d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c

General

Target
jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
Size 64KB
Sample260924-mc88lsbb94
SHA256 d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c
MD5 1ad07c2bf3f67af995b55d0efba7c1d4
SHA1 364ee84c6e3594aca6ab78a3ab94575e37c93794
SHA512 6a560d4ea0c15e384ff07fdba412b686ca0efa2b3f0892da244bd1cb07ff6b5fd078b71ef85c3cbaad6a65a51fe4f17e5f19c4424e4bd604dc4c568b74adeae8
SSDEEP 1536:uD8bqWUoB//3E4fjSF3mmGzbQbxtZXmF:Y8bHUo13nLo3mmGkL9mF
TLSH
T1EE53494EAA86CEE0EC5346B0466756B4C43372232AE556A6EECCCCDC0729D517C35ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3492	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
3492	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\sysapp23.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File opened for modification	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1628	sc.exe
4808	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4892	4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	86
PID 4672 wrote to memory of 4808	4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	87
PID 4672 wrote to memory of 1628	4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	88
PID 4892 wrote to memory of 4776	4892	net.exe	92
PID 4672 wrote to memory of 3492	4672	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	100

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4808
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245292.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245292.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245292.dat
Size 33KB
SHA256 01c6cb09beece19b06089aeb74d04d103e5cf75d8da68699f1d071244d7e4d9f
MD5 314f3307684d5291c2891812c5250de3
SHA1 8433737a5f53abc1cb699c788fef6c951977870e
SHA512 616f66626f03e3858461d2841f6e186169b5036cbec0808f42076442169ee610364c0408d650ad868c059332b0c1f49e13a318b8efbea0dec83edaba079182bc
SSDEEP 768:LgsyV/wi4E98Pa1kHJpv7grtD6hB7cOtZvR/xBV:MsyV/t8Pxpx7grF6YMvRjV
TLSH
T14FF24B127A4785A2E2E3823076452BB69BFC78304E0752A9DF72DB4B1D754C3DA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing