36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a

General

Target
jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
Size 24KB
Sample260924-eel7vsydla
SHA256 36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a
MD5 f73a0e690dfeaaccfd958e54df41e3e9
SHA1 20cde23d5f53b8a46065f8119a1b23d2c3883aeb
SHA512 5740b29fd6b132988a82116f8bcb46b2285a3df3557d6f6fc29d3eabbbe796798cc24d10cf5fbd4e667c0cc7d57fc3ce3995159873fc169d4b882b5b7586f340
SSDEEP 384:DHirf5k0j2w3zELmWfftS4/BRctnhlJoR48fRMrz:zirxkQzAtgE+tHJb8Y
TLSH
T12FB23A5B3EE58732E812C13158794D39DBBBA8772C6911EBEF040E0E293F191182669B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4168	bfxtray.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syswin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe"	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syswin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe"	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bfxtray.exe	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
File created	C:\Windows\SysWOW64\bfxtray.exe	bfxtray.exe
File created	C:\Windows\SysWOW64\bfxtray.exe	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
File created	C:\Windows\SysWOW64\bfxtray.exe	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfxtray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{38DB8280-B7CB-11F1-8F8C-768FA1516246} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3112	iexplore.exe
3112	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3112	iexplore.exe
3112	iexplore.exe
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
3112	iexplore.exe
3112	iexplore.exe
732	IEXPLORE.EXE
732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4168	4160	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe	99
PID 3112 wrote to memory of 1156	3112	iexplore.exe	102
PID 3112 wrote to memory of 732	3112	iexplore.exe	103

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\bfxtray.exe
  C:\Windows\system32\bfxtray.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4168

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4928

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1400

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3112 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3112 CREDAT:17414 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bfxtray.exe

Path C:\Windows\SysWOW64\bfxtray.exe
Size 24KB
SHA256 36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a
MD5 f73a0e690dfeaaccfd958e54df41e3e9
SHA1 20cde23d5f53b8a46065f8119a1b23d2c3883aeb
SHA512 5740b29fd6b132988a82116f8bcb46b2285a3df3557d6f6fc29d3eabbbe796798cc24d10cf5fbd4e667c0cc7d57fc3ce3995159873fc169d4b882b5b7586f340
SSDEEP 384:DHirf5k0j2w3zELmWfftS4/BRctnhlJoR48fRMrz:zirxkQzAtgE+tHJb8Y
TLSH
T12FB23A5B3EE58732E812C13158794D39DBBBA8772C6911EBEF040E0E293F191182669B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads