37fc55a5daeae6ac62babcf7af7b017df6316b09e95d3767d1e0babb48b57121

General

Target
jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe
Size 24KB
Sample261009-w2evqsdd65
SHA256 37fc55a5daeae6ac62babcf7af7b017df6316b09e95d3767d1e0babb48b57121
MD5 21ff1b6848be18650e12be2fd24dbbd5
SHA1 5e461b99c3e987e0e238922a0a58453297e263f3
SHA512 075e35b5f9165c6743b5b298ba68233cd0a8e0e0e7ab9fb96115d9e65016e98a0f1a72a939bf06b3894b435c846806180a6d3be6fcd8ac22b72e9be6db395fce
SSDEEP 768:r3cpN0u1np6SKCZDgMOV/okYvUQUQcnbcuyD7U:rMrJp6SKCZMMYokYchQcnouy8
TLSH
T1D4B2DFDE89398984C00E523B5B5998972C04AB1DBCC77FA26F84343FACD2F586975362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5056	b2e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek = "C:\\Windows\\system32\\server.exe"	reg.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4776-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4776-12-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5160	cmd.exe
4240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3140	reg.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 5056	4776	jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe	90
PID 5056 wrote to memory of 5160	5056	b2e.exe	91
PID 5160 wrote to memory of 6040	5160	cmd.exe	93
PID 5160 wrote to memory of 3140	5160	cmd.exe	94
PID 5160 wrote to memory of 2832	5160	cmd.exe	95
PID 5160 wrote to memory of 5976	5160	cmd.exe	97
PID 5056 wrote to memory of 4240	5056	b2e.exe	98

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5976	attrib.exe
6040	attrib.exe
2832	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\1C0A.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\1C0A.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\1C0A.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.atfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1E3C.tmp\batchfile.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:6040
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Realtek /t REG_SZ /d "C:\Windows\system32\server.exe"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\1C0A.tmp\b2e.exe
Size 25KB
SHA256 6ed874c936b7799e5bf1e2acf26b5fa13960ef528966c22dc5b3a6fe8ef808b0
MD5 3d450c2bdcec3ccaf4175feb7cfa37eb
SHA1 b00d891e6bdf7aec8bab073ec1467c8c24ec030a
SHA512 6db8252444a83e482ec4528e144ee77d6b359108e2476be3c5d74eab2c1683123d4fc3017ebb3547b3473a4a555b6363e3cf55ca715227be9db1ee155d0290b8
SSDEEP 768:d3M7YuszZrbVaC8lxjAvv2WGDyNuIeOPEYpU5X:dVZZa97kETqtSX
TLSH
T11BC29E1FE5418A95C39084F46E2E467EC70117CD9A2D21ABBBDC8D5E3BB0DB0A4B913C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\1E3C.tmp\batchfile.bat
Size 299B
SHA256 eae0fe285a1bda99b26c71e8cc5f18b62003b5fb2cee17da7b773faba911ed9d
MD5 e5cb3bb786ea6a930488be4b89e7e9d2
SHA1 eb128fa46f666cb94c9c44909fc843c22a010664
SHA512 a53362175ddcf1640edaad0c092c6fff855d491c5b8289fcda37aa9ee901c68c35f5f92bde8b65300c74bd5e760651893eecf588574cc06dad80f6d8fa8aace1
TLSH
T12EE0C2148A0B023B64747824E20C6C87A76FB22D944D030012C222F38445CD9FB20FBB
MD5 SHA1 SHA512 TLSH

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 55179a8e4d144dafe91fc1a8bf3533afea8e1c6144df1aa59dce411e086c85db
MD5 7b5558bbd3c5155f4dc09640f20710f2
SHA1 bbead7aca02bda4b2584253592464ef58fd104b6
SHA512 a4e11f960b6a8b2ee0e1c009157d2d361ad6a32ff72ea10db5b5c80164cd00fca4958b24dc6162ee2f3da636f33032853b7709d1aebe6c1a647067ab31f6bfba
TLSH
T114C04C118BCBDB5D6504A06707B6E64CD0B50E0C3F8A3B6087A5C84C254280FFAC3302
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4776-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4776-12-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5056-9-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5056-29-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads