e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd

General

Target
jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
Size 62KB
Sample260924-mcgtcsbb74
SHA256 e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd
MD5 3efcdb0792c0fc18515eba3534dedc03
SHA1 675223816f98ee736a8c2071eb2e3bd76c7994ed
SHA512 7602989cfc2691d0e8e35ce448ca3fd3330ca704065655a98da09c35e61e1a239e5fb5c0eee3264e3b8ea53b12f1b2e90f0e63e439b3584f9ae54b353e411fdd
SSDEEP 768:38BPWD5/nxldG0FeQ0NBdKuISNkPfSq1HTD9lk+6f5i83M6h+2ETltNRbIvADGHh:meDtxlF0bdLISNwbQ+Unxh+70vVrhn
TLSH
T158534A86BC8E08A2DC1FCEF945A75A7BB72327513A60C49ACA54C8CC3D27DD351672C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4820	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 2 IoCs

pid	Process
4820	rundll32.exe
4820	rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\YUksuser.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\DVR0034017.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File opened for modification	C:\Windows\SysWOW64\DVR0034017.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\chinasougou.ime	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
464	sc.exe
5084	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 2204	4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	85
PID 4444 wrote to memory of 5084	4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	86
PID 4444 wrote to memory of 464	4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	87
PID 4444 wrote to memory of 4820	4444	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	89
PID 2204 wrote to memory of 1564	2204	net.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1564
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:464
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245258.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

DVR0034017.dll

Path C:\Windows\SysWOW64\DVR0034017.dll
Size 32KB
SHA256 1dc3bcfb5c0dcffda0acd444e8b17bbed483f87a48459fdcbf9b58428f0964e9
MD5 09899ef4544f54ac4c1c3e5c11de8411
SHA1 42671a4c656018bd89f4b43f9138d5ce9616857a
SHA512 b191ab28e8f4129da81dd7ddd4f6e56c62ba37d77a3a17d5a422f21c257d9e77d52438486d81ccbe715b7e8cefc68c783c387ef7f06826a19775ea02e1236d62
SSDEEP 768:M07Jt/kM+Gi56SoKhPozduL7qCia2OiOWRlA3O:M07Jt/d8b/hgK7qCDE1Rae
TLSH
T1C7E24C12BA5644A3D3D7033475062BBDDBBCA9301F56D5A5CB624BC65CB46C3EA36203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chinasougou.ime

Path C:\Windows\SysWOW64\chinasougou.ime
Size 8KB
SHA256 666e8c00cf310cfd2a29088039ab14e0f18cc77b472b812f03a9a563bba221a8
MD5 251224cd16c7d500b103cdc6c0e6fc62
SHA1 5fdaa016efccc9ff6a2f41800a006f1adc606944
SHA512 8d063bf5fed1f5b9c3f8fd56f7ef1a54fb671b5ae8e92dcfc751eac71cb895a69e7e38abe0e0ce3ea3bd4c4bb2f3ef329ca208b1d5235a5fa2f7515fbb47a053
SSDEEP 96:KraoAVS6qE5Pyqmsdrel8pugj9qOGNgZ7qWAW5+5vq:BmrcaqKuP9qOGNgZ79dqvq
TLSH
T1F1F1E832B7CD18F6D89F07706C82332AA6A6BC344B7585790B7742C51C76665EE32313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yuksuser.dll

Path C:\Windows\SysWOW64\yuksuser.dll
Size 19KB
SHA256 dd28805fc6f5fd70ddc8c87fe1f5561d8614bdba65284cd6a7c0c73aea427a07
MD5 e55c45cc69106079bb6a144bc8655b4e
SHA1 980288eef9c38b39973a16c8758f80c5120ac793
SHA512 fca00c5e7ab884427597d235cc151d769e5b1056bef01012af762f2fe91f1f3ff5ed380f4202409c34b244969a6675e00760ddb2dafe448f8a9b338f1555ec2f
SSDEEP 384:tc7jVIc2o+dOH8Q8idAwpWAgWBPzD1IDBRJJZO95DKlxT1xPS:2EYnqw9vtI1P05DmPS
TLSH
T142927E8557684C43EBA73EB013E8FA23393D73921F2065D70494E6AA1C563C29F3457E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads