633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d

General

Target
jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe
Size 62KB
Sample260925-2rcwaaycpf
SHA256 633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d
MD5 3514c1816ad66c2ef5571e84e73040d1
SHA1 95fe14bdf8b9938d34424d42907f94ee6da7d23b
SHA512 a601af08400c402ea7c4994be3e9656d0321f195a5fac7449520bc85efe7d5c5991d3f446d44094a897dc1acf4fab74cd5af85b2a624662d0668635aeb226faf
SSDEEP 1536:6MgwgxPmq49y3QGnTTH9ZHvpF8SIhFmj/2wZV:kxPmqsy3QGnTTH9ZHvpF72m+gV
TLSH
T105538E03258948B1E76D1334346B6F3EE67E22B417E159D79BA3C89A98BF1B1F134183
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence vmprotect

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5588	rundll32.exe
5588	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000e00000001c60e-5.dat	vmprotect

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sfcos.dll	jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe
File created	C:\Windows\SysWOW64\systemp	jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5588	rundll32.exe
5588	rundll32.exe
5588	rundll32.exe
5588	rundll32.exe
5588	rundll32.exe
5588	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 248	4712	jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe	91
PID 4712 wrote to memory of 252	4712	jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe	92
PID 252 wrote to memory of 5588	252	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_633a07dac6338ddff18209411d95aa4fc2f4fd2191c96cb2a1305b80da5c640d.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\sfc.exe
  "C:\Windows\system32\sfc.exe" /REVERT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Windows\system32\s7am.ime,Runed
    3⤵
    - Loads dropped DLL
    - Modifies WinLogon
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6519.tmp

Path C:\6519.tmp
Size 51KB
SHA256 73013f4f769ee6a7c876752ed6cbdd0ddb3c3752c43e5ad1a3aa1aff73a1ebf1
MD5 991e6c629115bf2e32c1fe0e66a6225a
SHA1 38a604a58a2f14a1cf11fc5ac1cbd688c44d13d0
SHA512 22f192b408ebb74cfaccf025733c2c0c7ae5806ae506ea33db6ea6ba45323992abb8c97fff4ec2017c6874989e72a347b8645de91f4ef7de36b3e9e516588860
SSDEEP 1536:FxPmq49y3QGnTTH9ZHvpF8SIhFmj/2wZVO:FxPmqsy3QGnTTH9ZHvpF72m+gVO
TLSH
T192339E12158654B1E36E1234346BAF3EE57E16B42BE44DD397E2C89A58BF2B1F134283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfcos.dll

Path C:\Windows\SysWOW64\sfcos.dll
Size 20KB
SHA256 17fba410831c77a2cb36282454cb5b60ca56639e40add124a211e4d8c1f5028d
MD5 16153d3321d5ae42238304b30a367537
SHA1 0a7ee7b3464f6ea2aed2575959b613ac63844919
SHA512 60d38b5593822d7d574b4164d1330af24ed630c75f3061128ba9f54a029ea896ae6ae8f16af764d086c4f38195227b6f69b2f012aacbe66e33b0a35a28758d39
SSDEEP 384:h4WKi+1MvBbXSwWa0TINWe8WL0DBRJz7nR9z29:pKY5WLITt01Pzt9zo
TLSH
T1F5926E92E7280952EDDA6970219CF9573E3C5FD10B0050E79DD6E9941C663C2EE307BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemp

Path C:\Windows\SysWOW64\systemp
Size 4KB
SHA256 bb4e63a3f14791269342b53bddbac69f67d2009d0f3af108d97103431d674a16
MD5 b639e4d075d818c04d213552301c6cba
SHA1 aff684b72bc5423aef9cfd8e616f2e422693a6d9
SHA512 a7efa62982da961c97b0b00287d71d1c6bd9e797dbc8c4acd31fa44d6250a71031148e2ed50d120af4e709f7737beec8a643668629496b0c40911ac34ac67c54
SSDEEP 24:eNGSj/noW0l4rRvMQQlo/dRAVCR3t4U4lXDvDkfOQzpxmGoEtnlVjC+pxJsDX:ajfo/laRbwol+VtlzrkfNosnPjni
TLSH
T1EC814237BAD01972C01817376EFB20F778B6B5407FA155198C4285197912133EE6CB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path \??\c:\del.bat
Size 195B
SHA256 5672cc821af8825d6170c22353ab5449983b11bddc436e4fd9fc2faa2af35331
MD5 d795e65ccb4f6ef2459774cc666b3904
SHA1 8c7dea2113ea4c6a65e2de4fdcddd0fea6fd2504
SHA512 9de7dca8658ee0400dc8941cf6f94bee0531931d98eda1fd0ee5b4ecd2c539099fb04f57a32fcca250fafcc49c6837bb567cd37a0f243e815b7d148798262a2a
TLSH
T1CAD02201C2C772668CD0273609D19A4CC221E4AC270E3A31EA95C168702380DE652A48
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads