0f62ae69f0ed1302a5badf0e78a3179985600114a42b2a6d4e3d4f05abf649f6

General

Target
jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe
Size 58KB
Sample260919-w9k2qaae97
SHA256 0f62ae69f0ed1302a5badf0e78a3179985600114a42b2a6d4e3d4f05abf649f6
MD5 a8ec4fe36073564ebdf30aa5c7e87cc9
SHA1 e88ea8ab5c79d86a7d2aaabcec336d2b8fbeb72e
SHA512 0a1791653f0837874e343ec6c1465fa7afc8e7025fcb5a387ff2093534a9309e779601b81e77ef3415b59cde503f5240e3642dcc12d7f746fbff6138b5ecb1ed
SSDEEP 1536:nCBftgRewBlq2arQq79Nk7CcFr1NawNNaUAix:nCzylqvMqxuT52ix
TLSH
T1B3430209653BB8F8E884A97C3F1C19D2F414E5907A1B44F0193DF2AB6B87E1D725F681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
932	fasfds.exe
920	fasfds.exe
4368	fasfds.exe
2376	fasfds.exe
1388	fasfds.exe
1996	fasfds.exe
1880	fasfds.exe
5744	fasfds.exe
1108	fasfds.exe
4640	fasfds.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe
File created	C:\Windows\SysWOW64\fasfds.exe	jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe
File opened for modification	C:\Windows\SysWOW64\fasfds.exe	fasfds.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fasfds.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 932	5200	jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe	89
PID 932 wrote to memory of 920	932	fasfds.exe	90
PID 920 wrote to memory of 4368	920	fasfds.exe	92
PID 4368 wrote to memory of 2376	4368	fasfds.exe	93
PID 2376 wrote to memory of 1388	2376	fasfds.exe	94
PID 1388 wrote to memory of 1996	1388	fasfds.exe	95
PID 1996 wrote to memory of 1880	1996	fasfds.exe	96
PID 1880 wrote to memory of 5744	1880	fasfds.exe	97
PID 5744 wrote to memory of 1108	5744	fasfds.exe	98
PID 1108 wrote to memory of 4640	1108	fasfds.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\SysWOW64\fasfds.exe
  C:\Windows\system32\fasfds.exe 1116 "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a8ec4fe36073564ebdf30aa5c7e87cc9.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\fasfds.exe
    C:\Windows\system32\fasfds.exe 1224 "C:\Windows\SysWOW64\fasfds.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\SysWOW64\fasfds.exe
      C:\Windows\system32\fasfds.exe 1188 "C:\Windows\SysWOW64\fasfds.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Windows\SysWOW64\fasfds.exe
        
        C:\Windows\system32\fasfds.exe 1192 "C:\Windows\SysWOW64\fasfds.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2376
      - C:\Windows\SysWOW64\fasfds.exe
        
        C:\Windows\system32\fasfds.exe 1196 "C:\Windows\SysWOW64\fasfds.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\fasfds.exe
        
        C:\Windows\system32\fasfds.exe 1200 "C:\Windows\SysWOW64\fasfds.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\fasfds.exe
        
        C:\Windows\system32\fasfds.exe 1208 "C:\Windows\SysWOW64\fasfds.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\fasfds.exe
        
        C:\Windows\system32\fasfds.exe 1212 "C:\Windows\SysWOW64\fasfds.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5744
        
        C:\Windows\SysWOW64\fasfds.exe
        
        C:\Windows\system32\fasfds.exe 1072 "C:\Windows\SysWOW64\fasfds.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\fasfds.exe
        
        C:\Windows\system32\fasfds.exe 1216 "C:\Windows\SysWOW64\fasfds.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fasfds.exe

Path C:\Windows\SysWOW64\fasfds.exe
Size 58KB
SHA256 0f62ae69f0ed1302a5badf0e78a3179985600114a42b2a6d4e3d4f05abf649f6
MD5 a8ec4fe36073564ebdf30aa5c7e87cc9
SHA1 e88ea8ab5c79d86a7d2aaabcec336d2b8fbeb72e
SHA512 0a1791653f0837874e343ec6c1465fa7afc8e7025fcb5a387ff2093534a9309e779601b81e77ef3415b59cde503f5240e3642dcc12d7f746fbff6138b5ecb1ed
SSDEEP 1536:nCBftgRewBlq2arQq79Nk7CcFr1NawNNaUAix:nCzylqvMqxuT52ix
TLSH
T1B3430209653BB8F8E884A97C3F1C19D2F414E5907A1B44F0193DF2AB6B87E1D725F681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing