1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854

General

Target
jaffacakes118_1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854.exe
Size 35KB
Sample260924-ka1gkshf28
SHA256 1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854
MD5 110a21a4a354d304f659f887cd3d384a
SHA1 9dd20e3fb4ae457d34ad2a9a05edbe07616df3c8
SHA512 43c2246e536813c7d57ad4f7deb067dd8931dbf157c3d0ed14ffc3175f37912cae702095d93e9e52e9c66913137e597743d1b7337dee5eae16e307b3d56fb1a1
SSDEEP 768:2GDKi85HGn5WHj/wTMi8jGv3212+j3M7YuK6g:dK/k5WHsTM23212+jf6
TLSH
T19EF22A3B3B88A440D6449E3445178660C5A2ED6DCE194A5FBFE83DCFFBB46B4A23016C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1728	b2e.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5464	sc.exe
4512	sc.exe
4376	sc.exe
4240	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4720	cmd.exe
2888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1728	4692	jaffacakes118_1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854.exe	89
PID 1728 wrote to memory of 4720	1728	b2e.exe	90
PID 4720 wrote to memory of 5464	4720	cmd.exe	92
PID 4720 wrote to memory of 4512	4720	cmd.exe	93
PID 4720 wrote to memory of 4376	4720	cmd.exe	94
PID 4720 wrote to memory of 4240	4720	cmd.exe	95
PID 1728 wrote to memory of 2888	1728	b2e.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\6855.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\6855.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\6855.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a115c3c96a69cc980262db131874b57b9a67a5d4d3c2ebd08359c8cd2e47854.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6A88.tmp\batfile.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\SysWOW64\sc.exe
      sc pause CiSvc getdisplayname
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5464
  - - C:\Windows\SysWOW64\sc.exe
      sc pause ImapiService
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4512
  - - C:\Windows\SysWOW64\sc.exe
      sc continue cisvc
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4376
  - - C:\Windows\SysWOW64\sc.exe
      sc continue ImapiService
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\6855.tmp\b2e.exe
Size 8KB
SHA256 e7dc808a5f1983d56df5bc25c25c90c41bb32861584c7ba639b1b97d0bd041ef
MD5 49457b5f9a86499f1b852289b43f124c
SHA1 29f841342f1cabda786dc497354174839cd38288
SHA512 7282c80c99d984bea272a2b54b51282eb1aec4f7cf3f88940e122239ca4c676fb1db6f62d4d265cd785ff2137b3579747e5100bfb24e93744c13db4c84a0251f
SSDEEP 96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcq:3R5Fhp8cdwpHR3AkPLiM79mLU2Pcq
TLSH
T1AA02540FE9908AA5C3C0C5F41AAD527DDA5143CE836C518BFBDC8C662BF96B1D07961C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

batfile.bat

Path C:\Users\Admin\AppData\Local\Temp\6A88.tmp\batfile.bat
Size 159B
SHA256 c1846972954ffd92bf03e020aa892127460c78b83bf68e06b68e1e48f989ab18
MD5 8c5a906a69f7f4bca613f45a51f6c73f
SHA1 9dd33a9c483347c7ef9b84b7e733d458a60d17e4
SHA512 f3ed7735ea437925ba00e901a45d7d79e8746c32e77a3d3b936a04fa39dd5a5ec6b3bd4679dd18372d64e439772a05646289e05b70a6c5f012a956aa47552833
TLSH
T112C080055DE570C414C4C4890497ED92A69BC911C9441B1BD73406D4A5D5D49543D101
MD5 SHA1 SHA512 TLSH

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 815747fa8928b1e1bfdeff7dcdbc913776e510f78a099e51a81b494a0bfe61b5
MD5 c5f0a14f0972f92960b19bfa5cab4d7c
SHA1 a56ce9e496ba61d10e65d8848ffbb38b0f59962d
SHA512 adbef0bf767e61047fe9cfce8718a395006607bab31ec45955ef3b4e31c4542e6adef8bb797d087cd951f2316b80cfcdc7a1bb3ada512d09266cbc5a982ca998
TLSH
T1AFC002049ACBDB5D2404D07746B5E64E91B60D183E8A2B208726880C154284EBA82607
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1728-10-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1728-28-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4692-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4692-11-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads