c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf

General

Target
jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
Size 64KB
Sample260924-md97asbc39
SHA256 c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf
MD5 2fe00b7b4585bf429da4829c85353152
SHA1 bcbe913a9c594f12449feda68454f45cdbaa0c90
SHA512 e7dc75c2c6286f707f976dfe3a30cfeb79f80cebc32b7170272e8d80ee8c1fb1be8df21448ad2dd02fcf52cb58c0b81a89273e6e8a289b83a9e5bc0136648737
SSDEEP 1536:JWcbj0cauFCzAAbcNqSXOnMOtcV+5YRrY8tFyxVkV5KpK3kB:Icbt4bcNzXOtcQ5YvesUB
TLSH
T1E653154286CBD9B0FCC57C704957D2BB3071BCAB2AF45AAB6603FCC980395617539E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5732	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
5732	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\sysapp23.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4472	sc.exe
3088	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 896	1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	85
PID 1264 wrote to memory of 3088	1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	86
PID 1264 wrote to memory of 4472	1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	87
PID 896 wrote to memory of 4936	896	net.exe	91
PID 1264 wrote to memory of 5732	1264	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	100

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245415.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245415.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245415.dat
Size 33KB
SHA256 824008c6fe8ab8497bf3c5dcd1b93e6067dde2c16189aa11e9146a63697598e9
MD5 dcc5d69b927472ec54b47643de0782df
SHA1 71df540bc1e4095fc791e037f227091c58afa540
SHA512 d9613a20a02056acd050faca89a38f13a1325fce1d4863edfcfe0905af664cc54fa0cda8f6b9f110c09988b40ab2b3849eea095771dea15e482fe14e0f3949fa
SSDEEP 768:UWPYvZLnZ0icDVov3Yq7pW/PB7cOsRER+e:VPYvZLnUVOb7pW/GPER+e
TLSH
T145F25B527A4789A2D2E3813076892B79CBFC78301E0751AADF72C75B1D715C3DA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing