e474bff6c9c8966ae945a2ae492869cdff8647c79b26891c36967eeffe7c9e18

General

Target
jaffacakes118__8e9a02c34f4111297ff6303f13fa2b69.exe
Size 13KB
Sample260919-m429daed78
SHA256 e474bff6c9c8966ae945a2ae492869cdff8647c79b26891c36967eeffe7c9e18
MD5 8e9a02c34f4111297ff6303f13fa2b69
SHA1 2404eabcd6fe230cebfac56691635fbb78cf3fcf
SHA512 e359598734d14f0c03674b913eefef6d972ce9eb36580db89cb764aa645a3a29f721b3f1354978acdb108f591dbf4adf34e6c2a2bb52fc012bf3afd879d07a68
SSDEEP 192:4cYYBvDgPtrnb19aVL3b/PlbJZDs8Hd9EXqq0liMuLEprXJfuS/XFBRcPF:FYeMVrbLchbJZ1Hd9EqllSEr5lBcF
TLSH
T19D52BF20A0FC14A5D3C1D1B30706D4226F8BE5DC4B870B2259CCF29F8ECF0A695792E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence ransomware spyware upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2688	windhost.exe
3240	windhost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windhost.exe = "C:\\Windows\\windhost.exe"	windhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windhost.exe = "C:\\Windows\\windhost.exe"	windhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windhost.exe = "C:\\Windows\\windhost.exe"	jaffacakes118__8e9a02c34f4111297ff6303f13fa2b69.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3496-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/files/0x000f00000001c509-2.dat	upx
behavioral2/memory/3496-4-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2688-5-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2688-21-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3240-24-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\windhost.exe	jaffacakes118__8e9a02c34f4111297ff6303f13fa2b69.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__8e9a02c34f4111297ff6303f13fa2b69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windhost.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C88D0B3-B419-11F1-B703-D24DA2D396E5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 844f320a9242dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "ucycyh2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4039f2b12e48dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc6a6985d1531f4aba3916282e1d41a400000000020000000000106600000001000020000000a0bbbb0493cb6f3461d267ce33d8af4ec62f59976067acf472700dc4b14f5d03000000000e800000000200002000000081c49c6054ee74d13592da428e7980320b9b7c8c063631ce900a9308203b2b0e200000007b33e378f55550d692102d253393a44e5cf40e9a48a16ebf149ec3e0c3f863b1400000001be036f8bad652c3057a58866f3b8c344e792313497e293dbf6d52c0be2d23c66b357d1782d6a17fd4e523e1b2d2d6ec00961c0de2faf376baa8f5026d847afc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4100	iexplore.exe
4100	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4100	iexplore.exe
4100	iexplore.exe
5852	IEXPLORE.EXE
5852	IEXPLORE.EXE
4100	iexplore.exe
4100	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2688	3496	jaffacakes118__8e9a02c34f4111297ff6303f13fa2b69.exe	89
PID 4100 wrote to memory of 5852	4100	iexplore.exe	94
PID 4100 wrote to memory of 3064	4100	iexplore.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e9a02c34f4111297ff6303f13fa2b69.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e9a02c34f4111297ff6303f13fa2b69.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\windhost.exe
  "C:\Windows\windhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2688

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5200

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4100 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4100 CREDAT:82948 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

C:\Windows\windhost.exe
C:\Windows\windhost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windhost.exe

Path C:\Windows\windhost.exe
Size 13KB
SHA256 e474bff6c9c8966ae945a2ae492869cdff8647c79b26891c36967eeffe7c9e18
MD5 8e9a02c34f4111297ff6303f13fa2b69
SHA1 2404eabcd6fe230cebfac56691635fbb78cf3fcf
SHA512 e359598734d14f0c03674b913eefef6d972ce9eb36580db89cb764aa645a3a29f721b3f1354978acdb108f591dbf4adf34e6c2a2bb52fc012bf3afd879d07a68
SSDEEP 192:4cYYBvDgPtrnb19aVL3b/PlbJZDs8Hd9EXqq0liMuLEprXJfuS/XFBRcPF:FYeMVrbLchbJZ1Hd9EqllSEr5lBcF
TLSH
T19D52BF20A0FC14A5D3C1D1B30706D4226F8BE5DC4B870B2259CCF29F8ECF0A695792E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2688-5-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2688-21-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3240-24-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3496-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3496-1-0x0000000000416000-0x0000000000417000-memory.dmp

Download

memory/3496-4-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads