f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390

General

Target
jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Size 60KB
Sample260925-2s5mpaydjd
SHA256 f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390
MD5 4a101267912fa96d4c22c4076d7b00ba
SHA1 e9cd2bbd06601aff74eaf02eb99a135d9c855eaa
SHA512 9ae61af4fac344bee9dd73d720b82a62b449443d74e372f6aeea51c4f0ada26c7e4a27f2856454346beb38659a3dba3cabe0f45cb2c2d28be84d8b2c23488e7b
SSDEEP 768:XIz0uKz/bjxqa2pCXhxmRg/fbbRS0jYERk0pMPHvDpGKBNvM:XiGxmRKfblTMPHvcKBNk
TLSH
T1CA536C136BD040F2C3AB10306D292F37E1FAD2355FA619A397604A4D7D726D6E336B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4372	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Imm32.dll	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
File opened for modification	C:\Windows\SysWOW64\Imm132.dll	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
File created	C:\Windows\SysWOW64\Imm132.dll	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{38601915-A80F-6318-45F6-18CA8686178A}\InProcServer32	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38601915-A80F-6318-45F6-18CA8686178A}	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38601915-A80F-6318-45F6-18CA8686178A}\InProcServer32	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38601915-A80F-6318-45F6-18CA8686178A}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imm132.dll"	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38601915-A80F-6318-45F6-18CA8686178A}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4372	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4372	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 5728	4372	jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f6f2067e1cec92392cb1b040b69f17fa13c56b19013695d6ba7ee38699305390.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cas.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cas.bat

Path C:\Users\Admin\AppData\Local\Temp\cas.bat
Size 282B
SHA256 3469e7efc8cce91da6b3ba163c3c48aaca824ed3ffcc7d6f90bb99c8ed8f4bfa
MD5 61dfcc3361e7227befcf9dbf10212d97
SHA1 580ea2bbeae2fc8428e5e4045bc9bc1a99277ea4
SHA512 e0cca504c76df4b7236d7d8623ce2468a017cfd9cd462a6bf7b2b0eb4e316e84b75988f39bb4d5175acafc8c4cf8285023da94e8ad719a437f3b5db8d811e1ea
TLSH
T136D02B84813740DDC50CD87F416E7E4FF18089E72E8F3F0A2A31C1A85092139FD81300
MD5 SHA1 SHA512 TLSH

Submit Download

Imm132.dll

Path C:\Windows\SysWOW64\Imm132.dll
Size 36KB
SHA256 072fbb0dc6cbba988c2a4c12197850984b9e8670a159e8c2fe3584056902fb6a
MD5 ad494fd95d3aa0de800f6d4431f9ae16
SHA1 0a6b2afabd6e315b7f535c61506ada68e701bca4
SHA512 7300048726e7f87baedf5b9255b57deb95d2f86908e264c8ebcf79562d1236469c5d4537e551f066164dcfd354c8a653230e2bbd6fca938c7e5fe422326281f2
SSDEEP 384:K9DfuGUTJcQg/eKbbRcKgqXD7yYYEGd+LO1Q3/pBuPHvDrtC/BjwkPEXBWuv:OmRg/fbbRS0jYERk0pMPHvDpGKBNv
TLSH
T12AF24A125BD180F2C3AF1431AE2A2B37E1F982356FE8099357714A8D7E716E6D336721
MD5 SHA1 SHA512 SSDEEP TLSH