246c2b85f0225cbaa22122abd3c4e1e18a05ef428d267348c92a9c1cd81bdafd

General

Target
jaffacakes118_Packed.Win32.Katusha.n.exe
Size 105KB
Sample261011-1pcxtshe83
SHA256 246c2b85f0225cbaa22122abd3c4e1e18a05ef428d267348c92a9c1cd81bdafd
MD5 4d73c600767d07c5363ed0b464e706fb
SHA1 0327d4add71c6c69e3a9037f3799c59b344bd7ab
SHA512 9302e9251124177d46b2ac98aa0c387ece48f138cc1099fdfe0d70ea83af27e6bebedfc702f3ee1f4e2e01e96945855e40ca61e663f6a5c8ad2974b1b37ef46e
SSDEEP 1536:9tUh4HDp+5M2ie7u/EWa5XGcyzfKQTE3x3EpP+GvWw:7Uh4jpHXeoEf52cyzfnE3x3UP+d
TLSH
T131B3AE13B7912107F0958734D0892B77CE196D70691AA4729383EF6FA73E4E1CA7970B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	jaffacakes118_Packed.Win32.Katusha.n.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 16 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive14	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive11	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive10	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive7	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive4	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive3	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive1	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive12	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive6	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive5	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive13	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive9	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive8	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive2	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive0	jaffacakes118_Packed.Win32.Katusha.n.exe
File opened (read-only)	\??\PhysicalDrive15	jaffacakes118_Packed.Win32.Katusha.n.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2652	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Packed.Win32.Katusha.n.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Packed.Win32.Katusha.n.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Packed.Win32.Katusha.n.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2652	536	jaffacakes118_Packed.Win32.Katusha.n.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Katusha.n.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Katusha.n.exe"
1⤵
- Checks computer location settings
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Lxf..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lxf..bat

Path C:\Users\Admin\AppData\Local\Temp\Lxf..bat
Size 218B
SHA256 86fe27dd5820db034ce331e36790826871b50c96220793fed3a3e921c78a8105
MD5 26ba237ba4b751f0ebb456d67f670027
SHA1 1308380cecd695a91171f5c9a8e0492a71b7d24f
SHA512 6b6913a2f4b084d8e25b83c550ef750e3bc2f6745040ad7da7d44c9f0776a9b33108b261fc436695542a52c50208fa3ba99ce582103c4c379545237695c92ef4
TLSH
T1E8D0A740C14589070800CD1B8572934D84580E4927962F684B63C6F48D7166AF6D66D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-0-0x0000000000580000-0x0000000000596000-memory.dmp

Download

memory/536-2-0x0000000000400000-0x000000000041C000-memory.dmp