10ea4991321ee015b6dc0eb6f8ef90b6dbaa7e3747ac8cb0dbf779ad599c2818

General

Target
jaffacakes118_Trojan-Dropper.MSIL.Agent.sul.exe
Size 430KB
Sample261006-seaeyscw5j
SHA256 10ea4991321ee015b6dc0eb6f8ef90b6dbaa7e3747ac8cb0dbf779ad599c2818
MD5 c1d7a81ecfaf594a6eaa49d67fa8b9a0
SHA1 d086d128af323af5a8098ae759735a08709cb9b2
SHA512 656dd379277d35ab11f469fcda1e060ab591e391a7580ae755fef99362323cf917da53aaf540a40030fa88b59d17fbedb70b751464811305c1b1d71357abead5
SSDEEP 6144:aSDtrB8M8w/XGimb1PLyKGP0Mtftqot/CUOemuOduAE7gWGee7mJ7qK/GUZJHug2:RP8wdmV/GsMfqo3OeWut7gWTOLxYJOV
TLSH
T11F9412A2B6C4C463E4A64B75AE32C9EE9173FD194E64610F73C4BB7F2B330835619206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3356	virus_cryptrd.exe
1648	11016.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.MSIL.Agent.sul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virus_cryptrd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11016.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	jaffacakes118_Trojan-Dropper.MSIL.Agent.sul.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	mspaint.exe
2200	mspaint.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3356	virus_cryptrd.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2200	mspaint.exe
2200	mspaint.exe
2200	mspaint.exe
2200	mspaint.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 3356	5824	jaffacakes118_Trojan-Dropper.MSIL.Agent.sul.exe	89
PID 5824 wrote to memory of 2200	5824	jaffacakes118_Trojan-Dropper.MSIL.Agent.sul.exe	90
PID 3356 wrote to memory of 1648	3356	virus_cryptrd.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.sul.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.sul.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Users\Admin\AppData\Local\Temp\virus_cryptrd.exe
  "C:\Users\Admin\AppData\Local\Temp\virus_cryptrd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\11016.exe
    "C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\11016.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1648
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Anushka-45.jpg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Anushka-45.jpg

Path C:\Users\Admin\AppData\Local\Temp\Anushka-45.jpg
Size 123KB
SHA256 5ffabcc99bd1016e8904b5292b791dc3d3dee3d676750eb48e48c462570402db
MD5 7412ddcfe2e14b32f3533393065ec152
SHA1 cbf45cce5e9e356694ef86136fc655c57bcbb0db
SHA512 ca6d9a98898f0a22f47693f81c9880f4c9e736be55940d0a810993c5068673babe0fb36f4dd5fe03dde19696761fe4efd76f4ac2c5106a4a5177921918adf75e
SSDEEP 3072:rgWGrH6sOe7ETJ7qkNb/geG6nWT+zS16HJOcD/Cg2eD8n:rgWGee7mJ7qK/GUZJHugxD8n
TLSH
T182C3124C8B8F3483A583EE9F56E14685ECB5EA1879089D4BF7C581347332D2E691E30D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11016.exe

Path C:\Users\Admin\AppData\Local\Temp\iTV2HwOA\11016.exe
Size 340KB
SHA256 6700d730fd1d978ce783e7789070c350e6854f17b09cf46fc25be64ac8e43df7
MD5 5891d45cd710f71a1a3ff57d0a531e22
SHA1 a1737e5a0effbeb2a854c928cd8a2bbc54e13bec
SHA512 6fed58abf766ac6bf308fc3fca8e949c3c4218d0872d181776be07f1ee5d65f1c590d36abba063a640c542f8a7de17a81641edc898f04ecfcd66e8d903a77b2f
SSDEEP 6144:G0PEtTPkAuAfjlJuj3QjgJ6snJZ/RjY07qVyLOyFTzVxh3VAitO8yb8D/3/:G0m3blK36QhuIOyFHxlAaO8ye3/
TLSH
T1DE747C6373E28032E49341B222D91B65EFFABE3016369D978FD41D846E34591EB3634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_cryptrd.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_cryptrd.exe
Size 348KB
SHA256 5c2581a70aeae8a373bbe25b4a764ea83d01bb2656f1fe21f6ec5720ca24977f
MD5 9ebff3d93e93f63a3146b70e5dfdf07b
SHA1 1b306229047b510bd1ca32ae7cbbb6940afcae52
SHA512 7d757bc3bf4c90a75eab5e7144d3c9bbfbb0239e7da318a14b327410381a64801e7787f3395c484ac23813863f0a431265b3fe0a6ab6a1d7ca7cca5a41635c37
SSDEEP 6144:EDkXY7SHz1xjmmlBvY3Xqe4iIoF/0TWQ7od6N8BDlNRNnXkYR0P+On2+VKJB1lf:EDsPt7vMioWWQ7ma8BDlNPXn0PBn2D
TLSH
T1CD74D0D91BC3E899E2D32935C09E52F5520786D87E72DB360B345E62DFA48A354333E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3356-15-0x0000000073632000-0x0000000073634000-memory.dmp

Download

memory/3356-14-0x0000000000B60000-0x0000000000B70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads