af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b

General

Target
jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
Size 64KB
Sample260924-mb94hsbb66
SHA256 af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b
MD5 a789d6215530fbfa32af939ed84a85d7
SHA1 db4767bff8569ad6b21b198524ee27cf5483e798
SHA512 f9882c24be19055c85f671a31032261fe17925a1d39597787fc856d2a465f3af16d629b1e4d3fb5b06def29c54bf0f1f40b5f2feeb15efda64fb46f39049ba56
SSDEEP 768:2t/v2v22d5GFgElrMdQ/r7SftLGcif1ZY54ytDiIdqhydEVnxfpP9:2Nm2Hg4rEwco1ZlWdqSETfD
TLSH
T131537D02E6CB1462EC80CC3841E26B79441264F62AB11EFE5FD59FF8346E55DD63B2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3808	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
3808	rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\sysapp2.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File opened for modification	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2308	sc.exe
4832	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2044	2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	85
PID 2820 wrote to memory of 2308	2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	86
PID 2820 wrote to memory of 4832	2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	87
PID 2820 wrote to memory of 3808	2820	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	90
PID 2044 wrote to memory of 4580	2044	net.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245147.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245147.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245147.dat
Size 34KB
SHA256 b592051a37d45e9b30cb5bb5f2ebebc5475e32ace26da4e24d0064cdd5525fa7
MD5 4cd0477f9d90628e2926d1c4b7b51d53
SHA1 dd8b74ec2075ba646439dcac00aa647f628c0edd
SHA512 bf0147b54bc5f56aaa632e4930b00b16bff65c2bb795476ffaf9312b50ac4c6114bb0151f642567ed7b84152aecd68beb6d47bdec6982f5e5077356071ee32b0
SSDEEP 768:Z/NTEUsop10/Fm6+7d6tVlDqlOJLypRXFp0:Z/NTuo0/m7d6tDt+pRVG
TLSH
T103F24B137A4685A3D2CA02307A150FE99BFDBD301D0A5566FB63778A0DB45C3EA3B607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing