e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd

General

Target
jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
Size 62KB
Sample260924-mcgtcsbb74
SHA256 e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd
MD5 3efcdb0792c0fc18515eba3534dedc03
SHA1 675223816f98ee736a8c2071eb2e3bd76c7994ed
SHA512 7602989cfc2691d0e8e35ce448ca3fd3330ca704065655a98da09c35e61e1a239e5fb5c0eee3264e3b8ea53b12f1b2e90f0e63e439b3584f9ae54b353e411fdd
SSDEEP 768:38BPWD5/nxldG0FeQ0NBdKuISNkPfSq1HTD9lk+6f5i83M6h+2ETltNRbIvADGHh:meDtxlF0bdLISNwbQ+Unxh+70vVrhn
TLSH
T158534A86BC8E08A2DC1FCEF945A75A7BB72327513A60C49ACA54C8CC3D27DD351672C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4192	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 2 IoCs

pid	Process
4192	rundll32.exe
4192	rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DVR0034017.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\DVR0034017.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\chinasougou.ime	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\YUksuser.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4620	sc.exe
4140	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 4848	480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	89
PID 480 wrote to memory of 4620	480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	90
PID 480 wrote to memory of 4140	480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	91
PID 480 wrote to memory of 4192	480	jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe	92
PID 4848 wrote to memory of 4748	4848	net.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4620
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4140
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245261.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_e05b7751d6bc8693af77a530befcc780c04913e25461ce8282c4a92441c258cd.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245261.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245261.dat
Size 32KB
SHA256 5e8e6d8dc64eeaebd17aca2663719dff6c879e871b0e9bd3be2f89f7e98c7e02
MD5 82af5b0467ce4d186f39cf7035f18041
SHA1 81020ac222667325e05cfbeba2f86efe2b9478b4
SHA512 a20f792d2aed8011235534a5fbe3d2d723fd1dffe168f9b42461500e62f6822f23e0f01ada65b7e22a2c76a4b540610f9c10f3d8d8a1ca3633a5e403ce43c4fc
SSDEEP 768:MW7Jt/kM+Gi56SoKhPozduL7qCia2OiOWRlA3O:MW7Jt/d8b/hgK7qCDE1Rae
TLSH
T147E24C12BB5644A3D3D70334B5062BBDDBBCA9301F56D4A9CB624BC65CB46C3EA36203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YUksuser.dll

Path C:\Windows\SysWOW64\YUksuser.dll
Size 23KB
SHA256 c005d6dca7ff98ef78474c890206138cafcdfc5aee61b9258b70abb77b2aa24c
MD5 5e4de78bfb9c8657a1995f08957ffc8e
SHA1 0258adb501d94d4dd5bd9069ee177cbf18a9209d
SHA512 0b6e3b8be6d9eebd23ab8058a4144458a0b3e78bae9091c207fbe53948716c16c5675079c9eff800b62e3dff51c1fdf077f1a2235f7046faa5db421c9f1759ed
SSDEEP 384:TBdmuUWpWcmYgOJ0GqdJ20RWggW1dDBRJuDX+iR9zYaUwW:TLpW3OXB0Fbd1PuDuO9zztW
TLSH
T149B27DC1AB644502DEA629B813DCFA276C3D67E35F1024D35B90DA990C5A3D1EF309AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chinasougou.ime

Path C:\Windows\SysWOW64\chinasougou.ime
Size 8KB
SHA256 666e8c00cf310cfd2a29088039ab14e0f18cc77b472b812f03a9a563bba221a8
MD5 251224cd16c7d500b103cdc6c0e6fc62
SHA1 5fdaa016efccc9ff6a2f41800a006f1adc606944
SHA512 8d063bf5fed1f5b9c3f8fd56f7ef1a54fb671b5ae8e92dcfc751eac71cb895a69e7e38abe0e0ce3ea3bd4c4bb2f3ef329ca208b1d5235a5fa2f7515fbb47a053
SSDEEP 96:KraoAVS6qE5Pyqmsdrel8pugj9qOGNgZ7qWAW5+5vq:BmrcaqKuP9qOGNgZ79dqvq
TLSH
T1F1F1E832B7CD18F6D89F07706C82332AA6A6BC344B7585790B7742C51C76665EE32313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads