3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566

General

Target
jaffacakes118_3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566.exe
Size 97KB
Sample260924-le39psae25
SHA256 3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566
MD5 c78add8c0f2e40c3933b5c7b4c776282
SHA1 41088c05b17b45d793ab7ef60874359f54e8e9b5
SHA512 1c5983d92c8fa718053d800045059e4aece65e518dc75801d3c2ad2bceed539a75d2699aaa1dedcb33069d7f5f9606011279be414e1cf17a4a5a1a504c037eba
SSDEEP 1536:eh9vzOqXEAJK7zh/j6geW/idxpQRzm55Zl72T8s5Z3:ebvzRwl6s/idxwuL72Tf5N
TLSH
T1CDA3BF13B66CC432F2860271863287BD8EBABD370611A51F6F49B95D5E3C582E5B930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4900	tmpfile678.exe
3328	tmpfile679.exe
256	winmsn.exe
4296	winmsn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Plugin = "winmsn.exe"	tmpfile678.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winmsn.exe	tmpfile678.exe
File opened for modification	C:\Windows\winmsn.exe	tmpfile678.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpfile678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpfile679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmsn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3904	jaffacakes118_3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566.exe
3328	tmpfile679.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 4900	3904	jaffacakes118_3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566.exe	89
PID 3904 wrote to memory of 3328	3904	jaffacakes118_3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566.exe	90
PID 4900 wrote to memory of 4296	4900	tmpfile678.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3695993baf047a48ceb944b9183529004fe699af98c1de4674019aac24cb3566.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\tmpfile678.exe
  C:\Users\Admin\AppData\Local\Temp\tmpfile678.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\winmsn.exe
    "C:\Windows\winmsn.exe"
    3⤵
    - Executes dropped EXE
    PID:4296
- C:\Users\Admin\AppData\Local\Temp\tmpfile679.exe
  C:\Users\Admin\AppData\Local\Temp\tmpfile679.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3328

C:\Windows\winmsn.exe
winmsn.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Decrypted.exe

Path C:\Users\Admin\AppData\Local\Temp\Decrypted.exe
Size 26KB
SHA256 7666410cd74c79759e366e98aea057be131f56990ef25153138357930f42c9a0
MD5 e6f0ab5192e70437ff49186dd1159f49
SHA1 4c0df27677f6302e2197e05d991b311eac680623
SHA512 16215f7e7d48eb35f0c2f8c6cabd1fab5c143e5479bfd103142c67fcd4500be126d82705d8189eb301be7287816592d86a03afa632cf69e9cd7be05a23f693c3
SSDEEP 384:+e15yoqSyJnoSePEcNLknJYv5Z7zhdYIJkzaln3p0t7166gn3Kl7UoHtLi:+OqSyJ2EcNwJYL7zh5kzappS66geNL
TLSH
T1CAC23B9B6991C833D59340309014AB7ECFFBA834166970ABAF04495E5D7C4E3E6BD24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpfile678.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpfile678.exe
Size 27KB
SHA256 59468a73e5ce4bdee99e9cecc4ecf47bf6b4a31af445bd92bb097081ca9810f4
MD5 2c7ccf3c967ed4cbe643631c4e96a41c
SHA1 7c49c0859e19d11779aaf53accfb9c23895d9932
SHA512 fd89e8fbc9b69cf2f3731b45e217fe16e7015362e4b4f8caaeecdde98b6e2007bb42e38f170923076c59ecb9d6e2269a8360485ddcbb6b40b2180e14dd1220f2
SSDEEP 384:+e15yoqSyJnoSePEcNLknJYv5Z7zhdYIJkzaln3p0t7166gn3Kl7UoHtLi2U:+OqSyJ2EcNwJYL7zh5kzappS66geNLY
TLSH
T161C24B9B6991C833D5D340309114AB7ECFFBA8341666B0ABAF00499D5D7C4E3E6BD24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpfile679.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpfile679.exe
Size 46KB
SHA256 e7702f666d1c2e0d115038e9b7db2d8bcb04628b49689f274f925f9fb284bb13
MD5 955e4a76969b2bebca2803a501a3ce2f
SHA1 3217d256e790661cd73feca04ebcb5678240f3e8
SHA512 b7332990e708083a7c7edb4b36cb81cd5e0a765054f39d803f3006f668af7a8c476ccc6b8800653635c91cb90e59b383439fb797a84f4948816183181e8e0747
SSDEEP 768:8pidxpIFuQtz1c5x7TGkB+7OjHb2Fgegps5TEAnr3:YidxpQRzm55Zl72T8s5Z3
TLSH
T1BC23E120B26C8438E74E0375CAB7C3E166D8BF649E20555E76DEB6AE6F3440C213A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3328-11-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3328-23-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads