27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c

General

Target
jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Size 39KB
Sample260924-cpb4jaxycs
SHA256 27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c
MD5 f223999aa3951fcb58ae175aa299a0ff
SHA1 37319eac4849a33c77a3f08e5366e0528bad7c34
SHA512 afab86ba534f3b39355c273055f622747df3cc58328e11686e5f040f455224aeee49ab1b262db9574bf0abc87576f9226fc9d04c864fdfe8baf4c2d02f90a50c
SSDEEP 768:9U6LbqpSSoyoZLo1a0mboJmJfiINNmESxtAD:9UoqpALo1vmUYfVLm3AD
TLSH
T183038D9715800AE1F67B663E154D6B3E40B5163113C130FAAD72EBCA65F4EB7A30E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\default32.dll	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
File created	C:\Windows\default32.dll	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\PROTOCOLS\Filter\text/html	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\PROTOCOLS	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\PROTOCOLS\Filter	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\PROTOCOLS\Filter\text/html\ = "Microsoft Default HTML MIME Filter"	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node\CLSID\{235ba5af-79d5-4d35-903f-4ebddaff8c60}\InProcServer32	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node\CLSID	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node\CLSID\{235ba5af-79d5-4d35-903f-4ebddaff8c60}	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\PROTOCOLS\Filter\text/html\CLSID = "{235ba5af-79d5-4d35-903f-4ebddaff8c60}"	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node\CLSID\{235ba5af-79d5-4d35-903f-4ebddaff8c60}\InProcServer32\ = "C:\\Windows\\default32.dll"	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node\CLSID\{235ba5af-79d5-4d35-903f-4ebddaff8c60}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3488	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3040	3488	jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_27651510307f108f4383329391464b08ceb96b2872b4eb19938ccefa915d438c.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3040