1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126

General

Target
jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe
Size 23KB
Sample260930-mrm9pays2k
SHA256 1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126
MD5 891246e56f06985dcf60ad907d2bc43d
SHA1 b342e666715f7b4c0b811a28f21f7f053a030e18
SHA512 d2c78508725dcd2300e0a88f5e37e462be5988f044dd4e732ef8195055baf3bd7ece5a3e72ce03aebe6a7b4242582ce29c59cc8464f86f0a5a185065e5e035d0
SSDEEP 384:A3sZLQYqllLS/Ez1lk6FaVJWnFg7rpq1WmW8gcAVCiu+WyFF0YI:HZqffxNaVJjT8gcAVCNE0YI
TLSH
T179B2AED318C56593C983833B89764865BB659EB0103CED895784B0C730ADA87AEF95CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5588	svcnrpwb.exe
2640	tskaohad.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svcnrpwb.exe	jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe
File opened for modification	C:\Windows\SysWOW64\tskaohad.exe	svcnrpwb.exe
File created	C:\Windows\SysWOW64\tskaohad.exe	svcnrpwb.exe
File opened for modification	\??\c:\windows\SysWOW64\svcnrpwb.exe	svcnrpwb.exe
File opened for modification	C:\Windows\SysWOW64\tskaohad.exe	tskaohad.exe
File created	C:\Windows\SysWOW64\tskaohad.exe	tskaohad.exe
File opened for modification	\??\c:\windows\SysWOW64\tskaohad.exe	tskaohad.exe
File opened for modification	C:\Windows\SysWOW64\svcnrpwb.exe	jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\zznynb.job	tskaohad.exe
File opened for modification	C:\Windows\Tasks\zznynb.job	tskaohad.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3292	cmd.exe
4892	cmd.exe
4144	cmd.exe
3032	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tskaohad.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tskaohad.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcnrpwb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tskaohad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4892	3428	jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe	90
PID 3428 wrote to memory of 3292	3428	jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe	91
PID 4892 wrote to memory of 5588	4892	cmd.exe	94
PID 5588 wrote to memory of 3032	5588	svcnrpwb.exe	95
PID 5588 wrote to memory of 4144	5588	svcnrpwb.exe	96
PID 3032 wrote to memory of 2640	3032	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start "" /b "C:\Windows\system32\svcnrpwb.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\svcnrpwb.exe
    "C:\Windows\system32\svcnrpwb.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start "" /b "C:\Windows\system32\tskaohad.exe"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\SysWOW64\tskaohad.exe
        
        "C:\Windows\system32\tskaohad.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:2640
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0e592a91.bat" "c:\windows\syswow64\svcnrpwb.exe""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0e592958.bat" "c:\users\admin\appdata\local\temp\jaffacakes118_1af37e643ea277517c938f84e64564ff2dd33c8e747e5aa76ad865b4d06fc126.exe""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e592958.bat

Path C:\Users\Admin\AppData\Local\Temp\0e592958.bat
Size 41B
SHA256 3970963f4d4072736cbd70a05a4cca5151aabf1d27a7d65b954ef08372828ebe
MD5 95677ba254096531d914bc6156c6c8fe
SHA1 a2e7a47eb5d4e8760a98a25f24a58848bd32f3ef
SHA512 fbd360ea283f27211c7db8b4e7e8c21e3c6826067ade44b5df7eeb6f0a03589a6bfeba643f995cb1bfc7647cec15eeefdd743a68512e418d190d8dacc12b16e5
MD5 SHA1 SHA512

Submit Download

svcnrpwb.exe

Path C:\Windows\SysWOW64\svcnrpwb.exe
Size 48KB
SHA256 6fb60a6d6415f94934cb8d1fc26f4da341b0dc8b8428054862b3cc23196fecf6
MD5 9be8bea19b27107c0fc9b9ed95c3bf0f
SHA1 77690d5ac5b4a4df7bc4747f244c1ed89cad46f1
SHA512 ead07132a7d64b8e10a84efea74df3ffccf5dc80d996cc7b5ddee9feea6a0ce7d1d6cb2e3bc6d11a7cacd48a6cef4715626a4aafbffd980a70eff0b44e4d3c77
SSDEEP 768:HZqffxNaVJjT8gcAVCNE0YG2wf3H2XK0DDNWIOw0xhKTk6kKEDfWgF7mg:5FV1IKpD4YK0VWIOw0T/KEDfWC7mg
TLSH
T1A523E0C628C25783DD4B437B44760924E5296BB0202CED8D6380A9D760BF957DEF9ACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tskaohad.exe

Path C:\Windows\SysWOW64\tskaohad.exe
Size 68KB
SHA256 2d5427de59d470ff5053307aecd0dcd96034ce4f3b86b76210c6e5c64ff9c6f5
MD5 1bdbda935901a8a80aa8dc7178b33c9a
SHA1 200ff023b15260f03c251923c2abc9bfe2c52f5c
SHA512 547ea4a5300af2ca5e28b294c839759d9bf97b3a01d9fd340f836af2823a209b8e5de78a01db7c1bab6502424946f199ec91f42e23a2a4f2273aebe5a44b86b5
SSDEEP 1536:5FV1IKpD4YK0VWIOw0T/KEDfWC7mmGT7oiGuDj2a:5FV1IKpcYtpOr1fWCFGT0iGc
TLSH
T1B963F1C618C11793DE0E437A457A0C24E6265FB0203CED8A66409DEB51EDA4BDEF5BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2640-15-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2640-26-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads