1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6

General

Target
jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe
Size 362KB
Sample260924-elndhadf22
SHA256 1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6
MD5 f4ea8ec39f274ac0a544062ce0929393
SHA1 7d6ab26cffeb4a609f1afd3212e08a771fb95c86
SHA512 0f9520571592038394cd86d1fb988f1406dee91b0c3a0aa5de87ff00d8abb5f1fe58f01d1422e3ce5c739c20cb795550c2ccbeb110c9294d1806ee513975ca81
SSDEEP 6144:Zak8Appcg+J+bAFCWOkftE8+C6NoKA8N5wpNTSLQgbhhq:238AlI8+C6NoKA8N5FLQgFhq
TLSH
T140847D27F1D18477D1621AB8CC268269D53BBF603E79345AABE80D095E3D2D17C2E2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4120	locallpr.exe
6032	msvdtc.exe
1676	msievc.exe
5664	msdtcvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Tiny Firewall = "C:\\Windows\\system32\\msvcrtid.exe"	jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mssvcv.exe	locallpr.exe
File created	C:\Windows\SysWOW64\msvcrtid.exe	jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe
File created	C:\Windows\SysWOW64\locallpr.exe	jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe
File created	C:\Windows\SysWOW64\msvdtc.exe	locallpr.exe
File created	C:\Windows\SysWOW64\msievc.exe	locallpr.exe
File created	C:\Windows\SysWOW64\msdtcvs.exe	locallpr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvdtc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msievc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdtcvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	locallpr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4120	4812	jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe	90
PID 4120 wrote to memory of 6032	4120	locallpr.exe	92
PID 4120 wrote to memory of 1676	4120	locallpr.exe	93
PID 4120 wrote to memory of 5664	4120	locallpr.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1fae9c77d582888a65ab8bc284421d01e6b3c45356cc41b68ca8590f3fc658c6.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\locallpr.exe
  "C:\Windows\system32\locallpr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\msvdtc.exe
    "C:\Windows\system32\msvdtc.exe" 7040
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6032
- - C:\Windows\SysWOW64\msievc.exe
    "C:\Windows\system32\msievc.exe" 7041
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1676
- - C:\Windows\SysWOW64\msdtcvs.exe
    "C:\Windows\system32\msdtcvs.exe" 7042
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

locallpr.exe

Path C:\Windows\SysWOW64\locallpr.exe
Size 343KB
SHA256 57b713c4c2a82b251ccf7a8458440d65ed9727302704a864970685fc97f760f4
MD5 5028b0e9927c4b975c2f156742f44ba5
SHA1 f2f9fc6ea48477a95347c678ddd7809bab64e088
SHA512 412604e73c249280648cd65633e8dc602d56c909a6f3e37dbb6b6db0a5054dff7ebdf619f1dc5a2b5e3dcf64474507d286fee8f27d4b340ad42a9d8e437cdfdc
SSDEEP 6144:sAppcg+J+bAFCWOkftE8+C6NoKA8N5wpNTSLQgbhh:Y38AlI8+C6NoKA8N5FLQgFh
TLSH
T10A747D27F1D18477D1721AB8CC268269D53BBF613E79345AABE80D094E3D2D16C2E2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtcvs.exe

Path C:\Windows\SysWOW64\msdtcvs.exe
Size 16KB
SHA256 d81380528d1efcbd5438ffb7e4edba702f8ba3fc297c6831cc719dc48b65c6b7
MD5 0bfaeaef2f339a99fc861fc3d5b33292
SHA1 32007d696d8c9aa201b7fce9878f3f5562f9daec
SHA512 aeaff805f4939b77ff5b8c0fe0249e68b4dc11c272cae6efee2fa31b681f866d705dbd40e773a79f0055d20dc9ab70523176aa4b967738777b1d838cea56cebe
SSDEEP 192:wSNxm6prQXAMKV9DyW/LXVmZBdZDmojVJuZkbZFSDakBJqXoxWFZCc4lGDEpz4j:wSrX9DyoXVmlA51akWbLKIpqx3JQJon
TLSH
T132726CE778D40633C4868572A8B69B0AD73F262226715463EF501D5F2E398D09C3BF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msievc.exe

Path C:\Windows\SysWOW64\msievc.exe
Size 36KB
SHA256 03e9125ec36d3383c2ed3d45ad3879f19260a1dc084807fd17c42e1dd919a67c
MD5 043a56970d51114e7d09536ef8f441ea
SHA1 f13faea250c4aba707c46f703a82482adef9fcd3
SHA512 9faabc32d1fc09266e07cdd8da899c46bebe25f33171684a6f5aa10995cd37a09f0e96f4bdf08719a8724a93c53f86aa744f35b0e0d02b823ebf46da07c46065
SSDEEP 768:SSWmUFb3X6aOJXmmOXer3lQjg3fTeYKvYOiFFqZjjHRo2aC:SS2zXFG2mOXq9fTeFRiFOho9C
TLSH
T183F27E5278E18072D483827229B58F29AF3F56234766C657CB649D5F1C702A1EA3F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvdtc.exe

Path C:\Windows\SysWOW64\msvdtc.exe
Size 131KB
SHA256 15c706ff7265bd7089f3ba0b8caf7660d1f8eabc06cf222405f71e1bbc7284a1
MD5 d8ad5fd8540a259ca940f6a5080b3d01
SHA1 e7ff10331e7a5232bf009d30133e62cbb1b60ee9
SHA512 6267509a8b248d33a9396292ac0e9e5b886ca87821e6cd13551ee1384a49a61e136d6fda306ceb2f13efa8a56ddd2a75c3c6a9cddde455cb12ba347abd1d8a1c
SSDEEP 3072:2J9EWOkftf1/W8+C6IHBHobwsXBwTMtGlKiqb0FrZUf/15wUXEj:4CWOkftE8+C6NoKA8N5w
TLSH
T199D34C37F1D25477C1A21A78CC1A41A99427BFA13F29349AABDC1D099B3C5E1782F2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-38-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4812-8-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/6032-39-0x0000000000400000-0x0000000000468000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads