ef12c22af452659ff52be8d2fbb73e439f5620b7deab414b54a24b5e9fd17af7

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe
Size 88KB
Sample261006-sp7hfacy2j
SHA256 ef12c22af452659ff52be8d2fbb73e439f5620b7deab414b54a24b5e9fd17af7
MD5 7e825ce57fb36ab77d56557c801ccc94
SHA1 87612a8f662d6fcd40e1f89dba4a7709688c8ece
SHA512 a2eb74fabdba1270905b4872572230ac3b2fff9edab99b6216812377742967bf6d75d90864b49bd1469024b046b5ba3c14026630d9c26992cad706961794e94e
SSDEEP 1536:RL5A8gx9hgXMdD7nFvtzI9u53pKWPEnFL1:RNLgx9hgcdD7HI9u53pEZ
TLSH
T13393D613AE9B801FF2548AB01A7190D9297D3D333992AD1FFB89BA0D0D7154765E0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4172	wclient.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wclient.dll	wclient.exe
File opened for modification	C:\Windows\SysWOW64\wclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wclient.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe
File created	C:\Windows\SysWOW64\824.7339.bat	jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe
File created	C:\Windows\SysWOW64\wclient.exe	cmd.exe
File created	C:\Windows\SysWOW64\776.3177.bat	wclient.exe
File created	C:\Windows\SysWOW64\wclient.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
272	cmd.exe
2968	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wclient.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5928	PING.EXE
4352	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5928	PING.EXE
4352	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5292	jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe
4172	wclient.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 272	5292	jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe	91
PID 272 wrote to memory of 5928	272	cmd.exe	93
PID 272 wrote to memory of 4172	272	cmd.exe	94
PID 4172 wrote to memory of 2968	4172	wclient.exe	95
PID 2968 wrote to memory of 4352	2968	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bbzm.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\824.7339.bat
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:272
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5928
- - C:\Windows\SysWOW64\wclient.exe
    "C:\Windows\system32\wclient.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\776.3177.bat
      4⤵
      Drops file in System32 directory
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

776.3177.bat

Path C:\Windows\SysWOW64\776.3177.bat
Size 179B
SHA256 dc7ab649b9961d2b92ad122bd1d48952a50a21fea7147868e4ee000be6e2f5b6
MD5 6351adf26555db19c0290f62edb3bd69
SHA1 d68902395e6b404b08c93790ead54d14ce8e0867
SHA512 223deb71e472ba036e113be84e8996b01cdff150a00d8bab193d1f80566b2c2517b850e905ce9dea143accc0dcbcbac23cb17988d93b47ed2d8b4ba25b7ccc39
TLSH
T1C4C00244913000B4E5A12F18C60EBBA2AA7EF2BB720239E1015111AAECC251E2F5E8B8
MD5 SHA1 SHA512 TLSH

Submit Download

824.7339.bat

Path C:\Windows\SysWOW64\824.7339.bat
Size 283B
SHA256 ef3d4de1e73f9e4c6edf406334c4a474c19e0b6216f071d568aa4bfbee25830e
MD5 732163e8caf24131063e6170438c20cf
SHA1 40ffe4f24138eecc4d4afcb63453c4938642bab5
SHA512 11861a5825d33288ebf17a51c59a15addf08dcd2afb0c364b1305803f7cf41238906167a5d014aa1183d7c601d62abdf9c22c823b52fd1a67e1786447379d889
TLSH
T17AD0C20881E258744840DD2B847C6F8FA432791C36853F101370848DC9F146E7E4B53C
MD5 SHA1 SHA512 TLSH

Submit Download

wclient.dll

Path C:\Windows\SysWOW64\wclient.dll
Size 40KB
SHA256 bd4de132290f52bdfbbdce2ba502c2b30ac5c8313f8d37474c96cc4fb1ac4384
MD5 e20ca9643c9e7197498bc34fe07d6e67
SHA1 d6a17366af3b6f173d571bca4b253d82b3e9f214
SHA512 355c2250d6745fcc384e86df512e13249aaab463a5c318461b6fd8a3c75138491eac4f5889340958e9b21789a4ec239d21d8bdf98bd11f7f46d548d78ca242a1
SSDEEP 768:2Dg0r/lj54su/lu5GypKvOYSahvfPFL29:KzI9u53pKWPEnFL
TLSH
T16A03D522A7DEC42FF6D807B02A76A6EC15297D710F95DA4F32D9F74D1E35802862072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wclient.exe

Path C:\Windows\SysWOW64\wclient.exe
Size 88KB
SHA256 ef12c22af452659ff52be8d2fbb73e439f5620b7deab414b54a24b5e9fd17af7
MD5 7e825ce57fb36ab77d56557c801ccc94
SHA1 87612a8f662d6fcd40e1f89dba4a7709688c8ece
SHA512 a2eb74fabdba1270905b4872572230ac3b2fff9edab99b6216812377742967bf6d75d90864b49bd1469024b046b5ba3c14026630d9c26992cad706961794e94e
SSDEEP 1536:RL5A8gx9hgXMdD7nFvtzI9u53pKWPEnFL1:RNLgx9hgcdD7HI9u53pEZ
TLSH
T13393D613AE9B801FF2548AB01A7190D9297D3D333992AD1FFB89BA0D0D7154765E0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads