d448405a99d2f603d972da77dc923dadd11bd33eda17eadef9bb85ef7b22444a

General

Target
jaffacakes118_Trojan.Win32.Inject.adzvk.exe
Size 649KB
Sample261018-wpf72asyct
SHA256 d448405a99d2f603d972da77dc923dadd11bd33eda17eadef9bb85ef7b22444a
MD5 d1d28aec3245b646c57fb0543f5f58d2
SHA1 ce77319169d3c910ec5ddd2f5b9b37da7eb60140
SHA512 23f92fb0653b259c8293b941e450246ca9756270df12c54eefe7b9a22a098523a38fcd914955cc533ca5782950d0bcf608f8b645fc027b69cc68a99f7bb464d2
SSDEEP 12288:LxaVAh64U5lp13YLRmNFmzwjk429N6P1v7Yv1O6ubjNREaix4Av714MiinKuz6sZ:LxaVxr5Om7Zk4m0jNxYph4MKuz6wGq
TLSH
T1F3E4010236914B7DE6930E312E661638D3FB6BF6587AD53CA7F3164C262C1D28E116E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan.Win32.Inject.adzvk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

pid	Process
1708	rundll32.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3860	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.adzvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	jaffacakes118_Trojan.Win32.Inject.adzvk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3860	4660	jaffacakes118_Trojan.Win32.Inject.adzvk.exe	84
PID 3860 wrote to memory of 1708	3860	WScript.exe	85

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.adzvk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.adzvk.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\wkmi6XM144\H7lbiB.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" 2lh8.dll a53ifos
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2lh8.dll

Path C:\Users\Admin\wkmi6XM144\2lh8.dll
Size 74KB
SHA256 faa754eaffb3290bf57425a63b74bae96d8dc9f2fb060055ea0940f6a8347902
MD5 b25239c626d04bf7d8dc25712121046f
SHA1 efd2b3164a1f0eed756878811b860dc017f66729
SHA512 82a3d477309055d81a62fa8c124b0184c332bc53311d93738ca57ae2560d1c043f3f1f84cc9ed4e39cce8009ceb37669cf9ca49e8ca87ac9382c766c730eb944
SSDEEP 1536:BsB41dNNeCH7jDqiIkVgwJii5VM7exGzBLvZvzDx:dDNNB7jD8wkiE7exG9vZvzDx
TLSH
T1C3738C3371914F75F0710AF90C4CE2D7B82FBB7E39E0215AA789864A49E9780D819FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

H7lbiB.vbs

Path C:\Users\Admin\wkmi6XM144\H7lbiB.vbs
Size 106B
SHA256 c20cf7059d4a2043e02b33c465d2b0226c52071fa58d8636c94892f74eccd984
MD5 fd37729caa3a5b725306609274fc3246
SHA1 f8621e7cdb6d7a40d4fcd187cb9ea5b83cf1d9d1
SHA512 b9089f4aaf2375e8d9a1dcdf90fb2b5547388be8f55e6d44a88463758682d9ad4dc481bb8af5f105ad90016bf0beba15508bae86360be6c0cc973011f60b8161
TLSH
T167B0124B40084B8181CF47B00840CAF780AB425DBFB1A8B69FC1D0C431F2228730130F
MD5 SHA1 SHA512 TLSH

Submit Download

x

Path C:\Users\Admin\wkmi6XM144\x
Size 1.4MB
SHA256 31445ca162c04449e9c20c3a4541c9f2d2e93f5acbb030679f58f01e45cf6171
MD5 65ca87d1ab932cc2d3b0e30e31fd7505
SHA1 0982000a15d59b64f4915a60c41e7260ff764a2b
SHA512 b9ab4ba963bb704b8ff275c189630d0b571bdfdd7f9a0e97bed5bfbc97b316af5fb60845f7e482857f5a11233cc4c0e3022fa6216f17becc79bd13f6196ea504
SSDEEP 24576:GrTfG0QrTfG0QrTfG0QrTfG0QrTfG0QrTfG0QrTfG0QrTfG0QrTfG0QrTfG0D:GrIrIrIrIrIrIrIrIrIrL
TLSH
T13165F1DB209039CB9330032D54E015FC5AE31CEDB8DE4D0EBA1D355C9ABBA4AA51E9D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1708-14-0x00000000028D0000-0x00000000028E6000-memory.dmp

Download

memory/1708-16-0x00000000028D0000-0x00000000028E6000-memory.dmp

Download

memory/1708-15-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads