eff25b91750923db9788c6d146b5732170c8596ae8edb706c69407999d3428fe

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 836KB
Sample261014-bd7kmady9v
SHA256 eff25b91750923db9788c6d146b5732170c8596ae8edb706c69407999d3428fe
MD5 2f1cfc3e8e34f0f3e231a996feecb42e
SHA1 8f6a637e314e6bc23f9b8945db32cceb7ebb73fa
SHA512 4c1cc8328bc84327b73a7c19b9c68f419273482e1aad6e31de6aafa95222efbfd461d1a6d37fca50bfb0daf4b22724ab468b86e875135f4c2a32683d2510aefb
SSDEEP 24576:sc//////mCV0NDFFVMaR82h2X1ijws3ROR:sc//////ZEDFFfRRk1Cws32
TLSH
T1400525D361B95A72D2DF0372A07336E58A58389C9B1FD808754C3F58E9B6BD0144BCBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2056	¸´¼þ nn.exe
2876	Wowshell.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001b8b0-3.dat	upx
behavioral2/memory/2056-5-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2056-23-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5116	cmd.exe
3256	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4988	2056	WerFault.exe	93
5756	2876	WerFault.exe	94

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Wowshell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Wowshell.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¸´¼þ nn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wowshell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	¸´¼þ nn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	Wowshell.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2876	Wowshell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	Wowshell.exe
2876	Wowshell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 5116	4200	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 4200 wrote to memory of 3256	4200	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 5116 wrote to memory of 2056	5116	cmd.exe	93
PID 3256 wrote to memory of 2876	3256	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\\¸´¼þ nn.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\AppData\Local\Temp\¸´¼þ nn.exe
    "C:\Users\Admin\AppData\Local\Temp\\¸´¼þ nn.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1100
      4⤵
      Program crash
      PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\\Wowshell.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Wowshell.exe
    C:\Users\Admin\AppData\Local\Temp\\Wowshell.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 1336
      4⤵
      Program crash
      PID:5756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2056 -ip 2056
1⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2876 -ip 2876
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wowshell.exe

Path C:\Users\Admin\AppData\Local\Temp\Wowshell.exe
Size 736KB
SHA256 7ad759a50812a2feee1e6db7c1b1f85d87b76036cbf0dfff900793c8dc8a2232
MD5 a9f83e2ad2f4eb40604bf3c8cb9eea77
SHA1 1e77ddc36daf3bc97a49c8cbc983ab4f0d5db383
SHA512 eb2da7d9b2371b081008e3b5e1c952f972f23d985c46395b4c591f5a5298bd069960b3f5341dee24b77bfafc6047e3552d41b57ce3dd51d6de4153fad5f653c6
SSDEEP 12288:DBhk6PHzWEMDATkBzwcWnmJlM7b0CKRG79Eim17/VWCJr1AeAxkEEpASrO:DdPHLx8yb0C+sKikWCJZRukU1
TLSH
T1EEF49C21BEBCC0B6E8A2367508769A056536BD547BA49AC777C43B49CB303F1DE36342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wowshell.xml

Path C:\Users\Admin\AppData\Local\Temp\Wowshell.xml
Size 546B
SHA256 728f08c8e2ab36756759eb127286ae09a52b79a69d27de2e3c9714a520fb0aa7
MD5 fe73e640ea4ab6dce8b40797b8fa7010
SHA1 576cebb877e7b3fb57b4096bef10d10b79b7ed14
SHA512 aa4502faa2bdcc036aae4b535707c49c3f4c8515c1d1950173d93d695f89a5907cff57aa648b04d0c152ac8dbefc29ea00413cf1185fdd9cbaa24d85882273b7
TLSH
T115F02747E3815CA20F214A744E27AF1ADB58E1F346D570C833CEA50B2FB7C585297C22
MD5 SHA1 SHA512 TLSH

Submit Download

Wowshell.xml

Path C:\Users\Admin\AppData\Local\Temp\Wowshell.xml
Size 578B
SHA256 fdaf73a2bdb5606d493b783bb9aa331831299610c666d8eac41f7c907f0f8d17
MD5 fb8e590d83bf744411ff5d2ac3401063
SHA1 9877379bedbb8f766e9c6d1ef364b0366c15a4d1
SHA512 19ac046242582abec99d81dd4845435940b091dd38d40a4c7c1c5fe105c7df56629bcf77e8616f4bcb1b8d94f34d0f1fade91dbfac77ad252cad7a3ad827b377
TLSH
T184F05947E2819CA20B214A700E27AA1ACB5CE1F3429570C833CE650B2FB7C584157C22
MD5 SHA1 SHA512 TLSH

Submit Download

¸´¼þ nn.exe

Path C:\Users\Admin\AppData\Local\Temp\¸´¼þ nn.exe
Size 26KB
SHA256 b7a313ab2cda7f25db579609e69087140f436011bed52ed97ceb9770e5aa70ef
MD5 4ad9d4f7bfe023d06f17046686a65b38
SHA1 4261a1a7afff4b67c99c7ee7821425ec6556f185
SHA512 c31af879cb268edb1967f5318edacf2e08b488820ff9e095508d13b324d6b469e45c57758e996809c944818b8e648be6f7093eb958d64c66dc69f808e56aee45
SSDEEP 384:5w/obo7BBRGFprbzzp7ggWElfmh3Yv4ALIVvnke4uMXpPQyovdLpefC+m6PsaDLD:5M7IPegWEhmiqV8cMXpJERSLPTWq
TLSH
T1E3C2D07AFEE549FFCE40DA378317B8381278B1E595288709BE5752373D5609308A8B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exeupdate.xml.zip

Path C:\Users\Admin\AppData\Roaming\Wowshell\exeupdate.xml.zip
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2056-5-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2056-23-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4200-2-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads