055955fb55e022c19c1cee59fbcce4e6ae7fc00be7064855d41a6498275c983e

General

Target
jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
Size 688KB
Sample260919-vsd2eatepf
SHA256 055955fb55e022c19c1cee59fbcce4e6ae7fc00be7064855d41a6498275c983e
MD5 a23bb610b9eb410f69243fc651ad27e8
SHA1 7bd781f8392ca0fac452d914d57d104699fa328c
SHA512 fb3c9827c90410506f3f8397122261953e1399b9a410a67b2ae8b37bc892517e3fae4f11dff4c61d180df1d361239ce244ddadcb7918a5e28d582898842411b7
SSDEEP 12288:l8GEGaHFMd7KDP9p/4RCRJbUhSGN5ohdwjNBimfmxBnTDUeNISIWV:KGERlHL9FKCRJbUPkh8IQm/nTDUCX
TLSH
T145E4CFF767237EAFEB9E0BF8841426510CA858971A34F14DEC0E05A17698DA0197EDFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3312	vbc.exe
4424	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
3464	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe"	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3448 set thread context of 3312	3448	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	89
PID 4424 set thread context of 3464	4424	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3312	3448	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	89
PID 3448 wrote to memory of 3312	3448	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	89
PID 3448 wrote to memory of 3312	3448	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	89
PID 3448 wrote to memory of 3312	3448	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	89
PID 3448 wrote to memory of 3312	3448	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	89
PID 4424 wrote to memory of 3464	4424	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	92
PID 4424 wrote to memory of 3464	4424	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	92
PID 4424 wrote to memory of 3464	4424	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	92
PID 4424 wrote to memory of 3464	4424	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	92
PID 4424 wrote to memory of 3464	4424	jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\vbc.exe
  C:\Users\Admin\AppData\Local\Temp\vbc.exe
  2⤵
  - Executes dropped EXE
  PID:3312

C:\Users\Admin\AppData\Roaming\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
C:\Users\Admin\AppData\Roaming\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\vbc.exe
  C:\Users\Admin\AppData\Local\Temp\vbc.exe
  2⤵
  - Executes dropped EXE
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vbc.exe

Path C:\Users\Admin\AppData\Local\Temp\vbc.exe
Size 1.1MB
SHA256 ff6444089af3ad4d14aa977a689b2786245848ca588018342561d44270d23542
MD5 6e9bf100272097f3e330e7c1f312c303
SHA1 33464583d801d2fd52181a98dcc411464a89007f
SHA512 65dc52dfabd74c2453e499f17b7337f157f7627240b3d76ea3f55cc60c32fdcb79fa6a2590cb04aebc0fc6b69a21457d8bce7dde2083cbb72e3b0ab35ee9dc39
SSDEEP 24576:e6DXzo5KsJf3QBtN8zC1DruG8myZzP760dDQZD:/zo5KmI/h3QmCT760WZD
TLSH
T1BE453A21A7E9412AF5F33B305CBA736449BEBD3A9E35D38E2294940D5D71E80AC64733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe

Path C:\Users\Admin\AppData\Roaming\jaffacakes118__a23bb610b9eb410f69243fc651ad27e8.exe
Size 688KB
SHA256 055955fb55e022c19c1cee59fbcce4e6ae7fc00be7064855d41a6498275c983e
MD5 a23bb610b9eb410f69243fc651ad27e8
SHA1 7bd781f8392ca0fac452d914d57d104699fa328c
SHA512 fb3c9827c90410506f3f8397122261953e1399b9a410a67b2ae8b37bc892517e3fae4f11dff4c61d180df1d361239ce244ddadcb7918a5e28d582898842411b7
SSDEEP 12288:l8GEGaHFMd7KDP9p/4RCRJbUhSGN5ohdwjNBimfmxBnTDUeNISIWV:KGERlHL9FKCRJbUPkh8IQm/nTDUCX
TLSH
T145E4CFF767237EAFEB9E0BF8841426510CA858971A34F14DEC0E05A17698DA0197EDFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3312-2-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/3448-1-0x0000000074872000-0x0000000074874000-memory.dmp

Download

memory/3448-0-0x0000000001870000-0x0000000001880000-memory.dmp

Download

memory/4424-6-0x0000000074870000-0x0000000074E91000-memory.dmp

Download

memory/4424-10-0x0000000074870000-0x0000000074E91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads