d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c

General

Target
jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
Size 64KB
Sample260924-mc88lsbb94
SHA256 d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c
MD5 1ad07c2bf3f67af995b55d0efba7c1d4
SHA1 364ee84c6e3594aca6ab78a3ab94575e37c93794
SHA512 6a560d4ea0c15e384ff07fdba412b686ca0efa2b3f0892da244bd1cb07ff6b5fd078b71ef85c3cbaad6a65a51fe4f17e5f19c4424e4bd604dc4c568b74adeae8
SSDEEP 1536:uD8bqWUoB//3E4fjSF3mmGzbQbxtZXmF:Y8bHUo13nLo3mmGkL9mF
TLSH
T1EE53494EAA86CEE0EC5346B0466756B4C43372232AE556A6EECCCCDC0729D517C35ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5784	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
5784	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\sysapp23.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2032	sc.exe
5768	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5140 wrote to memory of 2492	5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	89
PID 5140 wrote to memory of 2032	5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	90
PID 5140 wrote to memory of 5768	5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	91
PID 2492 wrote to memory of 4844	2492	net.exe	95
PID 5140 wrote to memory of 5784	5140	jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4844
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5768
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245407.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_d032c815517e9e393070df77d4cf0d13d6a20e85a6598c71f08ef1996ff9531c.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245407.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245407.dat
Size 33KB
SHA256 f62f03c42fccccb8101eea1e7cd063d8dec30881941afdec0f10be51680f7551
MD5 327e85816361761713dfe9ae1c2b0150
SHA1 3b3bc28858450b2b77d589d09e79c536eba8fb45
SHA512 31410fa8bc74b4db272391718a93bfa8dd2aba189b42bf126fd325cd6ddf4305c7a18eee431c91e1506e83465b8d693568788cd532c8f4570c98ecaa59bf783f
SSDEEP 768:ygsyV/wi4E98Pa1kHJpv7grtD6hB7cOtZvR/xBV:1syV/t8Pxpx7grF6YMvRjV
TLSH
T14FF24B127A4785A2E2E3823076452BB69BFC78304E0752A9DF72DB4B1D754C3DA3A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing