cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74

General

Target
jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe
Size 121KB
Sample260925-ffed3sttct
SHA256 cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74
MD5 e133bda159ab8eaed676aebba9257886
SHA1 9141af1483f1c91e7760a7fedcd9523197e8bf0c
SHA512 40127091c11bb527e3b3120340d8760a30f0e30aa2d0042eb64827c6c1f889967b9ad4e6263179b1a099a4c31618223a3a0feb8894142cd0f633848bd6cf446e
SSDEEP 1536:JEd+ad8dIn9L38irQ7rubcCL4hlQoKt/ZUx4ZJa3ZZwhJYfBHFx:i+aydc9LMxuB8qtpo4ZJS8hCfBHFx
TLSH
T1E2C37B13B3904576C052593C8C4B92B5FA3D3A316EE5259ABDF22F1CDE3D2821D693A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}	jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}\StubPath = "C:\\Program Files\\DBS.EXE"	jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe

Executes dropped EXE 1 IoCs

pid	Process
2416	DBS.EXE

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 4652	2416	DBS.EXE	90

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DBS.EXE	jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe
File created	C:\Program Files\DBS.EXE	jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	4652	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 2416	3304	jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe	89
PID 2416 wrote to memory of 4652	2416	DBS.EXE	90
PID 2416 wrote to memory of 4652	2416	DBS.EXE	90
PID 3304 wrote to memory of 4988	3304	jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files\DBS.EXE
  "C:\Program Files\DBS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\SYSTEM32\userinit.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 584
      4⤵
      Program crash
      PID:5052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4652 -ip 4652
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DBS.EXE

Path C:\Program Files\DBS.EXE
Size 121KB
SHA256 cba83a058706b4cd4c56ee72b11782ca40f414717577777a9ff8b187e60d9b74
MD5 e133bda159ab8eaed676aebba9257886
SHA1 9141af1483f1c91e7760a7fedcd9523197e8bf0c
SHA512 40127091c11bb527e3b3120340d8760a30f0e30aa2d0042eb64827c6c1f889967b9ad4e6263179b1a099a4c31618223a3a0feb8894142cd0f633848bd6cf446e
SSDEEP 1536:JEd+ad8dIn9L38irQ7rubcCL4hlQoKt/ZUx4ZJa3ZZwhJYfBHFx:i+aydc9LMxuB8qtpo4ZJS8hCfBHFx
TLSH
T1E2C37B13B3904576C052593C8C4B92B5FA3D3A316EE5259ABDF22F1CDE3D2821D693A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-5-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/3304-6-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4652-1-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4652-2-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4652-3-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4652-4-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/4652-7-0x0000000010000000-0x0000000010025000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads