af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b

General

Target
jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
Size 64KB
Sample260924-mb94hsbb66
SHA256 af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b
MD5 a789d6215530fbfa32af939ed84a85d7
SHA1 db4767bff8569ad6b21b198524ee27cf5483e798
SHA512 f9882c24be19055c85f671a31032261fe17925a1d39597787fc856d2a465f3af16d629b1e4d3fb5b06def29c54bf0f1f40b5f2feeb15efda64fb46f39049ba56
SSDEEP 768:2t/v2v22d5GFgElrMdQ/r7SftLGcif1ZY54ytDiIdqhydEVnxfpP9:2Nm2Hg4rEwco1ZlWdqSETfD
TLSH
T131537D02E6CB1462EC80CC3841E26B79441264F62AB11EFE5FD59FF8346E55DD63B2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
596	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
596	rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\sysapp2.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1500	sc.exe
4544	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2324	2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	90
PID 2184 wrote to memory of 1500	2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	91
PID 2184 wrote to memory of 4544	2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	92
PID 2184 wrote to memory of 596	2184	jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe	93
PID 2324 wrote to memory of 2980	2324	net.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1500
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245252.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_af3c4f955e77af8eb8cf0164f31ee8b56fcf5ab9f187398e428c23772086932b.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245252.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245252.dat
Size 34KB
SHA256 b60aa08f212ceb996aadf7edd5a8a585b554d0eb0beefc1ad6e496403fa3f845
MD5 22e9a609c4321fe0d35d8f50da51209c
SHA1 cf2b23bcc74ef6b5e01ea215b9c5557b222854f8
SHA512 8a39feb29f36fcc61a7773e0894e56cdf13415e776dfac83f28b664b380cf24b2fe5d6c123464cfe97de6f810f37244685affe70984d0e25023f1552dc8151ba
SSDEEP 768:u/NTEUsop10/Fm6+7d6tVlDqlOJLypRXFp0:u/NTuo0/m7d6tDt+pRVG
TLSH
T143F24B137A4685A3D2CA02307A150FE99BFDBD301D0A5566FB63778A0DB45C3EA3B607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing