d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0

General

Target
jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
Size 34KB
Sample260925-2np2fa1vg1
SHA256 d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0
MD5 a2726b9f6ab28d5695ac892eedbfa6a1
SHA1 5dd5ab6ecc0ce29ad4aaf42f73cafedcb3aa5079
SHA512 e3056c737ec3c0c5f28ec99bda3fa69293dd8b58a3149d7c7b45c195b2fe292c9756add02c9d2ac5128641a84c23a877e701da429db148f22a61c04891efc4c7
SSDEEP 768:ftXQnGjTfbXccQdavRRzEcxZRMy+MZLvVWEwf0lBWQkJPwA:tsU3scQyvzPHcST36JPw
TLSH
T1EBF2D0DBAD998FE7E180267792DCCAB8205BA0701F7A8E41AF3811AF64FE710009DC55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001c465-6.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4328	myInsDll.exe

Loads dropped DLL 2 IoCs

pid	Process
4328	myInsDll.exe
4328	myInsDll.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SfcDisable = "4294967197"	myInsDll.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Unamsmqnws.dat	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
File created	C:\Windows\SysWOW64\dnfwg.dll	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
File created	C:\Windows\SysWOW64\myInsDll.exe	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
File created	C:\Windows\SysWOW64\sfc32.dll	myInsDll.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2680-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/2680-5-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/files/0x000e00000001c465-6.dat	upx
behavioral2/memory/4328-8-0x0000000010000000-0x0000000010108000-memory.dmp	upx
behavioral2/memory/4328-11-0x0000000010000000-0x0000000010108000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	4328	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myInsDll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4328	2680	jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe	90
PID 4328 wrote to memory of 4256	4328	myInsDll.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\myInsDll.exe
  "C:\Windows\system32\myInsDll.exe" dnfwg.dll,abcdefghjk C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d973aa9a40683d9cc509737e435f18752700abade8f4c2ef75849d377070c6e0.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\sfc.exe
    "C:\Windows\system32\sfc.exe" /REVERT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 804
    3⤵
    - Program crash
    PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4328 -ip 4328
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dnfwg.dll

Path C:\Windows\SysWOW64\dnfwg.dll
Size 30KB
SHA256 00d658968a19e89936dd9db334dda9e4e372852e9f63947436a5f0a03ffdd6a5
MD5 d45ac07f17b08069cf0dc9a9d75f42b6
SHA1 8d4d844558ef64f0e6289f5922c7428fcaad1bc9
SHA512 aa672fb73d988e38d3a3af9158698b469016fea818c196dbe61df9348e1fc4229dacb21250d1f7768b9f2bf8f4d119f90c8a99cb68d148d538c2742bc3f48e49
SSDEEP 768:8XQnGjTfbXccQdavRRzEcxZRMy+MZLvVWEwf0lBWQkJPw:+sU3scQyvzPHcST36JPw
TLSH
T19DD2D1CB98D89FD7F1502BBBE298CDFC2057A0602E6A8D41AB3811AF64FE75001DDC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

myInsDll.exe

Path C:\Windows\SysWOW64\myInsDll.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfc32.dll

Path C:\Windows\SysWOW64\sfc32.dll
Size 20KB
SHA256 17fba410831c77a2cb36282454cb5b60ca56639e40add124a211e4d8c1f5028d
MD5 16153d3321d5ae42238304b30a367537
SHA1 0a7ee7b3464f6ea2aed2575959b613ac63844919
SHA512 60d38b5593822d7d574b4164d1330af24ed630c75f3061128ba9f54a029ea896ae6ae8f16af764d086c4f38195227b6f69b2f012aacbe66e33b0a35a28758d39
SSDEEP 384:h4WKi+1MvBbXSwWa0TINWe8WL0DBRJz7nR9z29:pKY5WLITt01Pzt9zo
TLSH
T1F5926E92E7280952EDDA6970219CF9573E3C5FD10B0050E79DD6E9941C663C2EE307BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2680-0-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2680-5-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4328-8-0x0000000010000000-0x0000000010108000-memory.dmp

Download

memory/4328-11-0x0000000010000000-0x0000000010108000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads