415f677eb852a0787634f3b30cba0214343407eb4685c5376f4ec687599d55df

General

Target
jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Size 7KB
Sample260919-tekrcsdm61
SHA256 415f677eb852a0787634f3b30cba0214343407eb4685c5376f4ec687599d55df
MD5 9d7ef7558c47de6d2d3e5ac1ba1d79db
SHA1 0d88535859b4a9b21a532bd438a3cc27cf1f8d82
SHA512 1898f17fbf147303a8ddfa2c55ee87c1fbba820f0ca77f93a349c755db29797ab0851a05a86d742a8fcb57ac24dda2e7979d4db87d4ff255936ce75ee463a341
SSDEEP 192:xyfPBSyFnTQflbSFiY7j3B+xzTvD8TPLddiCib1jw:x2JQflOR7j3B+lTvYjLzi
TLSH
T135E19E88C351B4F4F829007F1652A14673F5E3E9D16E9E1E8BC0A940ECD485676C7CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0BC9BC01-54D4-4CCE-2B7D-955164314CD4} = "OLE Module"	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 1 IoCs

pid	Process
5000	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\trf32.dll	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
File created	C:\Windows\SysWOW64\mscnf.dll	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Videos = "no"	rundll32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\WOW6432Node\CLSID\{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}\InProcServer32	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\WOW6432Node	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\WOW6432Node\CLSID	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\WOW6432Node\CLSID\{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\WOW6432Node\CLSID\{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}\InProcServer32\ = "C:\\Windows\\SysWow64\\trf32.dll"	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\WOW6432Node\CLSID\{0BC9BC01-54D4-4CCE-2B7D-955164314CD4}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5000	rundll32.exe
5000	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 5000	1584	jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9d7ef7558c47de6d2d3e5ac1ba1d79db.exe"
1⤵
- Modifies Shared Task Scheduler registry keys
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\trf32.dll, load
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mscnf.dll

Path C:\Windows\SysWOW64\mscnf.dll
Size 39B
SHA256 37e61f09e5784a13a546d350553f1659fea65d8ffb8ddf061b865eb517aefd40
MD5 51529d6fbad0d8d72abe28b26a406fc3
SHA1 ee9eb84e98e9f4e3f7bdef87e1ba4f5dd0ca20d2
SHA512 a03b158d67560d35adf4f7b2e6e402b2159608c2643ecdeaa2a50821ce34c812b5959933c28eb6a52648488a2fe6de7235a7f3b2557930464bfbed994ab4c342
MD5 SHA1 SHA512

Submit Download

trf32.dll

Path C:\Windows\SysWOW64\trf32.dll
Size 10KB
SHA256 ee2aba9ecc6195dafe18f92a6d4df7c60ff87364c0f74793600693da1c72b163
MD5 d1a07646512f205dbe004571684b744f
SHA1 49c93a5084b5993bc814f01c969e4365b35d6515
SHA512 a163f4561eb25046d795a4ac780575ba0b01b65515072dc295f526de6dc6dc9d96aa63d982f586d22185e7191fabd03f84e109078ec22f75d3e5b7bea7103058
SSDEEP 192:bJA36EQP8tb54Q+MbWeD4H61jhxjzlEozB/c+xt3:bA6EQktaOS44avEQBF
TLSH
T15622090776DAE033D6671073B566AB62A7AD9A60A1C02D039F134E4E5F5B3429E3C70E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1584-5-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads