bb1aad8e6ff228a761d81b020c59023caf7c5ac3ea560a65194d1b22e1d1a6ee

General

Target
jaffacakes118_bb1aad8e6ff228a761d81b020c59023caf7c5ac3ea560a65194d1b22e1d1a6ee.exe
Size 176KB
Sample261002-jf7bmsyzd1
SHA256 bb1aad8e6ff228a761d81b020c59023caf7c5ac3ea560a65194d1b22e1d1a6ee
MD5 e2ed9f1a16bb2c23508273f6fe5d9167
SHA1 20a0dfae4041c76594fbcdd20ffc3f2806ec46c3
SHA512 fcc8883487135336deeaa658e5605f2c5dc3049f57b42890c807f8d1c3c521617e9bad653b6915c28874b3f67b1e983ea17b262562f9403689f4702fe13cbc19
SSDEEP 3072:38Swq3FOnb6dRS2Y/Y/YYw/YYYzYYYxYYOYIhsqYYpYYYBYYYPYYVYYLYBVA4Ocx:38ZLwsqVu8BpO
TLSH
T191040892B0EC9E73D07006300CABE4315E37AE43A695E54B22C57D7B76B33A1906ED4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6108	attrib.exe
3672	attrib.exe
6120	attrib.exe
2312	attrib.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\c:\autorun.inf	cmd.exe
File created	\??\d:\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	\??\c:\autorun.inf	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	cmd.exe
File opened for modification	C:\Windows\system.ini	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_bb1aad8e6ff228a761d81b020c59023caf7c5ac3ea560a65194d1b22e1d1a6ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	label.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	label.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1364	2524	jaffacakes118_bb1aad8e6ff228a761d81b020c59023caf7c5ac3ea560a65194d1b22e1d1a6ee.exe	91
PID 1364 wrote to memory of 2748	1364	cmd.exe	92
PID 1364 wrote to memory of 3292	1364	cmd.exe	93
PID 1364 wrote to memory of 4928	1364	cmd.exe	94
PID 1364 wrote to memory of 4244	1364	cmd.exe	95
PID 1364 wrote to memory of 4700	1364	cmd.exe	96
PID 1364 wrote to memory of 1688	1364	cmd.exe	97
PID 1364 wrote to memory of 2284	1364	cmd.exe	100
PID 1364 wrote to memory of 1848	1364	cmd.exe	101
PID 1364 wrote to memory of 6108	1364	cmd.exe	102
PID 1364 wrote to memory of 3672	1364	cmd.exe	103
PID 1364 wrote to memory of 6120	1364	cmd.exe	104
PID 1364 wrote to memory of 2312	1364	cmd.exe	105

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3672	attrib.exe
6120	attrib.exe
2312	attrib.exe
6108	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bb1aad8e6ff228a761d81b020c59023caf7c5ac3ea560a65194d1b22e1d1a6ee.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bb1aad8e6ff228a761d81b020c59023caf7c5ac3ea560a65194d1b22e1d1a6ee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6F89.tmp\Rihanna feat. Timati - Get free.bat""
  2⤵
  - Drops autorun.inf file
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 user,setcursorpos
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2748
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 keyboard,disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 mouse,disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4928
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 user,swapmousebutton.
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4244
- - C:\Windows\SysWOW64\label.exe
    label mp_k
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:4700
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 mouse,enable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 keyboard,enable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mes.js"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1848
- - C:\Windows\SysWOW64\attrib.exe
    attrib c:\autoexec.bat +h +s +a +r
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:6108
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\mp_k.exe +h +s +a +r
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3672
- - C:\Windows\SysWOW64\attrib.exe
    attrib c:\autorun.inf +h +s +a +r
    3⤵
    - Sets file to hidden
    - Drops autorun.inf file
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:6120
- - C:\Windows\SysWOW64\attrib.exe
    attrib d:\autorun.inf +h +s +a +r
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rihanna feat. Timati - Get free.bat

Path C:\Users\Admin\AppData\Local\Temp\6F89.tmp\Rihanna feat. Timati - Get free.bat
Size 1KB
SHA256 8f1068c0f43fe33b8d6ff79f25bb5a797f583d98737744392ba158bfbb8c8c77
MD5 bd9b8c6e9d1bf012c7a9ae255746c358
SHA1 e5cff74139245b56b84eaaebf536cd0cd9f35e4b
SHA512 8c4187ca923cd383a150161917bd945e7275c9291bc6a4871f12c1d8bb6d34807206c6a20a9fc0a241b29a34181b5c41200adf6ce8a75ea4a1b8d2d75c87f3c5
TLSH
T1B811EE36538F9F37AF620A69847AB00CAA27A1EB2B104D300F16DCFDF4C16503A18258
MD5 SHA1 SHA512 TLSH

Submit Download

mes.js

Path C:\Users\Admin\AppData\Local\Temp\mes.js
Size 124B
SHA256 2ba2ee783ae70c17059499270091d622c154d1ed9a7e566ba0779bafb0be1a3f
MD5 0716f49892487ca883cb58c76007c9c8
SHA1 6d2c34e0bb51e8e0b8edc8d989eaa49ebabc3a77
SHA512 7db229b252a049f07e2f45af264766fce6c798d3908301675770d1a1727a9487994fb8043e595dbefdc5f9f8066b0af8557ff55f167966817e9c27d9e873926a
TLSH
T158B0145C747CD455175D43CD0075C11C57F57CD517415D504FD4DD4C545535D4D34017
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.inf

Path C:\autorun.inf
Size 23B
SHA256 3218060f6df10c76b55cb8c49c52ef2f0cb3e8ee8c8472d8b31887373dd18cf6
MD5 823fd69f729fa5b863cfd7110827b191
SHA1 f71986cbf12f721961c67f6ff45aa3c7c5bc26be
SHA512 910a40d49012060c0447a792f2fe506123a5ee1e51dd366b61cef5d4c88a9d1e6477f9fc5c0ed1476bb79b01eec876baf428e38613ac4a2caac0a8ef473c44c3
MD5 SHA1 SHA512

Submit Download

memory/2524-0-0x000000000040A000-0x000000000040B000-memory.dmp

Download

memory/2524-5-0x000000000040A000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads