97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658

General

Target
jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
Size 156KB
Sample261002-ga7dcazs2p
SHA256 97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658
MD5 94d71d71275122040533ccbf9b99e83e
SHA1 7d2d98d0aac2a89f2477218c5a1e6ca79695185e
SHA512 b78209833fea8b6b2a7c94a68f690301f25f9f60c798ce81579a00002341e2182f10df2e6b38373a53e03f7b76dcd410c4295338ecf7bd11d4b396877afab869
SSDEEP 3072:J4gAt7ebW78cseKIMLIbxtAJ2qzz9jUg27BRgQvnfL+sFaGXi:yg47e0MFYYh4g27BRgA/d
TLSH
T1F2F3A62677E4F73AD15486F26BA142B80A6EFD300550881FF2C12B4AB772D97CE61367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
2316	i6g8xs.exe
4764	i6g8xs.exe
3596	i6g8xs.exe
4772	i6g8xs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\i6g8xs = "C:\\Users\\Admin\\AppData\\Roaming\\i6g8xs.exe"	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	Rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4788	sc.exe
5092	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
420	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	i6g8xs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	i6g8xs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	i6g8xs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	i6g8xs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	i6g8xs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	i6g8xs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	i6g8xs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	i6g8xs.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i6g8xs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i6g8xs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i6g8xs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i6g8xs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
2316	i6g8xs.exe
2316	i6g8xs.exe
2316	i6g8xs.exe
3596	i6g8xs.exe
4764	i6g8xs.exe
3596	i6g8xs.exe
3596	i6g8xs.exe
4764	i6g8xs.exe
4764	i6g8xs.exe
4772	i6g8xs.exe
4772	i6g8xs.exe
4772	i6g8xs.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2856	1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe	89
PID 1888 wrote to memory of 4788	1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe	91
PID 1888 wrote to memory of 2080	1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe	92
PID 1888 wrote to memory of 5092	1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe	93
PID 1888 wrote to memory of 2316	1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe	98
PID 1888 wrote to memory of 5252	1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe	99
PID 2856 wrote to memory of 5196	2856	net.exe	100
PID 2080 wrote to memory of 2880	2080	net.exe	101
PID 5252 wrote to memory of 4032	5252	Rundll32.exe	102
PID 1888 wrote to memory of 420	1888	jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe	103
PID 4032 wrote to memory of 3724	4032	runonce.exe	105
PID 2316 wrote to memory of 4764	2316	i6g8xs.exe	109
PID 2316 wrote to memory of 4772	2316	i6g8xs.exe	113

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\net.exe
  net.exe stop "Security Center"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Security Center"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5196
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= DISABLED
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\Windows\SysWOW64\net.exe
  net.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2880
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= DISABLED
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5092
- C:\Users\Admin\AppData\Roaming\i6g8xs.exe
  C:\Users\Admin\AppData\Roaming\i6g8xs.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\AppData\Roaming\i6g8xs.exe
    C:\Users\Admin\AppData\Roaming\i6g8xs.exe -d425155BF19DE07D8FC0D92B5622667626CF9D0A03D5F5D943458BDCBE731432B1569A3BEDBA7BAE4FA8E53FCF3CD426A38FB5BB3CF640854142D80FC7A05FE8C85CC68C74B4331DD3C7D96D10AF1575DE2D59BD754E5A8A8A1138BE341B5F076E5B2AFBD435DE15164A2792E5291ADF85BE6BD8E461DD4E31B391D5384FA3B8CC5D3C56CDC9F7FAE5263590AB2768805D63B2C2C5CA6615D059EB3ECCC2D47AFF69339446F0900182770D48E54CA6DC7C1AA972491B463D51E130986E3A7B75389F6D6C494D898614535C55FA2322267D06EEAAF1D532FAC688B1D8DD11771A6CF73AAA62597BE0F4C4D4ADB4389AAE9F2C7537A790A5BEF24942BA3DF2499F259B702A83BB325911DFAC1FD21684C8A58F83D045F70BB20D3E4B1F9973A95AFF8B46B9C2E65C3FED9E7C5BA657B8B6775A357EDC644655036056B1CC2BB0A77BDFDB1089844CD66E238341778B62EF2F7D48DEFE928AD854DAF57F06867DC58FA79E3A45200B860D9302C48040539AAD11C0D5E40CA284A5B11B1EDD27E31D33E7E4B97741F39CF9DC0089DF032F18E343B420084BBAC91DF50F7948A526D745CCC79C1
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4764
- - C:\Users\Admin\AppData\Roaming\i6g8xs.exe
    C:\Users\Admin\AppData\Roaming\i6g8xs.exe -dF5E6A349A96EDD021BEAC2E5DB9FD5D0C7523D4D2745F73E8CE0B2C4C315731B671B7469C5B9D987394D309F350BDCF47BB8D13965CE55092D14A0DC85FA8AF80F46B01F727AB15D1455793ECF34B0BA1423C38F57E62727C164C5A97196B0C3DC8F8F80052765F9A86AA5F18F59A3F9A01FEDC4722B0E4D6541CB8B8EFBD613FAED8A3C145638F83309FEAF994D47C36B8567776A91ECA976EE99ED20FA2CFBD6815AD67411A98932520C5654FA6CC603798B243523E128916F59DCAC9923C41E71F9F138737A976110981F62ED2272369DF2BA09324FCD934B74F5F7356DB2BE039E69B706AC6EBD4DAC38AB6FBCFC0E3C756C592DD5179922930B06F1FBA0E30EC47E86038026847490A0520BCA18DB712D1ADBE956CB00469FD61EBBFDD5FAB423C7793B7745330DCEA7BDA31DF228E472CC84EAF3D16556C1BBC5BCE596B1F1B50CA57951FA865C2E0D905EC61AC4E7DDBF89480B23A54762C5BEB164E0F477B1F6603210C87A93BADEB1B01685B974491A5FD54220DD972B7710BC6A88F0B0924E3E55F5034D10BAEE45B29E2E5748CDCABA8176F76BA1045BFF272831128210A8
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4772
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Roaming\mdinstall.inf
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\SysWOW64\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\d5jd6gnb.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:420

C:\Windows\system32\grpconv.exe
grpconv -o
1⤵
PID:1128

C:\Users\Admin\AppData\Roaming\i6g8xs.exe
"C:\Users\Admin\AppData\Roaming\"i6g8xs.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

d5jd6gnb.bat

Path C:\Users\Admin\AppData\Roaming\d5jd6gnb.bat
Size 282B
SHA256 1dfb69495d5851085546a7481e9a957e49eb6a2db90380ffd3bd80641b884a9b
MD5 a112ef93084893934485eaa2aedbb6ee
SHA1 b2bbee4d7cb69acd4a27439d6fce8059f510d914
SHA512 f3c9edb251d9482791796020525a3aabea8c53a8f2df623cef3e135624b7f86342df0fa883e423c49e0ec49508cc8ef1e9a1879d2741bb91c16b9cd5014e8eb1
TLSH
T118D02B0C43318F813910AFABCA21378D81214FB2F7DD1B5C66228ADC40F396931C3B04
MD5 SHA1 SHA512 TLSH

Submit Download

i6g8xs.exe

Path C:\Users\Admin\AppData\Roaming\i6g8xs.exe
Size 156KB
SHA256 97cac26d10c8a741c767e41b38046f6db76d636ea8bd3b856cc901d574a1e658
MD5 94d71d71275122040533ccbf9b99e83e
SHA1 7d2d98d0aac2a89f2477218c5a1e6ca79695185e
SHA512 b78209833fea8b6b2a7c94a68f690301f25f9f60c798ce81579a00002341e2182f10df2e6b38373a53e03f7b76dcd410c4295338ecf7bd11d4b396877afab869
SSDEEP 3072:J4gAt7ebW78cseKIMLIbxtAJ2qzz9jUg27BRgQvnfL+sFaGXi:yg47e0MFYYh4g27BRgA/d
TLSH
T1F2F3A62677E4F73AD15486F26BA142B80A6EFD300550881FF2C12B4AB772D97CE61367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdinstall.inf

Path C:\Users\Admin\AppData\Roaming\mdinstall.inf
Size 410B
SHA256 5d96bec9bc06fd8d7abc11efbb3cb263844ee0416910f63581dd7848b4e1d8dd
MD5 3ccb3b743b0d79505a75476800c90737
SHA1 b5670f123572972883655ef91c69ecc2be987a63
SHA512 09b1cdd4393f515f7569fbccc3f63051823ed7292b6e572bc9a34e4389b727b2914b22118e874864ccb32ef63016b2abd6d84510fd46fdee712fd84be59c114e
TLSH
T18BE02B28468945BA5D0673E19BB39540B3B4654421383016ABF9440825C2C0EC5BE936
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1888-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads