ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae

General

Target
jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
Size 72KB
Sample260924-mfxc8abc65
SHA256 ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae
MD5 372eade866dff72933f16d58488d2721
SHA1 4ac91bcb28f17945527b84758e0e2622d9616f70
SHA512 f54d391b1c5164a456f940435d10a993c4e480aa36be65e7012b72a9277039b6a3a281e08984a7dbe5519c4b2d27fe1217af7fcb1558544351042a385301de1e
SSDEEP 1536:LsBUTJG1zxmTxfE6LLL2YSfc6SZptqPPdau9bXZ1r9CuEBP4:LseGxmJ5orH4uYP4
TLSH
T127734706DAC70463DC54C93C05E24F6A452221F629B51EFE9FD68FFA342E099D43B2DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3164	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
3164	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\YUmidimap.dll	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
File created	C:\Windows\SysWOW64\sysapp10.dll	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
File created	C:\Windows\SysWOW64\YUksuser.dll	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3436	sc.exe
1924	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2444	2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe	89
PID 2328 wrote to memory of 3436	2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe	90
PID 2328 wrote to memory of 1924	2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe	91
PID 2328 wrote to memory of 3164	2328	jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe	92
PID 2444 wrote to memory of 4688	2444	net.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3436
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245572.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_ca68532bb03c6f44bac64d667aa0905aec5a008642e271bcf31ecdf02115c4ae.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245572.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245572.dat
Size 40KB
SHA256 5c8c9482e6e81be0c7488682264f52f55a47b6fce69bc745d1e93426619be819
MD5 26a579e06c10b33ee7bed6657e4fc31e
SHA1 80096352e3bd38ad2725e661d2761eadf63025ad
SHA512 6fef8ecf8dcb8c89fd287cd463c770a64488141eae346c42783126a005d8cee325badcfe8749ef86cdaae5160e632f3aee5099450a67890f0060587a72105f61
SSDEEP 768:NK/Q2SNQz3WmvM3ERMzB6cKXv7N8ZPpjJdWBpRcJhw:I/Q2SNQz3dqzB63/7N8HXapRGO
TLSH
T1B1136D12790A41A2D1D7863176663FB5DBFC68702E0AA6A4DF33C7570DF64C6DA32207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing