poisonivy | 5752acb9ad0b12d2b2a6b98b83bd1e52b19cf2a1208827428fc3288156432649

General

Target
jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe
Size 40KB
Sample261009-w2ws9add76
SHA256 5752acb9ad0b12d2b2a6b98b83bd1e52b19cf2a1208827428fc3288156432649
MD5 8cbdef7b28ab173f751d1ec9dec5396c
SHA1 e65e5281c97e32f9677a40b35034c53dec1a0bdd
SHA512 cd59bc7e6a82574917f6f9d04408c8bde9fe901281c87515f2fcafe61125811c0c1d0848ad99958865a416c1322f0fdbee64206c3fdc53e28ba673139584af78
SSDEEP 768:LEYQabRM+2D8/w6Q7hBSX9KhV1MSQCZudAaCUDYvXjDTK//4x8lha5:LE3abRV5Il7DZhV+hCZhLvvTKnLr
TLSH
T18C03E1A56F1945B3C5CB9DB3147E3A175B3BB5618233460782A8905F1C036FCCA7D2E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 defense_evasion discovery execution poisonivy rat

Malware Config

Signatures

Family: PoisonIvy
PoisonIvy is a remote access trojan used by many threat actor groups, first seen in 2005.
rat poisonivy

Detects PoisonIvy RAT 1 IoCs

resource	yara_rule
behavioral2/memory/3372-4-0x0000000000400000-0x0000000000423000-memory.dmp	family_poisonivy

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c612-1.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3372	update.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Outlook Express\update.exe	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1528	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5724	cmd.exe
552	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	3372	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe
3372	update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3328	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 552	3328	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe	89
PID 3328 wrote to memory of 5724	3328	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe	90
PID 3328 wrote to memory of 3372	3328	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe	93
PID 3372 wrote to memory of 1528	3372	update.exe	94
PID 552 wrote to memory of 3048	552	cmd.exe	95
PID 3372 wrote to memory of 4528	3372	update.exe	96
PID 5724 wrote to memory of 2972	5724	cmd.exe	99
PID 4528 wrote to memory of 5300	4528	net.exe	101
PID 3328 wrote to memory of 2908	3328	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe	104
PID 3328 wrote to memory of 4968	3328	jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe	106

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.rdv.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 10:00 /every:M,T,W,Th,F,S,Su "C:\Program Files\Outlook Express\update.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\at.exe
    at 10:00 /every:M,T,W,Th,F,S,Su "C:\Program Files\Outlook Express\update.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 19:29 /every:M,T,W,Th,F,S,Su "C:\Program Files\Outlook Express\update.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\at.exe
    at 19:29 /every:M,T,W,Th,F,S,Su "C:\Program Files\Outlook Express\update.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
- C:\Program Files\Outlook Express\update.exe
  "C:\Program Files\Outlook Express\update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\sc.exe
    sc config eventlog start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Windows\SysWOW64\net.exe
    net start eventlog
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start eventlog
      4⤵
      System Location Discovery: System Language Discovery
      PID:5300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 564
    3⤵
    - Program crash
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "c:\users\admin\appdata\local\temp\jaffacakes118_trojan-dropper.win32.demp.rdv.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3372 -ip 3372
1⤵
PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.exe

Path C:\Program Files\Outlook Express\update.exe
Size 40KB
SHA256 5752acb9ad0b12d2b2a6b98b83bd1e52b19cf2a1208827428fc3288156432649
MD5 8cbdef7b28ab173f751d1ec9dec5396c
SHA1 e65e5281c97e32f9677a40b35034c53dec1a0bdd
SHA512 cd59bc7e6a82574917f6f9d04408c8bde9fe901281c87515f2fcafe61125811c0c1d0848ad99958865a416c1322f0fdbee64206c3fdc53e28ba673139584af78
SSDEEP 768:LEYQabRM+2D8/w6Q7hBSX9KhV1MSQCZudAaCUDYvXjDTK//4x8lha5:LE3abRV5Il7DZhV+hCZhLvvTKnLr
TLSH
T18C03E1A56F1945B3C5CB9DB3147E3A175B3BB5618233460782A8905F1C036FCCA7D2E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~26B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\~26B8.tmp
Size 23KB
SHA256 c0beee11f926fb508a38a9f589fed949910e8ceaf37d2f0553e1ed6018692f21
MD5 3b481bdf4e15d3a674100a0e7a09591b
SHA1 b794723f16bdc00e1a253a952fd174afa3652fad
SHA512 a1536c94d64f34c88bb5c5fbcc557df695a4711043fef351eb17d0670a053c0174100bc4a9f1ca4d1a61113ce955256402a5a5bd4764f75acd3d60c4c0cbecf8
SSDEEP 384:5mruY0fG1/absk1s3bLeZljUGnuNDWkBZ+01Q1QLEoZt69HJY8/bZhXX:I0eoF1s3PuljUGuNKO4UAQ1GZJLbZpX
TLSH
T124B2D0F84B0961D6807BF14D7516B602356BD2BBAD29DE0CECA2A103397728C173EC99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3328-5-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3372-4-0x0000000000400000-0x0000000000423000-memory.dmp