bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4

General

Target
jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
Size 36KB
Sample260924-l85pmaba74
SHA256 bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4
MD5 91c501554f4d4c532bdc69fb68fbdc3a
SHA1 ce94182cbffe9251bf679f1ec27cfd3619fc2025
SHA512 383202e930200ae60b797fe86c2013228e2f02fcda4d45f280ae83b917e6734019ccc6905e0014549a1eaa8bf991a66193bd256d89f5ec1a2a8c33c395e76ef5
SSDEEP 768:gF6Zh3daFlgD9o1aMCU/2G3njn9xtAQaJ:yENdaEYay/2G3n7tY
TLSH
T1BDF23A467E95C4A2C15340347E80A52AD7AA7C782918B453F7527F8D7CBA7C36A3CE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\aksuser.dll	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
File created	C:\Windows\SysWOW64\mmgl3.dll	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3128	sc.exe
1120	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4480	4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe	90
PID 4580 wrote to memory of 1120	4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe	91
PID 4580 wrote to memory of 3128	4580	jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe	92
PID 4480 wrote to memory of 1404	4480	net.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bd0cd16a2a531596c4f16910cbea6dfea3d5ffe70a6e555f2f01da8c280fa5d4.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1404
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1120
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3128