ad44a580f37b9775c59e39c8c02f6ed97a528376e8cfb89d13b5ce8241df3327

General

Target
jaffacakes118_Trojan-Spy.Win32.AutoHK.pg.exe
Size 476KB
Sample261006-vm8ntssvay
SHA256 ad44a580f37b9775c59e39c8c02f6ed97a528376e8cfb89d13b5ce8241df3327
MD5 c157811dc71a28c1ce0c171e79ee2e42
SHA1 b4bde13166d17fc543ea0395440cf55297321d3d
SHA512 27207d449f2fcd9f81f243c9a6b8238ce31744927fad8bab8f0b02cf828a0eb2fcfe8c027f8d175abe356612760ecd45d72f9ccc26646074948d1e57cac2e7ec
SSDEEP 12288:OiVCROTTFW6VcHsyMzYstvu64GLmLx7qPOI3FHYp5:Oi/hvfyMTvTJC2Ho
TLSH
T12BA4E1E075805777CA69C27A88759864201A3C2FE26282FDF1997F4F3FBD25E741284B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
704	webhost.exe
1828	webhost.exe
1680	webhost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\web.bat	webhost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\web.bat	webhost.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2940	cmd.exe
5832	cmd.exe
3200	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.AutoHK.pg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3840	schtasks.exe
4836	schtasks.exe
5808	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1828	webhost.exe
1680	webhost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 704	4404	jaffacakes118_Trojan-Spy.Win32.AutoHK.pg.exe	89
PID 704 wrote to memory of 2940	704	webhost.exe	90
PID 2940 wrote to memory of 4836	2940	cmd.exe	92
PID 1828 wrote to memory of 5832	1828	webhost.exe	95
PID 5832 wrote to memory of 5808	5832	cmd.exe	97
PID 1680 wrote to memory of 3200	1680	webhost.exe	99
PID 3200 wrote to memory of 3840	3200	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.AutoHK.pg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.AutoHK.pg.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404
- C:\ProgramData\webhost.exe
  C:\ProgramData\webhost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c web.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn Web\Host /tr C:\ProgramData\webhost.exe /st 00:00 /sc once /du 9999:59 /ri 5 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4836

C:\ProgramData\webhost.exe
C:\ProgramData\webhost.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c web.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn Web\Host /tr C:\ProgramData\webhost.exe /st 00:00 /sc once /du 9999:59 /ri 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5808

C:\ProgramData\webhost.exe
"C:\ProgramData\webhost.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c web.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn Web\Host /tr C:\ProgramData\webhost.exe /st 00:00 /sc once /du 9999:59 /ri 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webhost.exe

Path C:\ProgramData\webhost.exe
Size 476KB
SHA256 ad44a580f37b9775c59e39c8c02f6ed97a528376e8cfb89d13b5ce8241df3327
MD5 c157811dc71a28c1ce0c171e79ee2e42
SHA1 b4bde13166d17fc543ea0395440cf55297321d3d
SHA512 27207d449f2fcd9f81f243c9a6b8238ce31744927fad8bab8f0b02cf828a0eb2fcfe8c027f8d175abe356612760ecd45d72f9ccc26646074948d1e57cac2e7ec
SSDEEP 12288:OiVCROTTFW6VcHsyMzYstvu64GLmLx7qPOI3FHYp5:Oi/hvfyMTvTJC2Ho
TLSH
T12BA4E1E075805777CA69C27A88759864201A3C2FE26282FDF1997F4F3FBD25E741284B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web.bat

Path C:\Users\Admin\AppData\Local\Temp\web.bat
Size 100B
SHA256 f0b8aa6e6d86ac280cae86fc2b501b1bc5073c3057abf42252ccc3d2f0ccda79
MD5 df2082eeaffcae3924b93d99b37a95a4
SHA1 ab302f004f1ab89d44295f92cd2dc261702e655e
SHA512 e236308156e2f6c59d67a2fae46806542bfd0379607531c7496ef4f8eb759cfe069484597506d539e0aed2c386a424852679c5c518e11ab1e83174a2b4859f83
TLSH
T142B0120DAB26C7405805249713274B8EED88D417B1C808A4425701AC8002D2C311F351
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-10-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1828-15-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1828-31-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4404-0-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4404-3-0x0000000000400000-0x0000000000523000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads