d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db

General

Target
jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
Size 88KB
Sample260925-2tatpsydjf
SHA256 d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db
MD5 dd3ea1303aed8aa1da0bed5963b2fef4
SHA1 092bb9ecd1d00ca2e8ce8cc42563bc292d494031
SHA512 52e3ddd20e0b222e379a6dad141bd389da4ac39dc229b63e3a5b4ebd78894add062494f5b32336925c5a7d61d4640aa7829c530ff519f1c59f0a7a70d0b16a3f
SSDEEP 1536:fSdzpFuNudDV1vfxZ5yO/Z59jnIADpl/wDZ4hkyd3xQA:adzLqudDV1vtyO/Z59jnIIl/wgkydh9
TLSH
T118938E03268988F2DA5D127034972F7FE779726067A29A832F52C96C5C6B173ED39343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence vmprotect

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4420	rundll32.exe
4420	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000e00000001c4c9-15.dat	vmprotect

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\systemp	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
File created	C:\Windows\SysWOW64\sfcos.dll	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\TenSLX.dll	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
File created	C:\Program Files\Common Files\ImeUtil.exe	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
File opened for modification	C:\Program Files\Common Files\VulInfo.dat	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
File created	C:\Program Files\Common Files\Tenparty.dat	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
File created	C:\Program Files\Common Files\fszww.dat	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
File created	C:\Program Files\Common Files\TerSafer.dll	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5156	4420	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4180	2104	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe	89
PID 2104 wrote to memory of 4700	2104	jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe	91
PID 4700 wrote to memory of 4420	4700	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7b09d56aaec6f0d16fac9f64340df2fc3903278b34bc8fb283803352b5f02db.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\sfc.exe
  "C:\Windows\system32\sfc.exe" /REVERT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Program Files\Common Files\Tenparty.dat",Runed
    3⤵
    - Loads dropped DLL
    - Modifies WinLogon
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 608
      4⤵
      Program crash
      PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4420 -ip 4420
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tenparty.dat

Path C:\Program Files\Common Files\Tenparty.dat
Size 24KB
SHA256 14cd86797106d7264657c21bb9ebea994516707c0a97d72ee0971f169f458a08
MD5 dc19678a207b6089a9ee2e4116a3620f
SHA1 1aa261c38c7ef31b25abaa4df7d3f18ca9857781
SHA512 e049336508c3be568debd1013b4f2b17076d8c01ed2dd095a85eccead92e9eb05b4a022347272e81ac263cbdd8f8881fecf25ef77edd40272cbac44f4dcca79f
SSDEEP 384:4tIVMMc9Cg1vuOUy1UDbgsuxfXoAeqIxapBdQs7ExvV9WAqLig80AHBEEexh:4tIVMMccgRdUAWgsudDIWT7ivK+ifx
TLSH
T1B1B26C037784C4F6E16A527020971A7FE7B5B274B2A7AF872F91CD1410A72719D3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VulInfo.dat

Path C:\Program Files\Common Files\VulInfo.dat
Size 119B
SHA256 8e1aa4a60855b9a004b167ecf2f3a135995f5f4e08f3741b86ebc4cade5607f1
MD5 c09c01aa6c9cb26ebab8646b082b72a2
SHA1 323997bf7067961891179f8b6f6cea00e95c50fb
SHA512 c7c2a50ce3e899b694adcd6266490599f25e27a5c5a6e41be286a08b7cd037fbada7d5aff666835a565a5d6fe1c1573972e535f703af5f184b1474faf55a4249
TLSH
T164B09235B670EE8ED5C714AC2E8600C532A8382A48D3E141D02B30A618E06A0270EEB2
MD5 SHA1 SHA512 TLSH

Submit Download

sfcos.dll

Path C:\Windows\SysWOW64\sfcos.dll
Size 20KB
SHA256 17fba410831c77a2cb36282454cb5b60ca56639e40add124a211e4d8c1f5028d
MD5 16153d3321d5ae42238304b30a367537
SHA1 0a7ee7b3464f6ea2aed2575959b613ac63844919
SHA512 60d38b5593822d7d574b4164d1330af24ed630c75f3061128ba9f54a029ea896ae6ae8f16af764d086c4f38195227b6f69b2f012aacbe66e33b0a35a28758d39
SSDEEP 384:h4WKi+1MvBbXSwWa0TINWe8WL0DBRJz7nR9z29:pKY5WLITt01Pzt9zo
TLSH
T1F5926E92E7280952EDDA6970219CF9573E3C5FD10B0050E79DD6E9941C663C2EE307BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemp

Path C:\Windows\SysWOW64\systemp
Size 4KB
SHA256 0de147e369ced2623b07467c67796797c79c4f96bf2fb41c26fae687f0e5ca54
MD5 ac83333b9722040a8e70f76d0ea7cd7f
SHA1 238521ad3ff07d9e0e1eab15b29377135fda59ad
SHA512 b6ad1f5e1dc8c5e83f76c237008e0d137d289358c9a3af29b57a100c3b5c483728cca754c215983db808f7bc49d50b309e6e34fd8cac0752003494c1a11604e1
SSDEEP 48:allX7tJydQU4ElD+YRnmjkakbqtQfu+Tc1udCf2H2jZunD:4t8+EB9RmHpYuyCOh
TLSH
T12C918472BAC145F1F4481973661236F378EA7AB84B7600094F429A317C16A7BE92E303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path \??\c:\del.bat
Size 349B
SHA256 998fcb41acf347eb76045ae54f9ee9150a2cdb191bdad31bf936ecc3c337fbf3
MD5 fb1752df253b86e52ad9f95e4a4d1276
SHA1 f24f9eb808fb01bd7a0dd20e16fb384da2f3d2e8
SHA512 56139a1ff9746c0261a38480bbf4c6159fac5390317b1b2428a7119677d27475c8251175f4f0048bb62a83a2726b98b729e7cd8cf86d0be536b9595cacdd9bfd
TLSH
T17AE020215156F7595C21741B4A703E0FC55D8D9D4B083F314E10CA8F2167B3DB655145
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads