666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f

General

Target
jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe
Size 388KB
Sample260925-2hmdcs1va1
SHA256 666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f
MD5 822b71103ce73753fc2b3459c260da06
SHA1 760e3cccf46125c6e87d39f5c4071c8857e0510c
SHA512 94dd856c4454cff444cb3a58f099d0d1279ca0c1e16f2b4a67d25bd7a32ce0219206897e0a5736b8a8ae4fcd92a62c140df4f68c7f95d3743c74264c14529fd2
SSDEEP 12288:NKARypleeeGB9zN8qIKpxGnkdxa92t0EOkeT1:NbRypwZGBhdpYkLCwneT1
TLSH
T155849E22F7C14476D0625A789C2AE77E9A3EBF202D386547B7E81E0D4E3D7C168183D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DRATSer\Parameters\ServiceDll = "C:\\Windows\\system32\\\\System64.dll"	jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe

Loads dropped DLL 1 IoCs

pid	Process
2432	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KMe.bat	jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe
File created	C:\Windows\SysWOW64\System64.dll	jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe
File created	C:\Windows\SysWOW64\System64.dat	jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1224	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1224	4188	jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_666d509b83eb7a246de475380108a6814a4f1a9859da7e2f57c1d85b8ccdba2f.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\KMe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1224

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netservice
1⤵
PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KMe.bat

Path C:\Windows\SysWOW64\KMe.bat
Size 132B
SHA256 308c816d9c72457dd2d3776e98cb535b6a5720c5d5b795744157b2d2cab1297c
MD5 8e8538efb5443bd6533d689d40a8fe71
SHA1 b0d47b86ebf54c28cea3c430cadf4c118ef236b4
SHA512 d456114dbaa7da98c82a1ffbd102b61944660e5b0b35d26ef7383ecb4e1f2a7b544e614535e8ef2901583bda75991e610f9b04b8fb29c4e70045ef2dc97a16c8
TLSH
T187C02B40835749210404C4071C20DA0FB45004163F8ECE850114A1DC048049E91C0785
MD5 SHA1 SHA512 TLSH

Submit Download

System64.dat

Path C:\Windows\SysWOW64\System64.dat
Size 65B
SHA256 2427f994c3c4443f7860531c0b3879042404c0f8ae28fcfb8a69a2e0864bccc2
MD5 4a682e75e4b27c47f66b484805195422
SHA1 fd7c6e9955b3c5290e41a933611fc508aa4bba44
SHA512 a92bc9edf112f9b5df92b3144bc0b8d5bfcce62b0e1ead763c6c8a5478884c4009b0a316ebaaa3ed50921a7867840f9222455be5e50913ca82f63aeacb1da501
TLSH
T1C4A0028052D245131C31442456601D001950B75144A06D39566E7FC47A4F698A0999DF
MD5 SHA1 SHA512 TLSH

Submit Download

system64.dll

Path \??\c:\windows\SysWOW64\system64.dll
Size 289KB
SHA256 f9b95a417cac12d49550fa7d164aad939e853034f0babec650098f512f593eaa
MD5 94e39892ebdd6ff6ca0f1914658eff35
SHA1 f85c2900b6078109cb831f87d10bed4f66df2610
SHA512 478131cdb3fe7b34cf7a3d3877e7396b40ce1ccdba2f013c732cf04a51fe36bcc48ad98643104329209a29f82d6759c0c327964a3beea52d1b5554cf5de4a0e0
SSDEEP 6144:syeig8B9zNArqIKpSOBGnKaID/qhoaxexr2Wda2t0EdiDkeTBT:sGB9zN8qIKpxGnkdxa92t0EOkeT
TLSH
T1FF549E21F7C1447AD0525E389C2AE77ADA3DBF202D386547B7E81E0D4E7E2C269183D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-10-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2432-16-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2432-22-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4188-6-0x0000000000400000-0x0000000000467000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads