008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9

General

Target
jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe
Size 64KB
Sample260925-2rs79sycrd
SHA256 008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9
MD5 5566896f0a2525bcabcf90ca46295eb7
SHA1 e5ef2a4314ee608a0f0e4987460bf3354bacd2ec
SHA512 6ea0fb8e9ad0d56ef2c7460061a34d4d87f7a3efa9fc0c887890add72bfa0fd71cbe2985f3833f2643a6b7c06daafabba992319fabbabcb90d91fadcf4d37d20
SSDEEP 1536:Ie5B3goiIVG3anJcfcHWzV7ImJ+hOoDkxBu6Lld9y:eSVG3anJcfcHWtDJtqyB5Lld
TLSH
T1D6538E03258504F2D71822343457AF3FEA7AA570279598D75B53CDF9A87E2B6E838283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence vmprotect

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1920	rundll32.exe
1920	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x001500000001c434-4.dat	vmprotect

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sfcos.dll	jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe
File created	C:\Windows\SysWOW64\systemp	jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	rundll32.exe
1920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3272	3380	jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe	89
PID 3380 wrote to memory of 6056	3380	jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe	90
PID 6056 wrote to memory of 1920	6056	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_008825f05fa76b848981dd3d1a2bc46f1b504d4cb478af62f8b6a445274299b9.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\sfc.exe
  "C:\Windows\system32\sfc.exe" /REVERT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Windows\system32\s2am.ime,Runed
    3⤵
    - Loads dropped DLL
    - Modifies WinLogon
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

119A.tmp

Path C:\119A.tmp
Size 53KB
SHA256 c3163f435fb503161000de19cb0e90cf0cd997a5a9f813cbd491aa066429c42c
MD5 e850a87b5e13df5374801ec94ffa4b08
SHA1 863bd8697a2d5bc40bedb2088617b8ec0e2ab0ae
SHA512 7aa4992303e75f2537c4dd81ebbb12399656ec47f51b49128aa93cebf625981576d076126110ed4d0cea779abc4960dcd5bfcc7a45083fc9a10b2039fb83ef8e
SSDEEP 1536:soiIVG3anJcfcHWzV7ImJ+hOoDkxBu6Lld9y:sSVG3anJcfcHWtDJtqyB5Lld
TLSH
T1C9339E02258244B2D31922383457AF3FD5BA957027A599D39793CCB9687E3F6E8382C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfcos.dll

Path C:\Windows\SysWOW64\sfcos.dll
Size 20KB
SHA256 17fba410831c77a2cb36282454cb5b60ca56639e40add124a211e4d8c1f5028d
MD5 16153d3321d5ae42238304b30a367537
SHA1 0a7ee7b3464f6ea2aed2575959b613ac63844919
SHA512 60d38b5593822d7d574b4164d1330af24ed630c75f3061128ba9f54a029ea896ae6ae8f16af764d086c4f38195227b6f69b2f012aacbe66e33b0a35a28758d39
SSDEEP 384:h4WKi+1MvBbXSwWa0TINWe8WL0DBRJz7nR9z29:pKY5WLITt01Pzt9zo
TLSH
T1F5926E92E7280952EDDA6970219CF9573E3C5FD10B0050E79DD6E9941C663C2EE307BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemp

Path C:\Windows\SysWOW64\systemp
Size 4KB
SHA256 b84ad541ce594e209ec98583734e751f39a14c9c1128966b3184d313169db045
MD5 ccf2b5b4ee45fb8d3186f23e66c32737
SHA1 5cdcdfa1dd78c278520a5f041b295ab0fb9ee185
SHA512 04c5c8fe4177065e80d722657d69b15c552592d1a88babc0773017739c2e20933428e5ca47f2e0e71cd27a1c1cc41bacbc8d963eef8469ce88f90c699775069d
SSDEEP 24:e1GSwHZnOW0l4rRvMQQlo/dRAVCR3t4U4ln71l71dvqDpxuH8StnlVjC+pxrIsDX:SoQ/laRbwol+VtlB7dCGH3nPjnrn
TLSH
T1F3814277BBC01573D41857336AB721F738F676416BB206198C8142157512133EE68B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path \??\c:\del.bat
Size 195B
SHA256 8c3b820ff382f6cb5fe7499eb5486632cb6af091c63a97b5551708e3502d65d4
MD5 f8e23b2ba6e83df5306e5d1183c0b72b
SHA1 0846d8b6135d89a9c0ff0f474826d59de852231b
SHA512 8af2c0a3a90d2a876058d1662b25bb1b9b18c282d70b3656750d84aff4c2c03a051e7ab9e9e3d2190c5b4d74227736539ff825c6ea4828d8d5bb1ae994cc9194
TLSH
T109D02201C2C771669CD0273609D19A4CC121E4AC270E3A31EA948068702380DE652A48
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads