bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821

General

Target
jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
Size 197KB
Sample260925-2k2k3a1vex
SHA256 bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821
MD5 c9e51a6a16bdd2abe8d1e352f3e6efe7
SHA1 a72e27d5ed7b98955fe3682fd49646fa0b0c28f4
SHA512 2b09505e6afce44fca59d26373933cad6cae669354909682f3447b7f7a01314460948e643b755fb38315ed49d9038a735ec74f3356b772359cc38ad14eae32ba
SSDEEP 768:eGnAwLa0RG9G6M4Au7Dm6LOKWDXcAyJ7SIpqfAKB:xLLa0u3AuZ7WDsAy5SIhKB
TLSH
T1EA14D702A9D784A2E689017831513F3EC7EE9734136347978F31CBDA2EA9CD6D93C216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5988	gth69338.exe

Executes dropped EXE 1 IoCs

pid	Process
5988	gth69338.exe

Loads dropped DLL 2 IoCs

pid	Process
4896	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
5988	gth69338.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmsfc1.dll	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
File created	C:\Windows\SysWOW64\ComRes.dll	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
File created	C:\Windows\SysWOW64\gth69338.exe	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fOntS\ComRes.dll	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
File created	C:\Windows\fOntS\gth69338.ttf	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
File created	C:\Windows\fOntS\gth69338.fon	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gth69338.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4896	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
4896	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
5988	gth69338.exe
5988	gth69338.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5988	gth69338.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 5988	4896	jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\gth69338.exe
  C:\Windows\system32\gth69338.exe C:\Windows\fOntS\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bac2a21e7e668701b43d9a72dc8555b94eb672068bcae11e4ca774760ae3e821.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gth69338.exe

Path C:\Windows\SysWOW64\gth69338.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmsfc1.dll

Path C:\Windows\SysWOW64\mmsfc1.dll
Size 20KB
SHA256 17fba410831c77a2cb36282454cb5b60ca56639e40add124a211e4d8c1f5028d
MD5 16153d3321d5ae42238304b30a367537
SHA1 0a7ee7b3464f6ea2aed2575959b613ac63844919
SHA512 60d38b5593822d7d574b4164d1330af24ed630c75f3061128ba9f54a029ea896ae6ae8f16af764d086c4f38195227b6f69b2f012aacbe66e33b0a35a28758d39
SSDEEP 384:h4WKi+1MvBbXSwWa0TINWe8WL0DBRJz7nR9z29:pKY5WLITt01Pzt9zo
TLSH
T1F5926E92E7280952EDDA6970219CF9573E3C5FD10B0050E79DD6E9941C663C2EE307BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComRes.dll

Path C:\Windows\fOntS\ComRes.dll
Size 156KB
SHA256 097747eb5f1ccd26f2702c00f203e8c34bd9f7b914edcc02ccabf4538e8aaf07
MD5 615d4a31846add4208fc9e861e615954
SHA1 80d5324d7d1aacf800efd008b2f23d59531ff5e3
SHA512 9648c3b0c82295ed2a6db8c2562e24b9f52c4861e0df76273b8fa93581d9d5c2a189a0a73ab7209bb039c489ec0b9274b0833b7f5d57a859bc69656c0a4966c4
SSDEEP 192:46MNdQ9r178Ufk5yrZVpDvebeh5t8GGks:46MuhbkYZ7Dvebiz8GZ
TLSH
T103F36052B6E809D2F18106BC36B03E3CC38BD43497A4875B4F59CBDB6D9AD91DA38172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4896-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4896-6-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5988-9-0x0000000010000000-0x0000000010016000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads