2fd582b539eb88e54a7c7e6643b834cfdb984cb0d0a7bc8745efc232868bdd6c

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dapato.pezx.exe
Size 1.1MB
Sample261009-wff6nsdb95
SHA256 2fd582b539eb88e54a7c7e6643b834cfdb984cb0d0a7bc8745efc232868bdd6c
MD5 491fdc2d86a91b9d8b3fcb83cfe63205
SHA1 739fade926882a7add6a3876d896d47a8e1bf0cc
SHA512 7f35a37e60639108e2f92967de9d7fe55ab3bbf90ff23f75ac1106914b0c62b905632aa3bc953da7eb9bb37a3a9ced21ffe5474b07df4fe99987c701e83372ef
SSDEEP 24576:+8acpqklf9Qo3EC7yp6uEB4zT/ZBXf8johI209pwI5BhvlO0DUQRx/VN:racpzf9Q+uEBAT/Lf8a096I5BhNO0DU4
TLSH
T14635024EB3A155E9D923C53CC9028646E6B23C104B31DE6F17A6976E3F133A09F2D362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3968	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
1468	yuxudi.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3076	WScript.exe
3660	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2916	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	jaffacakes118_Trojan-Dropper.Win32.Dapato.pezx.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
764	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3076	1624	jaffacakes118_Trojan-Dropper.Win32.Dapato.pezx.exe	90
PID 3076 wrote to memory of 1468	3076	WScript.exe	91
PID 3076 wrote to memory of 3660	3076	WScript.exe	94
PID 3660 wrote to memory of 764	3660	WScript.exe	95
PID 3660 wrote to memory of 2916	3660	WScript.exe	97
PID 2916 wrote to memory of 3968	2916	cmd.exe	99
PID 3076 wrote to memory of 5308	3076	WScript.exe	102
PID 3076 wrote to memory of 2668	3076	WScript.exe	104
PID 3076 wrote to memory of 2160	3076	WScript.exe	106
PID 3076 wrote to memory of 816	3076	WScript.exe	108
PID 3076 wrote to memory of 2464	3076	WScript.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3968	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pezx.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pezx.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\pohwcmruzz.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\ProgramData\yuxudi.exe
    "C:\ProgramData\yuxudi.exe" e -y -pjjleynktqyklqva C:\ProgramData\pohwcmruzz.rar C:\ProgramData\bhigolozjqwejj\
    3⤵
    - Executes dropped EXE
    PID:1468
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\bhigolozjqwejj\fvcnjpkscjtb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /XML C:\ProgramData\bhigolozjqwejj\fvcnjpkscjtb.xml /TN System\SystemChecks /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:764
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c attrib +s +h C:\ProgramData\bhigolozjqwejj
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h C:\ProgramData\bhigolozjqwejj
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3968
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\pohwcmruzz.rar
    3⤵
    PID:5308
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\yuxudi.exe
    3⤵
    PID:2668
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\bhigolozjqwejj\fvcnjpkscjtb.xml
    3⤵
    PID:2160
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\bhigolozjqwejj\fvcnjpkscjtb.vbs
    3⤵
    PID:816
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\ProgramData\pohwcmruzz.vbs
    3⤵
    PID:2464

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Checks.vbs

Path C:\ProgramData\bhigolozjqwejj\Checks.vbs
Size 1KB
SHA256 4f326505f14bd782df294b89ad6afd8c19273858c2b88c473c96f2c5c988049e
MD5 119ee67b62b871506751e80879502474
SHA1 a78d6b4252402b54b9fcd43e178081f24cb57a02
SHA512 2bcd2534c46eda1b6669a955595bf5e44f63bfc16f708dd33c2a89c31a5b03b62f06efa2cd9baa2cbc7d8ceba0ec45887d0bde2c4b3721073f9b39f22150bbe1
TLSH
T153113A2C581BDF54423334B588F65043BFCA85296B1D8E01F424DC7CA61BC1EE5F8AB9
MD5 SHA1 SHA512 TLSH

Submit Download

fvcnjpkscjtb.vbs

Path C:\ProgramData\bhigolozjqwejj\fvcnjpkscjtb.vbs
Size 898B
SHA256 a6f86d695831a06f082b768679b6f4398dd01c28e39ff3abf6e2771b5344ffec
MD5 4793b24c1236f4a1457d19f7582184c7
SHA1 9b53ad946800710132bb930d8fc6b0b08a90c174
SHA512 943544aa7a57c43c588f3cf64b2c0754b7683a984aa121aa8c8d41886f471d3729e0ebcdfceabf431072a701dc1d83efa9dec1787f5b150ff8a657aee1395002
TLSH
T1851159797606876FB831C86176ABAC0B96A0D82D3D345814E0C1C5DC5A1177FAF3B3DA
MD5 SHA1 SHA512 TLSH

Submit Download

fvcnjpkscjtb.xml

Path C:\ProgramData\bhigolozjqwejj\fvcnjpkscjtb.xml
Size 1KB
SHA256 ce20f866a9da82b44978105060254e955133083dd829caa6ae2f9be5f438abdb
MD5 075c4dba711e0352bdcd505c5faec4be
SHA1 c68620a7df1488f31c7c9041c11f1edc5395c7c7
SHA512 a4a372c178d654a7b2346683ce90629915ef3e7841a4ed22812f31bc8dffeff849a2b922abfe694675e1d638dadc4c417bf220a0af06f76369eb92c92d6bb0c7
TLSH
T1F631FCA4ADC0B20BB573413BE7519682FE3A87A746564030F4CC477F2FB618A629352B
MD5 SHA1 SHA512 TLSH

Submit Download

pohwcmruzz.rar

Path C:\ProgramData\pohwcmruzz.rar
Size 506KB
SHA256 b73200550da8fa05417b814a6ab132bab190a4931f6ddf279eabdc6e015c210b
MD5 597002ab7372ca2934759935bd2e3877
SHA1 9aa5057f61afbceec9894264f86ad648a3f1dd00
SHA512 b777d796c4b01d2ed2d80d437ab227a49dbe4c10f5b0d217c62f3bf6394ce3cb4417b4c4a1d267b66e680e2cd8cf7db990f8ebcd32714a1f1c0366e78cc5c524
SSDEEP 12288:E7ypFpjKuvcPpB9WexuCq/ZNH3HYpW8s8JgThI20PeCpwI5arEiwN:E7yp6uEB4zT/ZBXf8johI209pwI5BZ
TLSH
T10DB4234B809369075A5D40B296AA8397378732B84868FC4EFF2683B3316BEB05F155C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pohwcmruzz.vbs

Path C:\ProgramData\pohwcmruzz.vbs
Size 849B
SHA256 a5ed52a56b382acbe3763552515551c0b1c95cb421a8d6fc46a7a2ee0e860059
MD5 985e9430499a25e66282a6a2160d80d5
SHA1 20d5855f0e4b8fd8af80382573749342b893d0bb
SHA512 810789802785332df4a5ed17e6bfaa56592db43be2d7e05d51473045038afefb198e46c53c3e612fe8971d41e165c0e0e189323d84eb57d29105d1c317a79c43
TLSH
T13C01634D79DE47E460E1002457AB8D12D702E83992466E3D91941B1AF8D47AA3C73DF8
MD5 SHA1 SHA512 TLSH

Submit Download

yuxudi.exe

Path C:\ProgramData\yuxudi.exe
Size 589KB
SHA256 2cf58a93dbac2eaa7c3334fc1343c78956866ab46ff6d16e5aa48f2b463ed61e
MD5 a3af8f589a1d693fe9de72099aaee783
SHA1 eb4c30c44c9fee5f49ee0171210e78ce6212bfd2
SHA512 b0fe239d97477061f2aee5233a269d5adda822b822e14d613f7126262e74a260bb97744bb0fe15a70b9eceeff98bbc1ab7dbfead759ced299ed1a059b09a4c32
SSDEEP 12288:Ce9zhsMWz0EXj9sanIm9eWR5c/XQagZ13mDGOkHy/o/DFXI:h9zKMWQujfbeWR5c/zU13mDGOkHC2DFY
TLSH
T1A6D47D46A7F501A8E0B3D674CE664257FBB378555A308B1F03A9865B2F337608F39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads