37fc55a5daeae6ac62babcf7af7b017df6316b09e95d3767d1e0babb48b57121

General

Target
jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe
Size 24KB
Sample261009-w2evqsdd65
SHA256 37fc55a5daeae6ac62babcf7af7b017df6316b09e95d3767d1e0babb48b57121
MD5 21ff1b6848be18650e12be2fd24dbbd5
SHA1 5e461b99c3e987e0e238922a0a58453297e263f3
SHA512 075e35b5f9165c6743b5b298ba68233cd0a8e0e0e7ab9fb96115d9e65016e98a0f1a72a939bf06b3894b435c846806180a6d3be6fcd8ac22b72e9be6db395fce
SSDEEP 768:r3cpN0u1np6SKCZDgMOV/okYvUQUQcnbcuyD7U:rMrJp6SKCZMMYokYchQcnouy8
TLSH
T1D4B2DFDE89398984C00E523B5B5998972C04AB1DBCC77FA26F84343FACD2F586975362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
3460	b2e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek = "C:\\Windows\\system32\\server.exe"	reg.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/776-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/776-11-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2536	cmd.exe
1148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1244	reg.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3460	776	jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe	86
PID 3460 wrote to memory of 1148	3460	b2e.exe	88
PID 1148 wrote to memory of 4900	1148	cmd.exe	92
PID 1148 wrote to memory of 1244	1148	cmd.exe	93
PID 1148 wrote to memory of 3416	1148	cmd.exe	94
PID 1148 wrote to memory of 3076	1148	cmd.exe	102
PID 3460 wrote to memory of 2536	3460	b2e.exe	103

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4900	attrib.exe
3416	attrib.exe
3076	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\E654.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\E654.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\E654.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E838.tmp\batchfile.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4900
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Realtek /t REG_SZ /d "C:\Windows\system32\server.exe"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1244
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\E654.tmp\b2e.exe
Size 25KB
SHA256 6ed874c936b7799e5bf1e2acf26b5fa13960ef528966c22dc5b3a6fe8ef808b0
MD5 3d450c2bdcec3ccaf4175feb7cfa37eb
SHA1 b00d891e6bdf7aec8bab073ec1467c8c24ec030a
SHA512 6db8252444a83e482ec4528e144ee77d6b359108e2476be3c5d74eab2c1683123d4fc3017ebb3547b3473a4a555b6363e3cf55ca715227be9db1ee155d0290b8
SSDEEP 768:d3M7YuszZrbVaC8lxjAvv2WGDyNuIeOPEYpU5X:dVZZa97kETqtSX
TLSH
T11BC29E1FE5418A95C39084F46E2E467EC70117CD9A2D21ABBBDC8D5E3BB0DB0A4B913C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\E838.tmp\batchfile.bat
Size 299B
SHA256 eae0fe285a1bda99b26c71e8cc5f18b62003b5fb2cee17da7b773faba911ed9d
MD5 e5cb3bb786ea6a930488be4b89e7e9d2
SHA1 eb128fa46f666cb94c9c44909fc843c22a010664
SHA512 a53362175ddcf1640edaad0c092c6fff855d491c5b8289fcda37aa9ee901c68c35f5f92bde8b65300c74bd5e760651893eecf588574cc06dad80f6d8fa8aace1
TLSH
T12EE0C2148A0B023B64747824E20C6C87A76FB22D944D030012C222F38445CD9FB20FBB
MD5 SHA1 SHA512 TLSH

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 c455157f94dc328c3d9180b6eea7e47071c7d1739a948213a996ea8c86663427
MD5 9e2f71326b2c7d0a5559126f3c6e8ed7
SHA1 1a02be162f0abd2292886b7e213176889be2bd28
SHA512 743f6390a2dd60f769aee3501672b944a9563719cff530cf5de7de47ac9affed0f26e3a90bd9cc35dc06ec64c42ff7d84c1eac094f4e91ec0369047e539eb2c6
TLSH
T1C0C002089ACBDB9D340490670AB9E64C90B51D083E8A6B649725980D594280EFA82303
MD5 SHA1 SHA512 TLSH

Submit Download

memory/776-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/776-11-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3460-8-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3460-20-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads