ab5e435af57ede7421e4e09f33b79eb945886dddcb7892c9cd6ac0062969f14b

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe
Size 81KB
Sample261006-thgh4sfe44
SHA256 ab5e435af57ede7421e4e09f33b79eb945886dddcb7892c9cd6ac0062969f14b
MD5 b19bce022bf6f48d0fdae4b6507bc9a5
SHA1 876663ea8e4e74737e7c28b3b9e1815659410af3
SHA512 b86febc50113cc34c47643ee4032b25db373959f43a35f01d2dfbe734f7eb4e9df00e436d209d8f079ded2606422f78c49412c0997c2358dba089bf8fcff98f3
SSDEEP 1536:nCAM4UKxCKceEahu3xZxm7CP7Vwj0A6GD5Gthu9/9JvMBF44XSq+F7o0dise:nL+KPrRu3x7m7Cy5/9JvMBF44XSq+W0k
TLSH
T1248312CA367D42C2C70839BA025B5A348B3AF46E2281D3461F594DDB49F9F5C29B6F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3256	scombop.exe
1404	scombo.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\combop.exe = "combop.exe"	scombop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\combo.exe = "combo.exe"	scombo.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\scombo.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe
File created	C:\Windows\SysWOW64\combop.exe	scombop.exe
File created	C:\Windows\SysWOW64\combo.exe	scombo.exe
File created	C:\Windows\SysWOW64\scombop.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3440-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/files/0x0006000000016b3a-5.dat	upx
behavioral2/memory/3256-10-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/files/0x000500000001b85a-14.dat	upx
behavioral2/memory/1404-20-0x0000000000400000-0x000000000055B000-memory.dmp	upx
behavioral2/memory/3440-23-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/memory/3256-25-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/1404-28-0x0000000000400000-0x000000000055B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	scombo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	scombop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	scombop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	scombo.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scombop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scombo.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3256	3440	jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe	90
PID 3440 wrote to memory of 1404	3440	jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.lg.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\scombop.exe
  "C:\Windows\System32\scombop.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3256
- C:\Windows\SysWOW64\scombo.exe
  "C:\Windows\System32\scombo.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scombo.exe

Path C:\Windows\SysWOW64\scombo.exe
Size 36KB
SHA256 ebcdec65cc00588977bc665e6792df945213bb2c2ddddc463189734619ca5cff
MD5 5b0caaa3d9f4a5fd3d2fb372bded29bd
SHA1 d9fbb8aae57c95ae47f0321cd458f0b78b4e5c72
SHA512 88de98f0c59f271498cad6ea9934047f20831fb1400481d239278a93cf7cada22c86666525f5b8ea91c944ee59e7b9f3e60bcbc8c952f0ee5dcf4f5640f274e6
SSDEEP 768:zABqF3nOmutS2BIlSIgMkvIgZdABsKY5PqfSBiXMCtum:zYqRnWSLrgMJuABsKCPqfAW
TLSH
T180F2F10F378D8BA3F906AEB7324DDE01A8BEB04F1106ECAB839844D569DD6A405B1C75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scombop.exe

Path C:\Windows\SysWOW64\scombop.exe
Size 26KB
SHA256 78101540f36c892515adda4c68106f8d3d9d76da0f5a0b3e34799febb638e4cd
MD5 bc9a49d0b055bf615deda628126c58e0
SHA1 c6785c48339261bc9fab3f8c3ed876f742307783
SHA512 033ae9e2542bcc7f8318a1072a0c08f72900dd256c121d3194a952bb437db1d35ca31326684a7f917e06239831d7a1897b6f03965490f7f524bba71ed51d873a
SSDEEP 384:LJPSTmY2pifUngsdwP0LX8J0JBOtxBVeLJztXq69URWk5F94Lr96rh6hWn+ZaHk3:dPSiY2pvgsDsmJUBshBq6m0YOru1Z0g
TLSH
T1CEC2D0C53E98E270EA9598764FAB72BAB23C543021D27A185BD6C3EF05E6F143D0CA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-20-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/1404-28-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/3256-10-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3256-25-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3440-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3440-23-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads