c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198

General

Target

c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
Size

45KB
MD5

3e70d9a82e68af43f27dbde3a7492490
SHA1

4e46ebea70e6fbecdba8d274daeb43f9b9bdf9f3
SHA256

c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198
SHA512

5e0aed6c743535aba1470149da064f9a9cd18d57202479cc552181687969fd2949a438f74358a0ac63c053ef7fdb6c38040660cfbd078f73ac6ac07e89e9c1b6
SSDEEP

768:XZwb9TV5ZDzu83AqN1LZNneGcRnks/iaeS9rmJIga9/U/1H5:XZwb9TvZ3wqnL67RnkMVmeq

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe

Executes dropped EXE 1 IoCs

Processes:

Jmffdkpn.exe

pid process

848 Jmffdkpn.exe

pid	process
848	Jmffdkpn.exe

Drops file in System32 directory 3 IoCs

Processes:

c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Jmffdkpn.exe	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
File opened for modification	C:\Windows\SysWOW64\Jmffdkpn.exe	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
File created	C:\Windows\SysWOW64\Cdghjo32.dll	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

Jmffdkpn.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess	Jmffdkpn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes"	Jmffdkpn.exe

Modifies registry class 6 IoCs

Processes:

c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdghjo32.dll"	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Jmffdkpn.exe

pid process

848 Jmffdkpn.exe

pid	process
848	Jmffdkpn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe

description	pid	process	target process
PID 4572 wrote to memory of 848	4572	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe	Jmffdkpn.exe
PID 4572 wrote to memory of 848	4572	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe	Jmffdkpn.exe
PID 4572 wrote to memory of 848	4572	c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe	Jmffdkpn.exe

C:\Users\Admin\AppData\Local\Temp\c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe
"C:\Users\Admin\AppData\Local\Temp\c8a7af2d91f1b22cc8bc59070e246f6d7bd1a91a45d9729db3a373fb6ce4b198.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\Jmffdkpn.exe
C:\Windows\system32\Jmffdkpn.exe
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jmffdkpn.exe
Filesize
45KB

MD5
c1b5f7661ad35321d8f8be513b1b3dcc

SHA1
35d9d5851de567c91230006357cd50accfa4c04c

SHA256
8579e0612baac09786321770f5c8b850f7207380a27cfc5847e63be5f82826bd

SHA512
75ba32cbb61deb9e07c7404d7be6cc0c48bc14799a22377307b0c52caee7837580507b96c30df8a43ab5a38f156348bb08bb4cabcaca95f3e2b67cdd92a912b4

Download Submit
C:\Windows\SysWOW64\Jmffdkpn.exe
Filesize
45KB

MD5
c1b5f7661ad35321d8f8be513b1b3dcc

SHA1
35d9d5851de567c91230006357cd50accfa4c04c

SHA256
8579e0612baac09786321770f5c8b850f7207380a27cfc5847e63be5f82826bd

SHA512
75ba32cbb61deb9e07c7404d7be6cc0c48bc14799a22377307b0c52caee7837580507b96c30df8a43ab5a38f156348bb08bb4cabcaca95f3e2b67cdd92a912b4

Download Submit
memory/848-133-0x0000000000000000-mapping.dmp

Download
memory/848-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/848-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4572-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4572-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads