79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c

General

Target
jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
Size 64KB
Sample260924-me4e5sbc45
SHA256 79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c
MD5 2787e36514aafd503960f20f173861a3
SHA1 3acc1ce13bf2da1227d8ff859e3890fbbabe260a
SHA512 85b80d8900ef7e964c5fcb3a47c1f8daeb442764431cf2cba1fe7485d00866fa45b724b618ac82e540b4f6efae07e9cada763f3dccd94be9f1c41c0a52e7451f
SSDEEP 768:uDZbazb/nxQfrhr6hfGamVwg5oLiDq26Fc8e2uO1aXn06yjNq4aW9/8Eg3Pw:uD8bqw5nmVD5op2TbO1KnL4Z9EEg3Y
TLSH
T17353385EA986CEE4ED134571426752BAC433716B1AD5A29AEECCCCCC433AC517C34ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2416	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
2416	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\sysapp23.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3580	sc.exe
2384	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3656	4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe	90
PID 4532 wrote to memory of 2384	4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe	91
PID 4532 wrote to memory of 3580	4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe	92
PID 3656 wrote to memory of 4332	3656	net.exe	96
PID 4532 wrote to memory of 2416	4532	jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2384
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245440.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_79519ae06b32fa0735356a1cf1dadd4b732ed8ed5258bc34d055fafc3fabe98c.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245440.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245440.dat
Size 33KB
SHA256 a89c8a93d1b9969ca2a689991be9c0af07f51bb963edded2d8affbaeebc9fd26
MD5 858114f3a2d78e80236b79e411bbb8b2
SHA1 1b9a26206fa2f39d375c74f45af59f8bee4f0753
SHA512 08a554d5a738caef77d8d479d23f93c5b67395b932be6174cd611473d76e5e6e364654e556140f2dd4d1c680baaa336d9688d8fa5422f0272b8c25dc6197c8de
SSDEEP 768:ddW5MwZQlQ5sx9NHku7tPQDB7cO/qvRFQFjPh:/W5MwxsRT7tPQi5vRWFjJ
TLSH
T14DF25A527A5785A2D1A3813036812BB68BFC78301E0752EADB72CB4B1D755C7EA3A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing