5946f07c5f2bdbae314098274ef0a4247d4bbbc6f01e6c1a302fcb8bb0440fdd

General

Target
jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe
Size 128KB
Sample260919-rmgcssgc58
SHA256 5946f07c5f2bdbae314098274ef0a4247d4bbbc6f01e6c1a302fcb8bb0440fdd
MD5 9874c19e5564de019520bdfe66b0187e
SHA1 d1f252d881546f8b2b0055387474b12ded033223
SHA512 b838692c97808c5c20faf0b07b1bf1b86da4ab88f3f7b7072aa2d0d12290e8f9c4762293fdbef82aac9bbe8bf4cbd47b64dc7d302235c4ec69aaeda1dbd83ac6
SSDEEP 3072:HO+BeMrTTzbJ7GU7qdwcUBL0WuAhSzb3/E3Towsr+bpmbXbAkld6:HO+BpjzbJGU2U90WuAwb3oU8mbrJd6
TLSH
T18CD3381763444435E57B0136220B7A72D9F8FC3021226843FBDC9AA69E7EDD2D9663E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution persistence spyware trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe

Executes dropped EXE 2 IoCs

pid	Process
4664	bill102.exe
4248	bill102.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysfbtray = "c:\\windows\\bill102.exe"	bill102.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bill102.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bill102.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4224-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/files/0x000b000000019ca4-8.dat	upx
behavioral2/memory/4224-10-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\bill102.exe	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe
File created	C:\Windows\dxxdv34567.bat	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe
File opened for modification	\??\c:\windows\bill102.exe	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bill102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	bill102.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\tp = "1000"	bill102.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4664	4224	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe	89
PID 4224 wrote to memory of 4260	4224	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe	90

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9874c19e5564de019520bdfe66b0187e.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4224
- \??\c:\windows\bill102.exe
  c:\windows\bill102.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\dxxdv34567.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4260

\??\c:\windows\bill102.exe
c:\windows\bill102.exe
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bill102.exe

Path C:\Windows\bill102.exe
Size 128KB
SHA256 5946f07c5f2bdbae314098274ef0a4247d4bbbc6f01e6c1a302fcb8bb0440fdd
MD5 9874c19e5564de019520bdfe66b0187e
SHA1 d1f252d881546f8b2b0055387474b12ded033223
SHA512 b838692c97808c5c20faf0b07b1bf1b86da4ab88f3f7b7072aa2d0d12290e8f9c4762293fdbef82aac9bbe8bf4cbd47b64dc7d302235c4ec69aaeda1dbd83ac6
SSDEEP 3072:HO+BeMrTTzbJ7GU7qdwcUBL0WuAhSzb3/E3Towsr+bpmbXbAkld6:HO+BpjzbJGU2U90WuAwb3oU8mbrJd6
TLSH
T18CD3381763444435E57B0136220B7A72D9F8FC3021226843FBDC9AA69E7EDD2D9663E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxxdv34567.bat

Path C:\Windows\dxxdv34567.bat
Size 279B
SHA256 64246f257b5a1edec96bb5c407e590a1c50bd62a594f7d77fc9daea063341da4
MD5 5d94b47b0e0bf900574765625105f566
SHA1 f64ee16102d85a1f75a45bbed3c678aea266c2f6
SHA512 d1d6263cb93c427ececbc34485991b36ea1ae07d773fc3fe3823a44aa4cf79d78fe158be7365e3f5cea03ef0b2aeb2d843fd6783cd98595ed7fc6dc65b727e21
TLSH
T177D02B18419D85CD4725C83B40B5930E80B7DF246EDD2B5501B0DDCAD21583DB1FB2C5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4224-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4224-10-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads