5a0268537f8a6e45bc5127911e53b9d7364fbff3c2cd08ba418d004b172203d7

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 288KB
Sample261014-jbf9nafb46
SHA256 5a0268537f8a6e45bc5127911e53b9d7364fbff3c2cd08ba418d004b172203d7
MD5 dd407e1f12fc0d790bf24761af6191f7
SHA1 02469c817841efe6d734f5cdfc6e598f772a023b
SHA512 8d59e38c477dd0a7082fb219d6b4480c5f0f53655caa334c34d3eb0f704d0f309f66fab0e02cd935e27e1dbf595dface1e784d5d0edfe366662832b8d4ab208b
SSDEEP 6144:Ju2urzh9xu/XkauL5J9SOIY56ae1EooRg/b3i:Jutrzh9xOXkFSOIYgaYoRgT3i
TLSH
T15E54E29233C24067F6415A3036B7D73D6A76BC2C13905E97B758078B39FB2E1EA0561B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\PCIDump.sys	Server.exe
File opened for modification	C:\Windows\SysWOW64\drivers\PCIDump.sys	WinHelp32.exe

Executes dropped EXE 5 IoCs

pid	Process
4156	nt.exe
1496	er.exe
5644	240715937.exe
468	Server.exe
4404	WinHelp32.exe

Loads dropped DLL 1 IoCs

pid	Process
4156	nt.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinHelp32.exe	Server.exe
File created	C:\Windows\SysWOW64\WinHelp32.exe	WinHelp32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240715937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHelp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	er.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	468	Server.exe
Token: SeIncBasePriorityPrivilege	4404	WinHelp32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 4156	2676	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 4156 wrote to memory of 1496	4156	nt.exe	91
PID 1496 wrote to memory of 5644	1496	er.exe	92
PID 5644 wrote to memory of 5516	5644	240715937.exe	93
PID 1496 wrote to memory of 468	1496	er.exe	95
PID 468 wrote to memory of 4404	468	Server.exe	96
PID 468 wrote to memory of 4368	468	Server.exe	97
PID 4404 wrote to memory of 5412	4404	WinHelp32.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\nt.exe
  "C:\nt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\er.exe
    er.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\240715937.exe
      C:\Users\Admin\AppData\Local\Temp\\240715937.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5644
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\240715937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
  - - C:\Server.exe
      C:\Server.exe
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\Windows\SysWOW64\WinHelp32.exe
        
        "C:\Windows\system32\WinHelp32.exe"
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4404
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\WINHEL~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Server.exe > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Temp.exe

Path C:\Temp.exe
Size 32KB
SHA256 bdf6ba4efcfc337bde757eb69566f8bd5b0ff28cdb85cf37f1ae7e466ddb24c4
MD5 9d3b21557eb74e2f3997ba6a6b3a0a81
SHA1 07b224120cc77ccce22e56da2b33b5cfabcc35cb
SHA512 85ab9d33a01c7cd110ca2532a5703985449b7b75f3f8ef9a1b7c3a6bb5efe09df6b76e891b68ed0698e1ed8c150609ddf3b0f84c68ae7643dd11a97578c4aa2d
SSDEEP 768:nxIwrOBR04is65JkzCs25y6GPFezHGuuyuGYW9vtI:qBR04l67s2uoLTuyuLeu
TLSH
T18EE24BD15830C8B555B1E4848B41AA45D2D09F7CF498927E3DF07EE734AAE3DB8AF029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCIDump.sys

Path C:\Windows\SysWOW64\drivers\PCIDump.sys
Size 4KB
SHA256 5947ff34e874e7e455cc441b017b11b63fc4fb315b311766fb83070ea7012259
MD5 7434b98a847fdcb753d8db6341680db7
SHA1 859816f07486ae2ffdffd56f1ff77677bfd14f2b
SHA512 8d8de33e245eadabfb2d111aee51dbb0b64238cc82bc1cdd55a440f0f985466d2090a50c6363960bef09b41dd4bdf5888a2a99d37940211b092112ec5030ab53
SSDEEP 48:4ib8WE60cpyDrSEUG0mnYl0oJLcW5r4zU9BmMjN6gI6+rdWuKEWHVIRrA5j:7a6hoD+EUG0mYl0oxcRaogItrdL/Ba
TLSH
T1B191C66362C16C70EABD9DF9481F552191AFF9820F0312CB3A96819C6D833D5B83565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nt.dll

Path C:\nt.dll
Size 101KB
SHA256 441995e31da9ef0c6a84217700f4048e53a34db08eea64d3e1b57185dcf5b4ad
MD5 da695e131d443b1d05daa3fd345efe8b
SHA1 223d29c980389ea5536cdb0a0cc66476ee9423c7
SHA512 550c033a8e98e442be345c9866ada49b67827c87bedcaeafd4aa832849fc7ee9bee88590fcece67af119858868ae77e49846b6a12d759e61b02de29cb95840bb
SSDEEP 1536:Fp30T6DIj9/F9Ezp37ozly8LJtaTR6cnK2kEYUH6KV51azWa:F6OA9/F9mQa6cnKTEd6K4zWa
TLSH
T1FFA35C15BBC08833C05E4D7945A6E221DB3AD5039BF9C7C36B1E0AB56FEA2D19D34386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reg.ini

Path C:\reg.ini
Size 26B
SHA256 733b3a846cdc10775ad7fc66e20a7ab2f73af37e0576412ef6d433aaa1d5bc17
MD5 c95217b51fef2f40749691de60cfbde1
SHA1 009c7403aa58b868430fbd3f979cb2f0a5ce9e03
SHA512 183aa659789f81d439972f8457f0c51c5d16b6a42caf1c12cf04dab36e6be4b92714e00fbf96098212f7825088deacbc3256d1ea441ea8dbbe039cda93fc4a68
MD5 SHA1 SHA512

Submit Download

memory/4156-19-0x0000000000820000-0x000000000086A000-memory.dmp

Download

memory/4156-20-0x0000000000820000-0x000000000086A000-memory.dmp

Download

memory/5644-32-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/5644-39-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads