72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41

General

Target
jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
Size 86KB
Sample260925-22d64azs3l
SHA256 72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41
MD5 17338b4cc43f925d023121e3a23d9298
SHA1 e31ccfec5d0bee7f97b677a98fb25e134302bb59
SHA512 daa790afa13b63a7dd2b997cefc329439dfb9faaf4cd5009bd7dd9569d67217929c611806c1f720b819becb3d68ea6cf90c6f088adc2c6aaeb0e5a6d106c6f6d
SSDEEP 1536:rQxEe2rkTDfD4d9WcNwXVyh3GSDW4suDx3Yl:rpeNDEfFNwXVs3GCjDx3E
TLSH
T141832933BBC080F2D75E0974385A57BB953B7D301254A993AB63FEE41873362E928706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\1002.ocx	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File created	C:\Windows\SysWOW64\1002.ocx	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File opened for modification	C:\Windows\SysWOW64\xydh01.ocx	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File created	C:\Windows\SysWOW64\xydh01.ocx	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File opened for modification	C:\Windows\SysWOW64\font01.dll	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File opened for modification	C:\Windows\SysWOW64\system.ini	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File created	C:\Windows\SysWOW64\New.dll	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File created	C:\Windows\SysWOW64\font01.dll	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
File opened for modification	C:\Windows\SysWOW64\New.dll	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5460	cmd.exe
4260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 5460	3652	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe	88
PID 5460 wrote to memory of 4784	5460	cmd.exe	90
PID 3652 wrote to memory of 4260	3652	jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_72e1318e3ff96bc7a98b11090e0247c2004a84234d62ff2eb66462ab007c4e41.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\rundll32.exe C:\Windows\system32\font01.dll,CheckIME
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\font01.dll,CheckIME
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xydh.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xydh.bat

Path C:\Users\Admin\AppData\Local\Temp\xydh.bat
Size 1024B
SHA256 d2adeeef9087a2dc307df3585a64db2683888f39b5ad12431488ce16d3f58651
MD5 fe720f9dac59e92792d58756b399a2c3
SHA1 5ac5864b80bc47ef2ba14c0ad36776d834af95aa
SHA512 3abb0853935280ea5b49cd150b0c53e1670ddcabf9f1f6e07e514e7eea63b6abdc398be10354b15b77f3d5f45f7325c94471ba5696c179eafc1ab47229d4f4ba
TLSH
T12711261481CE4AAED850E43B0A754E2CE26228992F8527064631CECC16658DDB293318
MD5 SHA1 SHA512 TLSH

Submit Download

1002.ocx

Path C:\Windows\SysWOW64\1002.ocx
Size 5KB
SHA256 f11b74cd5dd35f4b18a904783feba8f5137c348c448ea0d212b66a29236e63df
MD5 c8fdfcf2f9a67381c5f089a5bc21125f
SHA1 4a1fad531384adb0601fd28ba7c190af0951f3b7
SHA512 541c8c78564d369610e2e54bf5a32ff4ce47b912aefad7a523ac70f591bafa9efad18c43664aefaaa8a863b203a8b7431d8d306bf922d47089204c6b3db66001
SSDEEP 48:ql7o/WcB2KU/hlviXiXZgSsKLKBkUP6M8Bv3Oub2bD+1s5cyh:maWywliXiXckULuie1wcy
TLSH
T170C1E73647C144F3D8A81F3F02AB6AF7B678A9309B50418E4AA7E4742623913E46D362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

font01.dll

Path C:\Windows\SysWOW64\font01.dll
Size 24KB
SHA256 45f0e06b7f6c3a8477139b92bb5efa8e90af582cfe12f1bdea5a1d2dad24f524
MD5 76a4e10807c9c2df57fc43de0e7d9d09
SHA1 f7677828663f61cbe1789b621b48407ee1f0ee00
SHA512 a679d448f50f1ad9ec336fd91a8b5b008ffc9ba24c202eb9e3263f5bd5c535da5369562ff51460022776b65d1feaeafff3f1deabcbbff76bb08f115da97c5639
SSDEEP 192:Nul+weU13VFEpZ5vOZnZdKOOjFbXZ79XK7m3rY+:/we4Ep7OZZdOtKK3R
TLSH
T1E0B2C7357BDA08AAD95F0A702E9615325277BC311B1050B68B7351C5ACB1BF2EF3230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads