399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed

General

Target
jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe
Size 108KB
Sample260924-2fmakstdlb
SHA256 399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed
MD5 59c17eb279190a184a94b17dff699364
SHA1 38e356d3dad3a9f848a3bc048e1a7d0cc18de2ce
SHA512 fb4dc80dc3e3669b0b46068264fec594942a889111fb0e7be7e69c0a5fb6baf178ed758d8cc645aa9b012dd7284b3cb5ba79a84c3d3b3af1a5259beba0336a96
SSDEEP 1536:Nr6rcIa+H/4EHTApVJwlaaQzhKO9um3f4s7sIeO:krFa+H9HTApVJka6UuC5sIe
TLSH
T1B9B39D127DD14976EA93817020BB5B37AB3BFE2207519DC7C704DDAA1D312A0EA39387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2224	update.exe
628	update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updata = "C:\\Users\\Admin\\AppData\\Local\\update.exe"	reg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2608	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2440	2224	WerFault.exe	88
1848	628	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2388	jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2224	2388	jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe	88
PID 2388 wrote to memory of 2608	2388	jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe	89
PID 2388 wrote to memory of 4092	2388	jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe	90
PID 2608 wrote to memory of 1076	2608	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_399b5978152989ff98e83d27aa680b340466e930340ea04392b753ff51909aed.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\update.exe
  "C:\Users\Admin\AppData\Local\update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 452
    3⤵
    - Program crash
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v updata /t REG_SZ /d C:\Users\Admin\AppData\Local\update.exe /f > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v updata /t REG_SZ /d C:\Users\Admin\AppData\Local\update.exe /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2224 -ip 2224
1⤵
PID:3440

C:\Users\Admin\AppData\Local\update.exe
C:\Users\Admin\AppData\Local\update.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 424
  2⤵
  - Program crash
  PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 628 -ip 628
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.exe

Path C:\Users\Admin\AppData\Local\update.exe
Size 68KB
SHA256 bb905fe04c04302bb2a07639763c56a6ff128d51aa2e71aefe192540c5aa99ad
MD5 83327c99861703c4a0e84361966eee61
SHA1 3a7b5fd3fa8389c547a7d0aa99a6ad50ca60ae97
SHA512 5a58c3174a1cda6ba03a2cd9b3fba5267e9520a44e9439a59897cbf2bc26a6a6ac5244d86b4d9f64112a3ac257e5e52eb2de620faa423af36a99aa0d6e870f73
SSDEEP 768:q1dKppsvr8L+gCgcKVlmZraaQzzHVybCXpKIVGjBkKy+Rm2G6HfIhDi75bpC43Ez:NpVJwlaaQzhKO9um3f4s7sIeO
TLSH
T1E7637C427AD14C7AFA53957011BB6B33A73BFE1207509EC7C710DEE61C322A0E929396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads