a2b0855751a7b3ceb84e7dd884593df1a7c4ae918ca8e1b7078df305b3c4ce66

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 374KB
Sample261009-vphv7ada25
SHA256 a2b0855751a7b3ceb84e7dd884593df1a7c4ae918ca8e1b7078df305b3c4ce66
MD5 fb78a23a5527ed19b41b03643e23eae4
SHA1 85d8b581b8a35fc6ffe261ea64f8ec8185e54912
SHA512 4bf2dcc679d9456abd7bb82dd21b9862cce69dca0ab3d7f9bc07c8dbfd3e900d519e09071d7f18bed46542bb7bfdcd8ecaf3f502deaed8707990e762f12a93ab
SSDEEP 6144:sqlZcOt2UaFbYbGDMsrrwJ5ckQ+Zehv6dlalVjjgbAIvXlYbk2E4acu:sOmblMsrrwvmDhv6EVjMb7vH2laB
TLSH
T18784CF2394A2E728D27D32F151668EBCD0B72E76295CCD29A1F472F6A9F10B3EC0454D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4092	lhlcgunxg.exe

Loads dropped DLL 1 IoCs

pid	Process
4092	lhlcgunxg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	lhlcgunxg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5992	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3520	2472	WerFault.exe	87
3612	4092	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lhlcgunxg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5992	cmd.exe
4724	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3912	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4724	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 5992	2472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	92
PID 5992 wrote to memory of 3912	5992	cmd.exe	94
PID 5992 wrote to memory of 4724	5992	cmd.exe	96
PID 5992 wrote to memory of 4092	5992	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 592
  2⤵
  - Program crash
  PID:3520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2472 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe" & start C:\Users\Admin\AppData\Local\LHLCGU~1.EXE -f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 2472
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4724
- - C:\Users\Admin\AppData\Local\lhlcgunxg.exe
    C:\Users\Admin\AppData\Local\LHLCGU~1.EXE -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Direct Volume Access: Opens a physical disk for reading
    - System Location Discovery: System Language Discovery
    PID:4092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 604
      4⤵
      Program crash
      PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2472 -ip 2472
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4092 -ip 4092
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lhlcgunxg.exe

Path C:\Users\Admin\AppData\Local\lhlcgunxg.exe
Size 374KB
SHA256 a2b0855751a7b3ceb84e7dd884593df1a7c4ae918ca8e1b7078df305b3c4ce66
MD5 fb78a23a5527ed19b41b03643e23eae4
SHA1 85d8b581b8a35fc6ffe261ea64f8ec8185e54912
SHA512 4bf2dcc679d9456abd7bb82dd21b9862cce69dca0ab3d7f9bc07c8dbfd3e900d519e09071d7f18bed46542bb7bfdcd8ecaf3f502deaed8707990e762f12a93ab
SSDEEP 6144:sqlZcOt2UaFbYbGDMsrrwJ5ckQ+Zehv6dlalVjjgbAIvXlYbk2E4acu:sOmblMsrrwvmDhv6EVjMb7vH2laB
TLSH
T18784CF2394A2E728D27D32F151668EBCD0B72E76295CCD29A1F472F6A9F10B3EC0454D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2472-0-0x0000000000D70000-0x0000000000D73000-memory.dmp

Download

memory/2472-1-0x0000000000560000-0x0000000000562000-memory.dmp

Download

memory/2472-3-0x0000000001000000-0x00000000010C3000-memory.dmp

Download

memory/4092-6-0x0000000000680000-0x0000000000682000-memory.dmp

Download

memory/4092-8-0x0000000001000000-0x00000000010C3000-memory.dmp

Download

memory/4092-10-0x0000000000680000-0x0000000000682000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads