c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85

General

Target
jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe
Size 27KB
Sample260924-d4lf7adb39
SHA256 c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85
MD5 6e495a9f0744f81c681aaa4be7a95d8b
SHA1 5ba28ec6ee258395fb68bd84f69414278e18da29
SHA512 df4d753e346f74ecc74e878c6f0a824972e191cbb0f102b53a9a6c6cd02bf9389f0edb7f7e54f978a890dcffdaa5f0d0e631fda393065a8120c051a378f64540
SSDEEP 768:zmEYsKftmN2lHvN2VEcFKKDa/gxWakHLTGA:zo7UQl8VaKDaIgd2
TLSH
T17DC208432D8A84B3D2BCB2704B114F726A7385270B21ADD7579CE6964F339C3D4F5A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery persistence spyware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Apwheel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe"	jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International	jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca00000000020000000000106600000001000020000000cd7cb657bc5d4af077038232c4281c6e641d3f16c57e3dee12e4c2beeeb36b57000000000e80000000020000200000001e67c6ea507bc3adcc462876fd5fc3848ebb33b7d323ad9342b4ea1f2b9b23c92000000035c9b11311753b0976a850786911d3128f85b6386e61539ea7b729d256b8878f40000000f24e88420bc30da68035c1163344c04d56a6ad4c5e213895ce5da34963a9b8b147376977bf8a156424f0383beaea43c0c9af6c0528defa77ab75f1c0e64ea168	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\nguid = "d67af002-5ef4-4c76-9084-4b5cb496799b"	jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5092d71ede4bdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E4E1B133-B7C8-11F1-8F8C-C6B1AE79E33D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3110590789"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca000000000200000000001066000000010000200000002bd50e0ed6246f202bb980e85f98e686c4ca5078eb2a3e05a941f65f67db5f6e000000000e8000000002000020000000e3c61ec58492e84aa58895a15174cc0b757f53740ef0f9c603b263f12b388ca920000000414f73d13c3d6f712f93ceef9334ccd3ea17a4e4dfde5ecc3185c6ea24e862b9400000001c4fc4452ef0dfd923b0257e27265d45bd1db76fcf7202c97f95b7cddf56f0b311e8fa87f182ec3073a74ed8f4b143488348e9dfab684d830f56c40ad3ce5dbe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main	jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280085"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d7d21ede4bdd01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1344	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1344	iexplore.exe
1344	iexplore.exe
3740	IEXPLORE.EXE
3740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3740	1344	iexplore.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
PID:1500

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3740

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c27ab6bffc5be529f59860cc779f5e9ab962e3553b0b5d692455ad4890785a85.exe
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.txt

Path C:\Users\Admin\AppData\Local\Temp\config.txt
Size 584B
SHA256 6c292d4052931edd148f6350627c067b73a93936746535d0162eff2a0864d8ff
MD5 ff24ce6fa6e6b50e811bc62199705cd1
SHA1 4b6c3d95a7a0322f0c3f24c70d30faea6b380b4c
SHA512 aa0ba5e02c2ce153cfa3f6d8695d3683f51f3b2c4c4233f73a1aecd183e18354ce712906a13aa89cc984f2bce49fe1ccc73d0d63dc940f4e1a3cf729bb014ced
TLSH
T14BF0E1BED06A21A72132C683706B3989E72080B5890415397E68F20C6F3A691E7C36CE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads