6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702

General

Target
jaffacakes118_6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702.exe
Size 430KB
Sample261002-fs7amazybw
SHA256 6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702
MD5 ee2ff1d635d3ea906596d0cbed3a91b7
SHA1 ecceadf838eea2a1578dab9ed9f5873a642bf36c
SHA512 33bc3d12795b98605e07625cfab619a8efa64bc9d7b591074a87e9cef01d6169b20fa3ea1e650a8500c75c949e8d769679c732e057003f272794c2a94b3df3b8
SSDEEP 3072:rGGu99lfzqIbXWcPTpQpHNEkS12hAGZu3YJcuR1nQ8Wg:a/cu/GptEF6u3Qz
TLSH
T117942BF5E6D0DA0BF5A4753119B4FA1E0401FB38FB22EAAB5760364A5676BC04078F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4756	Project1.exe
2236	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\server.exe:Zone.Identifier	Project1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Project1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	Project1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Project1.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\server.exe:Zone.Identifier	Project1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2236	server.exe
2236	server.exe
2236	server.exe
2236	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4756	Project1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4756	1196	jaffacakes118_6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702.exe	89
PID 4756 wrote to memory of 2236	4756	Project1.exe	91
PID 2236 wrote to memory of 1856	2236	server.exe	82
PID 2236 wrote to memory of 1856	2236	server.exe	82
PID 2236 wrote to memory of 1856	2236	server.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1856
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6cea252cf10c8fb949eac2043981376fd1cca305c9dae572dfecb6e657f51702.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Project1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Project1.exe
    3⤵
    - Executes dropped EXE
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Project1.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Project1.exe
Size 56KB
SHA256 6c3e5f43f547beea5774e2e2e899d436be05befb85be961453080cd450ef3638
MD5 8a7948d2e67d9a37130287c39e3af31c
SHA1 a315e2820be8a3f43ecd85555f9cd165c8509c1e
SHA512 374d7816a75502fd937b3597953798ad50bedb6f196da58512962588b15a7ddb04cf943284c5c89261fccd739816e22e76b08c1549f93d11069628b1ac1b02e5
SSDEEP 768:/M+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfCXy2Ge:/9Z/nEkh8OTKNx3
TLSH
T11543C005B3DE94A5E1469B314DBA8BE49162BC309F260B0B73FD777D5E31B022C9918D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 31KB
SHA256 c08386ecdaec2f4b0fd82b934d5a87413e8dcc212df49874817296ce74fdd9c8
MD5 4b818e975f37d13e27aa9e7fec7a3c2a
SHA1 31c4c4261a17fbefca336062f48e7c6537ab30d5
SHA512 95a9d3fea5288a74f56a068393253ab7bf8903591156c454b8a008192c2e6a4c025f35d0d2cd5d579ff210c27ba2f4171abd3a9c2c750516a397b23dc5bd8e77
SSDEEP 768:Z+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfC3:kZ/nEkh8OTKNr
TLSH
T1B3E2D08941CE28C0E5A3FB7C89ED0EE591A55A319F67030B93FE90FD5B20A4724AD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-0-0x0000000001000000-0x000000000106F000-memory.dmp

Download

memory/1856-43-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Download

memory/1856-44-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Download

memory/2236-41-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2236-47-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads