2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59

General

Target
jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
Size 20KB
Sample260924-mcbx4sbb68
SHA256 2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59
MD5 1f49e120833afd67d7ea0cc3dc76936c
SHA1 c8f9897e1596f257ab1532ab565a9c36a3efc370
SHA512 46fcaddc1b6ebb58609d82e69875a422ddc672e6a3fe679a8a949fb4c6e8b604a3733550c022a3981952c72bef6a1ec6bca41c1f1ac7b47a0f215845ea721658
SSDEEP 192:VLSpUHO1wQ5pBP3nPwswR85ztbkdSM0ftbQw6yUc866wdnwoU5OcHXeWT3:0B1RXP3Is7bYdvOUSmHotc3eWD
TLSH
T15D926CAF7F0408E3C1D29130501AA62ADDA2DE35529F9E04CD4881D7383D6A7B6FC77A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001c525-5.dat	acprotect

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\abc.dll	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
File created	C:\Windows\SysWOW64\abc.bat	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
File opened for modification	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
File created	C:\Windows\SysWOW64\aksuser.dll	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c525-5.dat	upx

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4776	sc.exe
4104	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3748	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
Token: SeDebugPrivilege	3748	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3748	3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe	89
PID 3444 wrote to memory of 5236	3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe	91
PID 3444 wrote to memory of 4104	3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe	92
PID 3444 wrote to memory of 4776	3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe	93
PID 3444 wrote to memory of 4272	3444	jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe	95
PID 5236 wrote to memory of 5996	5236	net.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d899ea81640027e62de9eb2ce12439f403fc6d3d53c0b8e91c641cfbc7f8c59.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im zhengtu.dat /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5996
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4104
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\abc.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

abc.bat

Path C:\Windows\SysWOW64\abc.bat
Size 43B
SHA256 941edef3080f6c82866ffc541e155165728b834b93e3d7d6d8261a4094de5f38
MD5 fa568bafaba758349aef8dd65a4fa7a5
SHA1 6eee7cfff63f8f39ffd7785761b44870b03b2171
SHA512 71414f0568f11fe6b11846f19226e7c1e7e59853be34e68e5808f68207bd49e27ff803e22848019ad7000535040ef0180fb2d27d9af189f4d8493a610481b69a
MD5 SHA1 SHA512

Submit Download

abc.dll

Path C:\Windows\SysWOW64\abc.dll
Size 9KB
SHA256 dd4e0a8b4edad37b596917c124bd599644452392c7e0a5a57bc95b7afb044af6
MD5 afc67f4967c85eb380ce89a770b698f3
SHA1 8a1e6494ff3ad9dce2570b178c46ff0278ff1453
SHA512 03af49a3263e6d0b861ef0bc04f5b9603533ed9737a2e5e60f8c36763d81b062ac0287189dbe79b2ffc5203bcbb7804556e2bda374b58c3725aa40f0aed8e002
SSDEEP 96:/M0f0RCbQw6mtUYLnHEOgdot0IrDzLpE9489TzoU5OcKFWRXWu0kv1S+ZT9k2zHF:/M0ftbQw6yUc866wdnwoU5OcHXeWT3
TLSH
T12F126B2E7A182963C1E7F635315B7B056CF1F66CADAF86084C0890EA392B274563C739
MD5 SHA1 SHA512 SSDEEP TLSH