23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463

General

Target
jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
Size 86KB
Sample260925-2tgl9aab28
SHA256 23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463
MD5 fbb8ea5969b801eece32ba73540f89a7
SHA1 590528e6b551effb2aa725f7a732a5be5756120e
SHA512 640c39912b4fe21710b7be1783091d0175e3200178adaafafeb20fb197ba7260cbb619124fa1e1aef9ac8b8dc6e6b636f50065a301e7ab43301f2dca62568dc8
SSDEEP 1536:XxdJ5suNudDV1vfxPZOqJ5LQt9yvcYm0pwl:hdJmqudDV1vPOqJ5LQtQ04s
TLSH
T1D2837D5336C848F2DA59127034A72F3FEBB932606762A9836B52C9AD5C6B172DC35343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence vmprotect

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5776	rundll32.exe
5776	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x001500000001c41c-15.dat	vmprotect

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sfcos.dll	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
File created	C:\Windows\SysWOW64\systemp	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\ImeUtil.exe	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
File opened for modification	C:\Program Files\Common Files\VulInfo.dat	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
File created	C:\Program Files\Common Files\Tenparty.dat	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
File created	C:\Program Files\Common Files\fszww.dat	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
File created	C:\Program Files\Common Files\TerSafer.dll	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
File created	C:\Program Files\Common Files\TenSLX.dll	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4056	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1824	5776	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5776	rundll32.exe
5776	rundll32.exe
5776	rundll32.exe
5776	rundll32.exe
5776	rundll32.exe
5776	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4124	3720	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe	89
PID 3720 wrote to memory of 4056	3720	jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe	91
PID 4056 wrote to memory of 5776	4056	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_23d6a2cedddc08850ed99f8f39484a0a040412e73aff8d4dbba823b23a89e463.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\sfc.exe
  "C:\Windows\system32\sfc.exe" /REVERT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\del.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Program Files\Common Files\Tenparty.dat",Runed
    3⤵
    - Loads dropped DLL
    - Modifies WinLogon
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 532
      4⤵
      Program crash
      PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5776 -ip 5776
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tenparty.dat

Path C:\Program Files\Common Files\Tenparty.dat
Size 24KB
SHA256 14cd86797106d7264657c21bb9ebea994516707c0a97d72ee0971f169f458a08
MD5 dc19678a207b6089a9ee2e4116a3620f
SHA1 1aa261c38c7ef31b25abaa4df7d3f18ca9857781
SHA512 e049336508c3be568debd1013b4f2b17076d8c01ed2dd095a85eccead92e9eb05b4a022347272e81ac263cbdd8f8881fecf25ef77edd40272cbac44f4dcca79f
SSDEEP 384:4tIVMMc9Cg1vuOUy1UDbgsuxfXoAeqIxapBdQs7ExvV9WAqLig80AHBEEexh:4tIVMMccgRdUAWgsudDIWT7ivK+ifx
TLSH
T1B1B26C037784C4F6E16A527020971A7FE7B5B274B2A7AF872F91CD1410A72719D3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VulInfo.dat

Path C:\Program Files\Common Files\VulInfo.dat
Size 167B
SHA256 912bf8cec37d2f80b698e55848a1f773c07e698c40bcde4a7616e8d8b10079fc
MD5 a89b30cd72ddc8aa2725a68f04cdf38a
SHA1 672a872bbc4f9eaba93de0a7fec43df4a8349214
SHA512 379b0b108b16fb85e0d7f5176e9a9e714e4a6624812c52f393697d1b3c543661d01b19c7caf78a174c8f4680e8170350cf495dd03ca06b4f13140220f3c91919
TLSH
T1C6C04C46FD450F2D3CC7208AAD5642C1A2A590E8DD0FD0009A5F40E6FDFA4E58F09538
MD5 SHA1 SHA512 TLSH

Submit Download

sfcos.dll

Path C:\Windows\SysWOW64\sfcos.dll
Size 20KB
SHA256 17fba410831c77a2cb36282454cb5b60ca56639e40add124a211e4d8c1f5028d
MD5 16153d3321d5ae42238304b30a367537
SHA1 0a7ee7b3464f6ea2aed2575959b613ac63844919
SHA512 60d38b5593822d7d574b4164d1330af24ed630c75f3061128ba9f54a029ea896ae6ae8f16af764d086c4f38195227b6f69b2f012aacbe66e33b0a35a28758d39
SSDEEP 384:h4WKi+1MvBbXSwWa0TINWe8WL0DBRJz7nR9z29:pKY5WLITt01Pzt9zo
TLSH
T1F5926E92E7280952EDDA6970219CF9573E3C5FD10B0050E79DD6E9941C663C2EE307BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemp

Path C:\Windows\SysWOW64\systemp
Size 4KB
SHA256 95831cf9a96ca1e22739a7095e75c415d1ec18d5959298391f94eb86fdad4f75
MD5 a3d367ea47388086005aad44a13ac33c
SHA1 89946d640d14a7e786f92f72db3c7bbaede75941
SHA512 790cd24c58ab203f9deda0d61f8586356e65fdd49cb1c646c14838a656e6a3981583bfd8ae931845478a3bbb0cccde0fa485b322da37c8554d9aea3f726176e4
SSDEEP 48:qCLvGyWUg5zlD7iflYRC9sAcK6krqtQfKn6c1uDAxx8Cf2HWjZuzfg:XvtS9BFRIsPF5YXa8CO1
TLSH
T1C0918535BAC004F1F8051A732A2239F379EB35A41B76100A5F529E75AC26E73D82E703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del.bat

Path \??\c:\del.bat
Size 349B
SHA256 ddf8bfbff61aadfe51fa53df7833e14b98ff6c98ed2039c174fbd975696442d4
MD5 6fb776a8ebfd4d512b22895533994663
SHA1 c3dfd2b6682f33062d17120c6f024c606e4a4a53
SHA512 a58af45a0dc59ef465c617eb64de989e00a3cb69e2f3f2c5b4c595ede9e84ac15b32a162175ad4b1f44c1009b627b4230e24df5489acb18754377ad5138c7d75
TLSH
T1EBE0C0F18FCB8F115C80E81B1A373E0D425A49AD72482E315B75B3DC304382E6245858
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads