36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a

General

Target
jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
Size 24KB
Sample260924-eel7vsydla
SHA256 36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a
MD5 f73a0e690dfeaaccfd958e54df41e3e9
SHA1 20cde23d5f53b8a46065f8119a1b23d2c3883aeb
SHA512 5740b29fd6b132988a82116f8bcb46b2285a3df3557d6f6fc29d3eabbbe796798cc24d10cf5fbd4e667c0cc7d57fc3ce3995159873fc169d4b882b5b7586f340
SSDEEP 384:DHirf5k0j2w3zELmWfftS4/BRctnhlJoR48fRMrz:zirxkQzAtgE+tHJb8Y
TLSH
T12FB23A5B3EE58732E812C13158794D39DBBBA8772C6911EBEF040E0E293F191182669B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4764	bfxtray.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syswin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe"	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syswin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe"	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bfxtray.exe	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
File created	C:\Windows\SysWOW64\bfxtray.exe	bfxtray.exe
File created	C:\Windows\SysWOW64\bfxtray.exe	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfxtray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A517B54-B7CB-11F1-978D-E657AC6DA687} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6132	iexplore.exe
6132	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
6132	iexplore.exe
6132	iexplore.exe
4308	IEXPLORE.EXE
4308	IEXPLORE.EXE
6132	iexplore.exe
6132	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4764	4400	jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe	91
PID 6132 wrote to memory of 4308	6132	iexplore.exe	94
PID 6132 wrote to memory of 2932	6132	iexplore.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\bfxtray.exe
  C:\Windows\system32\bfxtray.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4764

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5432

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5428

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6132 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6132 CREDAT:82948 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bfxtray.exe

Path C:\Windows\SysWOW64\bfxtray.exe
Size 24KB
SHA256 36e280808148ef0921ffc279fe49521b1a00908cf040d8a3f1ecfeed275b4c6a
MD5 f73a0e690dfeaaccfd958e54df41e3e9
SHA1 20cde23d5f53b8a46065f8119a1b23d2c3883aeb
SHA512 5740b29fd6b132988a82116f8bcb46b2285a3df3557d6f6fc29d3eabbbe796798cc24d10cf5fbd4e667c0cc7d57fc3ce3995159873fc169d4b882b5b7586f340
SSDEEP 384:DHirf5k0j2w3zELmWfftS4/BRctnhlJoR48fRMrz:zirxkQzAtgE+tHJb8Y
TLSH
T12FB23A5B3EE58732E812C13158794D39DBBBA8772C6911EBEF040E0E293F191182669B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads