224-25-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4796-23-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4964-3-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads