9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146

General

Target
jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe
Size 58KB
Sample260924-cdpkgsbf89
SHA256 9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146
MD5 570e5b175ef2214d577a52287c689f68
SHA1 2c22f9e2b45337207d112677d002d99634754a88
SHA512 b50674131395ad1d6f56d27b5b52d923623a63a0b734c1761f45eccdf790824df8539c5667d2356c3ed2473bd2de194f14c3d9e2b6b075a99f887f6b84c6df41
SSDEEP 1536:tSqunQ0GQSS1Ay4VicEHPCquFw0GQe/ZVpGN530Q:ZbwN4VicEHprzpGNF0Q
TLSH
T134435E46EAD1C8B2C020CAF89D29C16DFB3B36651D7D14D57AEF1FCCDCAA2510A1CA46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5148	attrib.exe

Loads dropped DLL 2 IoCs

pid	Process
6092	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe
6092	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cmd.bat	cmd.exe
File opened for modification	C:\Windows\SysWOW64\cmd.bat	cmd.exe
File opened for modification	C:\Windows\SysWOW64\cmd.bat	attrib.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\Come_System.sys	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\mfc.bat	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\Come_system.dll	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\Come_system.dll	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4656	taskkill.exe
3448	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6092	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 2424	6092	jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe	90
PID 2424 wrote to memory of 5148	2424	cmd.exe	92
PID 2424 wrote to memory of 4144	2424	cmd.exe	93
PID 4144 wrote to memory of 2636	4144	net.exe	94
PID 2424 wrote to memory of 4656	2424	cmd.exe	95
PID 2424 wrote to memory of 3448	2424	cmd.exe	97
PID 2424 wrote to memory of 3432	2424	cmd.exe	98
PID 3432 wrote to memory of 3388	3432	net.exe	99

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5148	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9fdd13da0cb38b48ac777f6d57038a7e3260ee583f3cbcf3af1cca2ad16b3146.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSInfo\mfc.bat" "
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\system32\cmd.bat +r +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5148
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    TASKKILL /im 360* /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\SysWOW64\taskkill.exe
    TASKKILL /im RStray /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\SysWOW64\net.exe
    net stop Shadow" "System" "Service
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Shadow" "System" "Service
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Network Share Discovery

1

T1135

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Come_System.sys

Path C:\Program Files\Common Files\microsoft shared\MSInfo\Come_System.sys
Size 28KB
SHA256 65c8a520be5d66e3f16353cd719b3fe425b128d604192a144817f0e935ca4d86
MD5 3cf2e3dda0c147acfa4cb3293294d001
SHA1 4f989f8cbdacab5c4f495ebd1649d941c8678df6
SHA512 7de696a25186501f1b30df92ad0e62fb6ceacc356fd7e0d997d99cefd3299c0c494ba1c6866b22ce9a96a8c82863e669b87e2d4c5c8f7e09310afe5a87d2b2da
SSDEEP 768:7KSCquFw0GQy/mRsr0QrxX53HpBfrIN53Y:pCquFw0GQe/ZVpGN53Y
TLSH
T135D24D46EED0C4B1D020CEB8AD25C26DFB3F36655D7D14E57AEA1FCCDC692820A1CA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc.bat

Path C:\Program Files\Common Files\microsoft shared\MSInfo\mfc.bat
Size 453B
SHA256 e568f807435b6a58e057a6f2d64b47120d9600ca6162f0f6c466ed613df36a1e
MD5 772239043c342a30a43bb81a69380492
SHA1 d9271f07120b4eaae10fef272d4b3879820aaee4
SHA512 5052469f6cb5becd2f8b2c4865ec5250940c31c0528d3be04eb8dedf3a9e825a99af8768f5cadf3d0c7401adfb91f0ada226f167df860e61574c64e34b2453a4
TLSH
T1B3F0E29F7483E87186694581807A1922772AB0C50E63F1D8368D6353C692D78CB10BEC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6092-13-0x00000000038B0000-0x00000000038BD000-memory.dmp

Download

memory/6092-17-0x00000000038B0000-0x00000000038BD000-memory.dmp

Download

memory/6092-16-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/6092-21-0x00000000038B0000-0x00000000038BD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads