c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf

General

Target
jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
Size 64KB
Sample260924-md97asbc39
SHA256 c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf
MD5 2fe00b7b4585bf429da4829c85353152
SHA1 bcbe913a9c594f12449feda68454f45cdbaa0c90
SHA512 e7dc75c2c6286f707f976dfe3a30cfeb79f80cebc32b7170272e8d80ee8c1fb1be8df21448ad2dd02fcf52cb58c0b81a89273e6e8a289b83a9e5bc0136648737
SSDEEP 1536:JWcbj0cauFCzAAbcNqSXOnMOtcV+5YRrY8tFyxVkV5KpK3kB:Icbt4bcNzXOtcQ5YvesUB
TLSH
T1E653154286CBD9B0FCC57C704957D2BB3071BCAB2AF45AAB6603FCC980395617539E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4936	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
4936	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\sysapp23.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6124	sc.exe
5448	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4268	4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	89
PID 4324 wrote to memory of 6124	4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	90
PID 4324 wrote to memory of 5448	4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	91
PID 4268 wrote to memory of 1956	4268	net.exe	95
PID 4324 wrote to memory of 4936	4324	jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1956
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:6124
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5448
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245421.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_c7ae66ee6493870c9971a47a76a8fba9cae52f091f8e7f663798f19d0413edbf.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245421.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245421.dat
Size 33KB
SHA256 d82c2e17edaff64f589142444fd6df9ae41131a4a9a688176843fb0ad276ba87
MD5 8428689875a33418341659a4bef3d1d9
SHA1 0d41db62eec13a989f9608b189b44d6dfcdbe2d2
SHA512 5ea6744cd5e6df9ff5017245c5b6407ce2294082d78b194e51299b79a432eceff9ae10dbb1bb99acfe01d79555669e73f98cc28b63a5248ee480254f481fb959
SSDEEP 768:JWPYvZLnZ0icDVov3Yq7pW/PB7cOsRER+e:IPYvZLnUVOb7pW/GPER+e
TLSH
T1B4F25B527A4789A2D2E3813076892B79CBFC78301E0751AADF72C75B1D715C3DA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing