d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0

General

Target
jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
Size 34KB
Sample260925-2np2fa1vg1
SHA256 d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0
MD5 a2726b9f6ab28d5695ac892eedbfa6a1
SHA1 5dd5ab6ecc0ce29ad4aaf42f73cafedcb3aa5079
SHA512 e3056c737ec3c0c5f28ec99bda3fa69293dd8b58a3149d7c7b45c195b2fe292c9756add02c9d2ac5128641a84c23a877e701da429db148f22a61c04891efc4c7
SSDEEP 768:ftXQnGjTfbXccQdavRRzEcxZRMy+MZLvVWEwf0lBWQkJPwA:tsU3scQyvzPHcST36JPw
TLSH
T1EBF2D0DBAD998FE7E180267792DCCAB8205BA0701F7A8E41AF3811AF64FE710009DC55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000244c5-15.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	myInsDll.exe

Executes dropped EXE 1 IoCs

pid	Process
736	myInsDll.exe

Loads dropped DLL 2 IoCs

pid	Process
736	myInsDll.exe
736	myInsDll.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SfcDisable = "4294967197"	myInsDll.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Unamsmqnws.dat	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
File created	C:\Windows\SysWOW64\dnfwg.dll	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
File created	C:\Windows\SysWOW64\myInsDll.exe	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
File opened for modification	C:\Windows\SysWOW64\myInsDll.exe	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
File created	C:\Windows\SysWOW64\sfc32.dll	myInsDll.exe
File opened for modification	C:\Windows\SysWOW64\sfc32.dll	myInsDll.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4396-2-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/files/0x00080000000244c5-15.dat	upx
behavioral1/memory/4396-19-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/736-20-0x0000000010000000-0x0000000010108000-memory.dmp	upx
behavioral1/memory/736-25-0x0000000010000000-0x0000000010108000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4464	736	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myInsDll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 736	4396	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe	86
PID 736 wrote to memory of 4916	736	myInsDll.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\myInsDll.exe
  "C:\Windows\system32\myInsDll.exe" dnfwg.dll,abcdefghjk C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\SysWOW64\sfc.exe
    "C:\Windows\system32\sfc.exe" /REVERT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1120
    3⤵
    - Program crash
    PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 736 -ip 736
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dnfwg.dll

Path C:\Windows\SysWOW64\dnfwg.dll
Size 30KB
SHA256 00d658968a19e89936dd9db334dda9e4e372852e9f63947436a5f0a03ffdd6a5
MD5 d45ac07f17b08069cf0dc9a9d75f42b6
SHA1 8d4d844558ef64f0e6289f5922c7428fcaad1bc9
SHA512 aa672fb73d988e38d3a3af9158698b469016fea818c196dbe61df9348e1fc4229dacb21250d1f7768b9f2bf8f4d119f90c8a99cb68d148d538c2742bc3f48e49
SSDEEP 768:8XQnGjTfbXccQdavRRzEcxZRMy+MZLvVWEwf0lBWQkJPw:+sU3scQyvzPHcST36JPw
TLSH
T19DD2D1CB98D89FD7F1502BBBE298CDFC2057A0602E6A8D41AB3811AF64FE75001DDC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

myInsDll.exe

Path C:\Windows\SysWOW64\myInsDll.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
TLSH
T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfc32.dll

Path C:\Windows\SysWOW64\sfc32.dll
Size 48KB
SHA256 d9d8ce1b86b3978889466ab1b9f46778942d276922bf7533327a493083913087
MD5 98c499fccb739ab23b75c0d8b98e0481
SHA1 0ef5c464823550d5f53dd485e91dabc5d5a1ba0a
SHA512 9e64ac13e18ab0a518bb85b6612520645b5ab2c9a5359ced943813ba7344714999f25ba0e52240ad2d0c2fefc76552ff43173adc46334ff0b5dba171fb58e4e6
SSDEEP 768:iAHOev0jjN6n/6J0kQP6t/s8oDSwxgWK9I/WOMPbr6wD1Ped:iAuevh/6J5QP6Vum/9IubbPed
TLSH
T1EE237D91E6034171E7ED357021BCB27E2D3D5F05079144CBAB42D9AA99627C3BA3139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-20-0x0000000010000000-0x0000000010108000-memory.dmp

Download

memory/736-25-0x0000000010000000-0x0000000010108000-memory.dmp

Download

memory/4396-2-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4396-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads