a78bf9b0062e9c5cdadb901300d9309a91f7fb2a97e41b18ab5c1b2e3d5280d7

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dapato.peui.exe
Size 1.0MB
Sample261009-wfd2badb94
SHA256 a78bf9b0062e9c5cdadb901300d9309a91f7fb2a97e41b18ab5c1b2e3d5280d7
MD5 de88115d5a247d0fec3998204ae61f5c
SHA1 81c7a18991567e91c77b19f99b077ad1a321345c
SHA512 aadd24896f773740b1c600f9e2f5bb060f7247d3001298f79e714ad4420329b9ffe2f589bfa9af50f2f04a71befd3f4887467bebb13ebf25b2d305f1dae93088
SSDEEP 24576:+8acpqklf9Qo3EdG1dJHS3/aFPGhbSzymxXsw/qxQlvlO0DUQRx/VG:racpzf9QzWnS3/MMbsymG7UNO0DUQo
TLSH
T1D835024EB3F455E8D923C13DCA428516E6B63C511B34CB6F13A9565E3F133A0AE2E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4564	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2212	yixmlgoh.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1212	WScript.exe
2764	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1412	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	jaffacakes118_Trojan-Dropper.Win32.Dapato.peui.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5008	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1212	3848	jaffacakes118_Trojan-Dropper.Win32.Dapato.peui.exe	89
PID 1212 wrote to memory of 2212	1212	WScript.exe	90
PID 1212 wrote to memory of 2764	1212	WScript.exe	93
PID 2764 wrote to memory of 5008	2764	WScript.exe	94
PID 2764 wrote to memory of 1412	2764	WScript.exe	96
PID 1412 wrote to memory of 4564	1412	cmd.exe	98
PID 1212 wrote to memory of 3040	1212	WScript.exe	101
PID 1212 wrote to memory of 4160	1212	WScript.exe	103
PID 1212 wrote to memory of 4144	1212	WScript.exe	105
PID 1212 wrote to memory of 900	1212	WScript.exe	107
PID 1212 wrote to memory of 1196	1212	WScript.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4564	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.peui.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.peui.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\awgpehj.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\ProgramData\yixmlgoh.exe
    "C:\ProgramData\yixmlgoh.exe" e -y -psnwkemd C:\ProgramData\awgpehj.rar C:\ProgramData\qfnuvngenkhk\
    3⤵
    - Executes dropped EXE
    PID:2212
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\qfnuvngenkhk\uuqpbrisqryy.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /XML C:\ProgramData\qfnuvngenkhk\uuqpbrisqryy.xml /TN System\SystemChecks /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5008
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c attrib +s +h C:\ProgramData\qfnuvngenkhk
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h C:\ProgramData\qfnuvngenkhk
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4564
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\awgpehj.rar
    3⤵
    PID:3040
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\yixmlgoh.exe
    3⤵
    PID:4160
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\qfnuvngenkhk\uuqpbrisqryy.xml
    3⤵
    PID:4144
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\qfnuvngenkhk\uuqpbrisqryy.vbs
    3⤵
    PID:900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\awgpehj.vbs
    3⤵
    PID:1196

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

awgpehj.rar

Path C:\ProgramData\awgpehj.rar
Size 448KB
SHA256 1c36f64fc137ad4c6efe058ad4bba8128186f30d5d9aa0ce5517d94865034e0f
MD5 d9ca575424cef44de1bb4b69b0e9b00b
SHA1 821501e7a1bbb77ef796b6bb158bda39eae3c0cc
SHA512 59386bdaa743aa9a024bbdb4329dda84d68f1879b85bd6068f1056c394860239be335739ec716bb5226f980f10411b40cc23866a56087d83f3bd2b5f0874fb97
SSDEEP 12288:ahXG9vdJhT5SBJT/ahzn3fGhYQSlAM3MVNkcRiXc3w/BIxHwZ:2G1dJHS3/aFPGhbSzymxXsw/qxQZ
TLSH
T136A42385D2E5FEC8D9A7C032A7F5D01667EE36E33D1C4B72362C00865A18D43BA86D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awgpehj.vbs

Path C:\ProgramData\awgpehj.vbs
Size 796B
SHA256 034d43451083b344327afbeb14e34d828e7b070af97e3ce1cd3b1961c9c1debe
MD5 8364d89e60921e73a01db845bfa2ab90
SHA1 f80120e22adef89fecfa9361accb3532e0bba72d
SHA512 effd19fc94aa782083f8b3e26fa2d47afdea7a30d374f3e18b2dd7eb1f68efe05eb1eec3393e66807837f2aee5e0ce1122914d5061927a258acfa83d83930879
TLSH
T1D00145086AAB43F4B08309A55B3DBD01CA04EC77EA5D243EB5D44B2FF480EB17823679
MD5 SHA1 SHA512 TLSH

Submit Download

Checks.vbs

Path C:\ProgramData\qfnuvngenkhk\Checks.vbs
Size 1KB
SHA256 8e836fa67c9e6fcc92ca2ac0ad1743a061962cb11f9cc44b16c3ae209b53444c
MD5 fe7b73ddc91029c9694086b5ad9cd3c6
SHA1 01911eb25f0a795a0729c90ff5697c6f5ecdcdbe
SHA512 6e6739c7ec5223db3118cd9cb9f805ed4eb9ccf53ce7c1faf16baa9b6961c4a78c39942853fb661f678c2246faa1c0cd674fd510fe6d324fd874ccbdeeaa8698
TLSH
T102116A2C180BEB58067234B958F55043BBCE885EAB2C4900F460DC38A617C2EF5F8A7D
MD5 SHA1 SHA512 TLSH

Submit Download

uuqpbrisqryy.vbs

Path C:\ProgramData\qfnuvngenkhk\uuqpbrisqryy.vbs
Size 891B
SHA256 87983c5f1c6f123d80f726ecfaf92a952230d71401e25af1d8b6d9e628386993
MD5 aac2a918f91e4cc5de2206f2e14c0a92
SHA1 1ba06abcf45ce69e454e823afcf8e17b3780b26e
SHA512 c67dd49cb818fcdcb1fe7f6628f25a5c645cb10fed763cd9bca34f44fa7c4bb68510284021a7559f9729a8176b2057f41c4fe3e7b5cd2ae58ecb01a2dc301de2
TLSH
T19F1100262527CBF63A5B49C102E38A059790C408E7295121F2C8B28E90B3F2DF5B3777
MD5 SHA1 SHA512 TLSH

Submit Download

uuqpbrisqryy.xml

Path C:\ProgramData\qfnuvngenkhk\uuqpbrisqryy.xml
Size 1KB
SHA256 5d7565022467b97c99a41a1e419ef58a599b388483e8fa3f35b9e3dafaecc671
MD5 44d6ba5cfd8cd3965d1db13f1aec0939
SHA1 861a8b5574d6d956f49b152575f28de3333bfe5b
SHA512 1cab947b60ece7ed1ac2499cf9c10b7bc2e305f98e6487260ab8c0094e66954eb3d0f3a9dcaff65e4a3da6a0321943bbc27f5e9ae37fc726275e1dcd63213177
TLSH
T1A731FEA4ADC0B20BB573413BE7519682FE3A87A746574030F4CC477F2FB618A625352B
MD5 SHA1 SHA512 TLSH

Submit Download

yixmlgoh.exe

Path C:\ProgramData\yixmlgoh.exe
Size 589KB
SHA256 2cf58a93dbac2eaa7c3334fc1343c78956866ab46ff6d16e5aa48f2b463ed61e
MD5 a3af8f589a1d693fe9de72099aaee783
SHA1 eb4c30c44c9fee5f49ee0171210e78ce6212bfd2
SHA512 b0fe239d97477061f2aee5233a269d5adda822b822e14d613f7126262e74a260bb97744bb0fe15a70b9eceeff98bbc1ab7dbfead759ced299ed1a059b09a4c32
SSDEEP 12288:Ce9zhsMWz0EXj9sanIm9eWR5c/XQagZ13mDGOkHy/o/DFXI:h9zKMWQujfbeWR5c/zU13mDGOkHC2DFY
TLSH
T1A6D47D46A7F501A8E0B3D674CE664257FBB378555A308B1F03A9865B2F337608F39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads