385370400564b8a4ef8b422a6ffbf53dc9d150ea2d185570678415eaa7f8a190

General

Target
jaffacakes118_Virus.Win32.Qvod.f.exe
Size 136KB
Sample261014-ppx28avxb1
SHA256 385370400564b8a4ef8b422a6ffbf53dc9d150ea2d185570678415eaa7f8a190
MD5 a66928b9e904d9f8db0b9adfe2581a30
SHA1 dc96b2f54f0a1802a6272d9d1bb8bfc9b0aa095f
SHA512 5fac23e1721fa6c0667f019a379d156c58b1ef372767102e92820154a1398dc35139e09a55067edcd2109569fee8de43a143d21b5e6f9003076685ad91a527de
SSDEEP 1536:cMASiLNFZdO/NTpxQaklLkdbbCzJ7VyzypXbPvt/eZHcpUAIznWcLKf67OWugLrL:c3vO/NGlLEDAIznZKCoY
TLSH
T100D36DBA1754A13BC4E2013122655B9A4EFE7F795838EC0BCB541E493AFA5EBD230353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	376508c1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	376508c1.exe

Executes dropped EXE 1 IoCs

pid	Process
2036	376508c1.exe

Loads dropped DLL 12 IoCs

pid	Process
5316	svchost.exe
5960	svchost.exe
4508	svchost.exe
5768	svchost.exe
1180	svchost.exe
2492	svchost.exe
1716	svchost.exe
4260	svchost.exe
4460	svchost.exe
1764	svchost.exe
4860	svchost.exe
4500	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	376508c1.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	376508c1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1984-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1984-16-0x0000000000400000-0x0000000000422000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Virus.Win32.Qvod.f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	376508c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	376508c1.exe
2036	376508c1.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2036	1984	jaffacakes118_Virus.Win32.Qvod.f.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Qvod.f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Qvod.f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984
- C:\376508c1.exe
  C:\376508c1.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs
1⤵
PID:6048

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5960

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4508

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1180

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1716

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4460

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4860

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

376508c1.exe

Path C:\376508c1.exe
Size 100KB
SHA256 643a84c52c06f391d88fa03a8989166feb595686ead55d9037a00653fdda6395
MD5 377355cc1b5ee4acd24f07ae4d789121
SHA1 00c7dffb208d1a8c99f388ab6b84933b2bb1906a
SHA512 616cfcc1cc06ed124d164aab8b72e57be9202eae4962467940c8f6e6cf27a229de2963fe8af7c9372dc38813cd4ffc82263d9643baac85609191541e37784341
SSDEEP 1536:JTpxQaklLkdbbCzJ7VyzypXbPvt/eZHcpUAIznWcLKf67OWugLrppI:JGlLEDAIznZKCoYg
TLSH
T193A36CBA1240B17FC495013222265F9B4EFD3F795468E81BCB956E5836FB2EBC230257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fastuserswitchingcompatibility.dll

Path \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll
Size 100KB
SHA256 8ada49e7ea367a2c69ec7f90b654e96b8a88bb11dbbc17e3a5ee635b56aab121
MD5 ba58180d89500a343427b1ef3f747aab
SHA1 a1fba7d0626af16e3e2669cb6bbdb11cae48ea52
SHA512 5041823e1085e6f1d546572d9ef7af0786a1abb1ab5286fa2131311740a36a9f9a9518bad859dbf91aa906ac97b235a5b3b400bf994ac36f56e973e2c95f5d2c
SSDEEP 1536:JzpxQaklLkdbbCzJ7VyzypXbPvt/eZHcpUAIznWcLKf67OWugLrppI:JmlLEDAIznZKCoYg
TLSH
T11AA36CBA1240B17FC495013222265F9B4EFD3F795468E81BCB956E5836FB2EBC230257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1984-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1984-16-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2036-5-0x0000000000870000-0x000000000088C000-memory.dmp

Download

memory/2036-47-0x0000000000870000-0x000000000088C000-memory.dmp

Download

memory/5316-11-0x0000000074AC0000-0x0000000074ADC000-memory.dmp

Download

memory/5316-12-0x0000000074AC0000-0x0000000074ADC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads