b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6

General

Target
jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe
Size 52KB
Sample260925-2ablwsxhph
SHA256 b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6
MD5 c7a7110d5039d3297359f49a399be06c
SHA1 a68d20496ca9cbdc6f817a91b47f5c4dc76fff03
SHA512 4875957b22e9a7a4d05eb25df81a93aec41a982294c95cb913f7fb0414bad0267b8df4ec47340f2506fb93db24ada9161ffa73855d49962bc3aa9bce6d1b5621
SSDEEP 384:cqBZqICYfFvd3kWVygqBKRO1pb5s4VmW8qaMrn7GPWZzS5jL1WwKg58:c075z02QzbiqaMr8WhYjL1WpgW
TLSH
T115332A42DA4608E1FB99493031DA3FBBC93D3B711246B1DBDB22D96818771E2F62D247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4440	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sys.tmp	rundll32.exe
File opened for modification	C:\Windows\sys.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3768	cmd.exe
4752	cmd.exe
1028	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "regedit.exe /s \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1632	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 3768	3964	jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe	88
PID 3964 wrote to memory of 4752	3964	jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe	89
PID 3768 wrote to memory of 4440	3768	cmd.exe	92
PID 4440 wrote to memory of 1028	4440	rundll32.exe	93
PID 1028 wrote to memory of 1632	1028	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c rundll32.exe C:\Users\Admin\AppData\Local\Temp\zt2.tmp1 St C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\zt2.tmp1 St C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b588001795d80a5cbeb0672d5ba818d94a56b596744d792e3ccf9ab9aa2f0ba6.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\a.reg
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Windows\SysWOW64\regedit.exe
        
        "regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\a.reg"
        5⤵
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Privilege Escalation

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.reg

Path C:\Users\Admin\AppData\Local\Temp\a.reg
Size 152B
SHA256 3db613d24a75ae220891698c055e1c580a42e58564f568a0510db87581cc2042
MD5 b100f5324ef74ded0b998e64d07a2e19
SHA1 40b0d7f51bf2dd8451f1b723d21355c471a5fa46
SHA512 c12391bb37c334074f7d7e1257b6364fd5cbce848e0a8fe15b8326f54fd9568fe3baec58618c4334027a774a06a08ec249cb71db925c1f85feee6a3d3a816c04
TLSH
T1D9C08C9488358202D1F1AE100A8F864233F1832A3887A6102084E1C17A919C7816D2FA
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 400B
SHA256 d627e8fb1fdf2ff6606b5f561143894b98631b159e95b9891fa631203706feb9
MD5 61472b8f392a6ae4d6dd07c1aa640147
SHA1 aa732f847cf11ac2b4854870b9c05c8dddd06420
SHA512 8a144bb84ae4778c2ef371b0aa8c69a19c7d1a6b607b46d73a6894a6822e10ef0d78d8c27198c9b593d8b67a50e2e21aeeee46410db8cc287fbd047099da22ec
TLSH
T1E4E02BA783C3C5FCECA0D53758B5130547AD87051B881F316731CBA632D201C95C7300
MD5 SHA1 SHA512 TLSH

Submit Download

zt2.tmp

Path C:\Users\Admin\AppData\Local\Temp\zt2.tmp
Size 32KB
SHA256 9acea247e025ec85321d3e1926e5d5a7eafdec28bf4eea33acaa87f45351f9a2
MD5 4786771d1285366cd5ccf3bd1ce947a8
SHA1 26627647f7bc12a212d904ca4d1ef28bcdde45f7
SHA512 5fe9a8633ae07143c0cd293a872a8a5f246c11f85fe4ed3e8db5caf5e0ff770ff53e83832d57bb0743aa804e0410e3b56690ae90594fce73581639e4775c0f5a
SSDEEP 384:DygqBKRO1pb5s4VmW8qaMrn7GPWZzS5jL1WwKg58:DQzbiqaMr8WhYjL1WpgW
TLSH
T15AE21A42DA5618E1FB99493030C92FBAC83D2B75118AB196DB22DD6818771F3F32D247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads