6f7de538ea9ff8ac494d98f8c00706444bb55d4b67f378c4d8f111fbe69022fa

General

Target
jaffacakes118_Trojan-Dropper.Win32.Delf.fl.exe
Size 142KB
Sample261009-wvbvhadc96
SHA256 6f7de538ea9ff8ac494d98f8c00706444bb55d4b67f378c4d8f111fbe69022fa
MD5 4fe5d04c53ce3c0a8cc239b54945f17e
SHA1 842795cb689a64cda2eed761e40f723e9040ad2d
SHA512 899f89340842e7425a26b06bf73abd4287905a203cf0f9226b789371d3a94075841dd55f3650b3daf11d2abba57872c1266a8b9c2a0df8dc4bd31749aec3df92
SSDEEP 3072:RLF43yOxJHFyLGMQOiWOBYWFU3FhOl3D:RL63/JHFz8ixC3F63
TLSH
T19DE3124CB5C244E6CE868170FA4CC7200577FCFD92A99B7322E451AC7D27D2B8A4A56F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1688	~DP50A7.exe
5696	~DP52AB.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c54c-3.dat	upx
behavioral2/memory/1688-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1688-32-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Delf.fl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~DP50A7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~DP52AB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	~DP50A7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	~DP50A7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	~DP50A7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	~DP50A7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	~DP50A7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	~DP50A7.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3240	regedit.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1688	992	jaffacakes118_Trojan-Dropper.Win32.Delf.fl.exe	89
PID 992 wrote to memory of 5696	992	jaffacakes118_Trojan-Dropper.Win32.Delf.fl.exe	90
PID 1688 wrote to memory of 2952	1688	~DP50A7.exe	91
PID 2952 wrote to memory of 3240	2952	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.fl.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.fl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\~DP50A7.exe
  "C:\Users\Admin\AppData\Local\Temp\~DP50A7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\cdvd2.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s cdvd.reg
      4⤵
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:3240
- C:\Users\Admin\AppData\Local\Temp\~DP52AB.exe
  "C:\Users\Admin\AppData\Local\Temp\~DP52AB.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cdvd.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\cdvd.reg
Size 359B
SHA256 d72a13f7d1dcf5bc5de6a12418d978cb1302f0aca7d50980d16a85a2cdb3cd9c
MD5 bce0b69e378098dedaa025b053426153
SHA1 797e36c473a0d0deb1f761d2f78d60315c917795
SHA512 1d7da44378e3f3ccb7d5a83fe75e12886e2d80cdc5deb4fd99ed10a5d9231623f425256edd15fbeeb6c92c0300d77be540106250997c2811b220d73d611c13b3
TLSH
T1BFE0C030E9224AB56166F970A1644340FB75F25939E20FED20C992401713844187C36F
MD5 SHA1 SHA512 TLSH

Submit Download

cdvd2.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\cdvd2.bat
Size 20B
SHA256 99dee1f684b6f6ec05cfa4be17ea733dc73a831070ba4dd205c88dfdecf3c950
MD5 26a79fbc6b56d5a6d3ba1d47e9dd2949
SHA1 4df72e69808823a02f99accab8e7aa1f247484b4
SHA512 d2243ef84be008bb181a239d16cb035aa3893e563b4f61a6f24ed28fb733a9315c8aa7a59f940a342398cc55d52aaf7431929beda729d3a747d0795dee7210a5
MD5 SHA1 SHA512

Submit Download

~DP50A7.exe

Path C:\Users\Admin\AppData\Local\Temp\~DP50A7.exe
Size 53KB
SHA256 d32a3f87072c00f902a3a4fce25990799adb23a04e8263be380aa469b5c55882
MD5 9e0d00a7cced4b99293500c6e5460b08
SHA1 83d502eec8e7c6cfbc455e588710f59fc8397463
SHA512 5557c0e5121b5283fdd43106b643a3eaeec4b07ec0d7f03978eab6529320a59081148ed8da5de59d5471e9eb7dd0e0d3fbab1b33982eeeed6eb9b1075e416b72
SSDEEP 1536:KJ0C8ZvADpPJlrx+1vDpaxYnLAYUNZ6rzl6VJ3o:KQZvilrE1vDpaMAYr4fo
TLSH
T1B443F28B9B733843F856313C199769D26352EF71722A3F237980D23E7916E94DD0A790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DP52AB.exe

Path C:\Users\Admin\AppData\Local\Temp\~DP52AB.exe
Size 91KB
SHA256 faa70ece77b0e161baa397a147fb3334c48a5ef47607c856b4cb999c5f0e6405
MD5 c0892bc084816a670c79bec77b19f909
SHA1 6f0dc3de33a8e23029b7502232d3c17f6f3a33d3
SHA512 6b24ca41c2fbf049c84f273a5024e7c1f32cb48246ce5a1ef0f3e7226f7865df756e2e72bfa4af799f07bc040cd8e5585a711a0dd7200f5ee735b55902fb33cd
SSDEEP 1536:CEq5CUQMRRmvn14+r55D8w+tvv1m2vtrOlZb6fCke76kUU6/6Qt32+urJEeakI:YCUtRm35r+tn1m5lZb6fCke76kUn/6wp
TLSH
T1B5934A13B2E28C73E1F11A7C9C15A1A4943FFE212E28175B7BA90A4D0D7D2C6599C2DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-19-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1688-13-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1688-32-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5696-33-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads