beb3aec6798a666df7c258b474e2cf47e358d6421d9cf49003f3d8eec45fdc57

General

Target
jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
Size 96KB
Sample260919-mt4pfszthy
SHA256 beb3aec6798a666df7c258b474e2cf47e358d6421d9cf49003f3d8eec45fdc57
MD5 8dd8f5d20365741da6cc0739dd6e63f6
SHA1 70bd7b64f0ae630c7c162cf9c44bb44a74848994
SHA512 eb44b700d14e4674a6dd42868469eb39c3617399e38252ed4146d26538969afbd8b20c247097cced927d3de111e22218f283d7353fdd221e418904489163e8cc
SSDEEP 1536:bujPJ1Hegc7hoqH41yBJzjeZf53dPlmiBfW:yPJ1HegmyyTzjeZf53d9miRW
TLSH
T1A6A31313F135D646FAED40B12A78A0AC2C9A7D3212658D1FB389370B317495BF7A1B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1792	winrun.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windir = "C:\\winnt\\winrun.exe"	winrun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysdir = "C:\\winnt\\winrun.exe"	winrun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winrun = "C:\\windows\\winrun.exe"	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winur = "C:\\winnt\\winrun.exe"	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windir = "C:\\winnt\\winrun.exe"	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysdir = "C:\\winnt\\winrun.exe"	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winrun = "C:\\windows\\winrun.exe"	winrun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winur = "C:\\winnt\\winrun.exe"	winrun.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Abyss Web Server\abyss.conf	winrun.exe
File created	C:\Program Files\MyWebServer\Setup\JVM4506.exe	winrun.exe
File created	C:\program files\winmx\library.dat	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File created	C:\Program Files\Abyss Web Server\abyss.conf	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File created	C:\Program Files\Abyss Web Server\Setup\index.html	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File created	C:\Program Files\MyWebServer\Setup\JVM4506.exe	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File created	C:\Program Files\MyWebServer\mywebserver.ini	winrun.exe
File created	C:\Program Files\Abyss Web Server\Setup\index.html	winrun.exe
File created	C:\Program Files\Abyss Web Server\Setup\JVM4506.exe	winrun.exe
File created	C:\Program Files\MyWebServer\Setup\index.html	winrun.exe
File created	C:\Program Files\MyWebServer\mywebserver.ini	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File created	C:\Program Files\Abyss Web Server\Setup\JVM4506.exe	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File created	C:\Program Files\MyWebServer\Setup\index.html	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File created	C:\program files\winmx\library.dat	winrun.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\windows\winrun.exe	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File opened for modification	C:\windows\winrun.exe	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
File opened for modification	C:\windows\winrun.exe	winrun.exe
File created	C:\windows\winrun.exe	winrun.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrun.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2400	jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
1792	winrun.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8dd8f5d20365741da6cc0739dd6e63f6.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2400

C:\windows\winrun.exe
C:\windows\winrun.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Red alert 2 crack.exe

Path C:\sharedDocs\Red alert 2 crack.exe
Size 96KB
SHA256 beb3aec6798a666df7c258b474e2cf47e358d6421d9cf49003f3d8eec45fdc57
MD5 8dd8f5d20365741da6cc0739dd6e63f6
SHA1 70bd7b64f0ae630c7c162cf9c44bb44a74848994
SHA512 eb44b700d14e4674a6dd42868469eb39c3617399e38252ed4146d26538969afbd8b20c247097cced927d3de111e22218f283d7353fdd221e418904489163e8cc
SSDEEP 1536:bujPJ1Hegc7hoqH41yBJzjeZf53dPlmiBfW:yPJ1HegmyyTzjeZf53d9miRW
TLSH
T1A6A31313F135D646FAED40B12A78A0AC2C9A7D3212658D1FB389370B317495BF7A1B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads