cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25

General

Target
cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe
Size 3.7MB
Sample260804-y59kmaxwct
SHA256 cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25
MD5 f368c7a0a929bb918b7347f4fdff96fc
SHA1 45ccca9ef803a9b3feab6a54504b5775efb8c30d
SHA512 42214a4b6af417e0cade0b4dd92961baa2d84784a54ece3c200e7e363706fe505025af294ee4e1dd34f524d5ea4a1424605f80bbf4c5867ba0b4774c35e8d86e
SSDEEP 98304:WCrPAEqG/Og3fI+skr7vFKgDWcz8raf2CVIUcoyRhn3:JrPAExGgTskrUgDRzwauCT+Rhn
TLSH
T1BA060222728EBCB1D4751170637B8BEA876DEE700B52E5CF53C40AA5897C4C27E31BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
defense_evasion

Software Discovery
T1518
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
1316	PackageApp.exe
612	PackageApp.exe
4796	asv.exe
5272	asv.exe
864	kws.exe
3352	XAS.exe
3732	xhelper.exe
1064	kws.exe

Loads dropped DLL 3 IoCs

pid	Process
3588	regsvr32.exe
3804	regsvr32.exe
3352	XAS.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XAS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xhelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ XContextMenu\ = "{7086CF95-1215-470E-8032-AA1B540FB5F6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ XContextMenu	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\ XContextMenu\ = "{7086CF95-1215-470E-8032-AA1B540FB5F6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\ = " XContextMenu Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\jwclie\\XShell64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ XContextMenu	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1620	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe
1620	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe
3352	XAS.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3588	1620	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe	89
PID 3588 wrote to memory of 3804	3588	regsvr32.exe	90
PID 1620 wrote to memory of 1316	1620	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe	92
PID 1620 wrote to memory of 612	1620	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe	93
PID 1620 wrote to memory of 4796	1620	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe	94
PID 1620 wrote to memory of 3352	1620	cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe	98
PID 5272 wrote to memory of 3732	5272	asv.exe	102
PID 5272 wrote to memory of 1064	5272	asv.exe	103

C:\Users\Admin\AppData\Local\Temp\cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe
"C:\Users\Admin\AppData\Local\Temp\cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Roaming\jwclie\XShell64.dll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\system32\regsvr32.exe
    /s C:\Users\Admin\AppData\Roaming\jwclie\XShell64.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:3804
- C:\Users\Admin\AppData\Roaming\jwclie\PackageApp.exe
  "C:\Users\Admin\AppData\Roaming\jwclie\PackageApp.exe" install "C:\Users\Admin\AppData\Roaming\jwclie\xpopext1.msix"
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Users\Admin\AppData\Roaming\jwclie\PackageApp.exe
  "C:\Users\Admin\AppData\Roaming\jwclie\PackageApp.exe" install "C:\Users\Admin\AppData\Roaming\jwclie\xpopext2.msix"
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Users\Admin\AppData\Roaming\jwclie\asv.exe
  C:\Users\Admin\AppData\Roaming\jwclie\asv.exe -i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4796
- C:\Users\Admin\AppData\Roaming\jwclie\XAS.exe
  "C:\Users\Admin\AppData\Roaming\jwclie\XAS.exe" /inst
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3352

C:\Users\Admin\AppData\Roaming\jwclie\asv.exe
C:\Users\Admin\AppData\Roaming\jwclie\asv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Users\Admin\AppData\Roaming\jwclie\xhelper.exe
  C:\Users\Admin\AppData\Roaming\jwclie\xhelper.exe /serverReport=true
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3732
- C:\Users\Admin\AppData\Roaming\jwclie\kws.exe
  C:\Users\Admin\AppData\Roaming\jwclie\kws.exe /servercall=true
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1064

C:\Users\Admin\AppData\Roaming\jwclie\kws.exe
"C:\Users\Admin\AppData\Roaming\jwclie\kws.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Software Discovery

1

T1518

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PackageApp.exe

Path C:\Users\Admin\AppData\Roaming\jwclie\PackageApp.exe
Size 291KB
SHA256 c5656866e86044ea93f00e5d69613ab3349b1ed4278b029eed718e4669431ccd
MD5 b1a3f87ee46145b5a7c89b52d7048412
SHA1 65eb639b4e20390706097422e21bc048d8d05c25
SHA512 852c103bc51a8efb6b6a64710acd62b9389b4b08a3a74d16440d11d66a689371dee4b7c4c1e9fdd5a0f368f1dcc8936b63d01ce4e0b2be230ce63262edf2bdaa
SSDEEP 3072:BPeJGZIqbcYep5REsSiQAT1rz+25SWbjHsDkf2WjgbgCscw:1lZIq1m5REve1vjHsDSlc
TLSH
T15654C203A6EC3CEAD13A8274A77747C0EB2EEC5147A0C58F56D006A5DD3E6937A267D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAS.exe

Path C:\Users\Admin\AppData\Roaming\jwclie\XAS.exe
Size 102KB
SHA256 190373093ef8dd3f1a9e73e2b1acc31d6d399106054f114412cd6ffa4b913dfb
MD5 340695dc2e00ff3e1eb241fc3b4262c4
SHA1 ec37d48678a2187ec5090418f3dc043cef40d97a
SHA512 14f77afe9ab7bfc3b863355936e55130ba16b286d25375cd5366129a4af691f1ff500347976692a21f7916d43b94574b19c1823a7c06f627aaec91c7ea361f55
SSDEEP 3072:XZKCdLcCLkGrYIz85ZvkVH5vvDk3H2RyB7IA5DZw:XjotGcxilVi7IA5DZ
TLSH
T1B4A38E0275D1C431EA72197568B4E9709E3EF9501FA19DEB338812A94F343C1AE35EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPlugin.dll

Path C:\Users\Admin\AppData\Roaming\jwclie\XPlugin.dll
Size 3.0MB
SHA256 57d0d46a74cf4832caeadd5b5caa0fa2c87e44fc31ee73640cb3cadd30238fde
MD5 5f149e376afe06e01b0724e042d0bd69
SHA1 72ee673ad2d8a55dc03c4916743e600be0cd9848
SHA512 37dd2235f87b1d308c400cd7fdf56fc26d024ca19ab0773adeed3df9730e67495638bbcbab8668c9ef1e59f3eca50738f23259b4d1945c8aca59c57d7cd54f1b
SSDEEP 49152:/aYpFmHhMDUksdW7rB4uKgT2D2b3rc4EaPVJrWzU0xto:CYpcHyUW7rB4jgKDSrOY
TLSH
T1BBE5AF227A828177D89E4171967ECBBE453D5F600B3AC9C387D03AAA5D708C23736F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XShell64.dll

Path C:\Users\Admin\AppData\Roaming\jwclie\XShell64.dll
Size 352KB
SHA256 c445e05c376d4aee39a49e7583c0f966c172aa76880df89a9040f3c33ae240b9
MD5 d8afddf9b5f103de14a113c45e53a471
SHA1 7ef900f113eb667e96a279fb1461417a104ea26c
SHA512 59f2ebe6429e58b4150aaa10859a6f1e031b43e81ab5a5d9c5c0edfbae64d7f37b6a70c63606dc5680206b31fdb571c7adce2f3d4f727039cc017d30800f15a5
SSDEEP 6144:Ld7UUp88cEe7alRQKgdRe1IqmotDcifrUpwFXqcj:Ld7UgVe7DKgd0KBKcifrUId
TLSH
T1AE746A9B72A50EBAF877813A86534508E7F3B8564321DBCB0720466E0F27BD09D7AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asv.exe

Path C:\Users\Admin\AppData\Roaming\jwclie\asv.exe
Size 303KB
SHA256 a31e4ff8bfe5654ea383c3f708467b49eb3bc811818005d24c95a259d597f634
MD5 1ad7ffbd9805fb06ea24285135fbcc0f
SHA1 9c451755df8e9a95ec0bb538f203913ba9a5b99c
SHA512 39f864b23c8417f7714a33a87e582dca8b9f71e28f636a7404f9ff86e381682892e25f23d95a6b2eee809b48ee057f2433ea0e8faf5463418d32bbf108d071d1
SSDEEP 6144:ZBKBI5ftK2kSHna7IB5Ct+oKruRlTZG5qkxH:PKBSK2bHjjuRldU5
TLSH
T10A648E10BA418033D97704724A79DB7A8A7DBE700F6169CBA3D41EBAC9606C19B34F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kws.exe

Path C:\Users\Admin\AppData\Roaming\jwclie\kws.exe
Size 244KB
SHA256 9ad5b4adb64269b1f8a946020765bb084824491b1edf95e8de2b0bafae081c2e
MD5 0fab5f986e5b03f2b12dfc4d8c693885
SHA1 936ce71a3ea1c60eb74b669e6c5191af6e63dd4c
SHA512 e151c3074b6e83aa9267aa4eda917fe5ffe1e718100b842fb0bca85d92fa397988f1c278a8198ac747a280865ef28b17177f8fe934ac9d0eddd6834b399fd8cf
SSDEEP 6144:2QaE+OZ6BylyJnWc/VuHest5vMFfcaR6CSr:Za/hyQJWc2vMVsr
TLSH
T146349E11B991C036DA2708368DF8DFB9993DB9704F61A9C763C41FEBCA605C15B34B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xhelper.exe

Path C:\Users\Admin\AppData\Roaming\jwclie\xhelper.exe
Size 743KB
SHA256 6eded9f08b1f07f5df94d6e35b3c43d0b787351bb40d812d60e3ea590b6cf51a
MD5 510fe0d716e6b79559fc29cf31892e97
SHA1 3d3956bae564dce5748ba0554d5df19f6e0031aa
SHA512 c33e1ddb9fab1974b72d45af96d61ed035fe1ecf699eeffcdd5644fb41bfa82bc7269abce5464d3ac2522404d9ede052af520ade28707ff404546148d8e5a009
SSDEEP 12288:wzxwotIOFSZyuHgVCJmL88mCo3ygLd9dKr90TseVk+SIIRn:w+otIOFgAVN8JCAhdOyT3/IRn
TLSH
T17DF43A227589BCB6C5710170677FCBEA932DFA710B62D4CF52C40AA9897C4D33A31BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3804-185-0x00007FFBACD20000-0x00007FFBACD30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads