5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190

General

Target
jaffacakes118_5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190.exe
Size 5.6MB
Sample260925-wa2kesseqg
SHA256 5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190
MD5 96f36c98ee5a30f6aaa9efa30994b218
SHA1 3070d6e8ae5e401f61e2dcdffa6d1574bbede8ec
SHA512 d1e45732aa16ee22e119c36ffe0fe2072faf1f39a4171ee40025f3249794f400653e0bada92b70f6082627e6c0e5123dd5470d4cefe86c60842e38e0efc08f6d
SSDEEP 49152:6l5whqE0ZEywT28Ft7sJaujOScJ3IzJq:6l52qE0ZEdT/Ft7sJjKSUIzJq
TLSH
T17856A00C8A62EA0F8E8A9A63F385342BCC76F93D66D679D849D71F3F716D0814C2C459
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5552	Java.exe
5984	Java.exe
1392	Java.exe
5440	Java.exe
1664	Java.exe
2736	Java.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\Java.exe"	reg.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5552 set thread context of 5984	5552	Java.exe	93
PID 5552 set thread context of 1392	5552	Java.exe	95
PID 5440 set thread context of 1664	5440	Java.exe	97
PID 5440 set thread context of 2736	5440	Java.exe	98

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5984-27-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5820	jaffacakes118_5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190.exe
5552	Java.exe
5440	Java.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5820 wrote to memory of 1548	5820	jaffacakes118_5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190.exe	89
PID 1548 wrote to memory of 2708	1548	cmd.exe	91
PID 5820 wrote to memory of 5552	5820	jaffacakes118_5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190.exe	92
PID 5552 wrote to memory of 5984	5552	Java.exe	93
PID 5552 wrote to memory of 5984	5552	Java.exe	93
PID 5552 wrote to memory of 5984	5552	Java.exe	93
PID 5552 wrote to memory of 5984	5552	Java.exe	93
PID 5552 wrote to memory of 1392	5552	Java.exe	95
PID 5552 wrote to memory of 1392	5552	Java.exe	95
PID 5552 wrote to memory of 1392	5552	Java.exe	95
PID 5552 wrote to memory of 1392	5552	Java.exe	95
PID 5440 wrote to memory of 1664	5440	Java.exe	97
PID 5440 wrote to memory of 1664	5440	Java.exe	97
PID 5440 wrote to memory of 1664	5440	Java.exe	97
PID 5440 wrote to memory of 1664	5440	Java.exe	97
PID 5440 wrote to memory of 2736	5440	Java.exe	98
PID 5440 wrote to memory of 2736	5440	Java.exe	98
PID 5440 wrote to memory of 2736	5440	Java.exe	98
PID 5440 wrote to memory of 2736	5440	Java.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dGVsB.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\Java.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2708
- C:\Users\Admin\AppData\Roaming\Java\Java.exe
  "C:\Users\Admin\AppData\Roaming\Java\Java.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Users\Admin\AppData\Roaming\Java\Java.exe
    "C:\Users\Admin\AppData\Roaming\Java\Java.exe"
    3⤵
    - Executes dropped EXE
    PID:5984
- - C:\Users\Admin\AppData\Roaming\Java\Java.exe
    "C:\Users\Admin\AppData\Roaming\Java\Java.exe"
    3⤵
    - Executes dropped EXE
    PID:1392

C:\Users\Admin\AppData\Roaming\Java\Java.exe
C:\Users\Admin\AppData\Roaming\Java\Java.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Users\Admin\AppData\Roaming\Java\Java.exe
  "C:\Users\Admin\AppData\Roaming\Java\Java.exe"
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Users\Admin\AppData\Roaming\Java\Java.exe
  "C:\Users\Admin\AppData\Roaming\Java\Java.exe"
  2⤵
  - Executes dropped EXE
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dGVsB.bat

Path C:\Users\Admin\AppData\Local\Temp\dGVsB.bat
Size 133B
SHA256 f7d16394ddbc074f0c869e93b4384d89f96306f27440ee70966345ee74f76e52
MD5 05a96107f65548eced02f7d79d505f8e
SHA1 e8cd034bc9bf46c525645d2b242827760865d9dd
SHA512 30c83bfa7e83cf8af9197913bbb234dc3ca32b574a88ba4752263ed6ed6a44ace20369e0e779726d31bb53647cacd700934713054584b88301dd55496f93a122
TLSH
T17FC02B2175908709F06091210A161044D3A293C72400964D42C1040C81026CDD4570C3
MD5 SHA1 SHA512 TLSH

Submit Download

Java.exe

Path C:\Users\Admin\AppData\Roaming\Java\Java.exe
Size 5.6MB
SHA256 5f89f3ae8b0af56a5a99c1b1611ac4ec86deaf38aad4b6378d6fda70f5828190
MD5 96f36c98ee5a30f6aaa9efa30994b218
SHA1 3070d6e8ae5e401f61e2dcdffa6d1574bbede8ec
SHA512 d1e45732aa16ee22e119c36ffe0fe2072faf1f39a4171ee40025f3249794f400653e0bada92b70f6082627e6c0e5123dd5470d4cefe86c60842e38e0efc08f6d
SSDEEP 49152:6l5whqE0ZEywT28Ft7sJaujOScJ3IzJq:6l52qE0ZEdT/Ft7sJjKSUIzJq
TLSH
T17856A00C8A62EA0F8E8A9A63F385342BCC76F93D66D679D849D71F3F716D0814C2C459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-28-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/5440-33-0x0000000000400000-0x00000000009A6000-memory.dmp

Download

memory/5820-0-0x0000000000400000-0x00000000009A6000-memory.dmp

Download

memory/5984-27-0x0000000000400000-0x0000000000473000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads