995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c

General

Target
jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
Size 27KB
Sample260924-ffrdmsec23
SHA256 995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c
MD5 b034eec8e9bd8c083e44d456f9b57f2f
SHA1 887c2f2e4146938509319bd754d1bf6f91fbda13
SHA512 cf9b567afc6591afa471355ba4c12840d7bf6676042ef02a083a306a1301c220a35f0ee7a12722353faed7c1fadb14967cb20ef8daf71dd08266bc97ed1d8966
SSDEEP 384:pdekFkp+2fJT2r3rPk1eyxJ5odQeeAHzLJcmNQG9CsL0a9EbH:pWc2fJYeeIJxeeATVfQG9H9C
TLSH
T1F7C24A8B3A5699B3D396027034996A2B97FC6FB842A4EC47C7C64E9A74D51C3D039B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\meecoxrx.dll = "{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}"	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe

Loads dropped DLL 1 IoCs

pid	Process
1716	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\meecoxrx.tmp	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
File opened for modification	C:\Windows\SysWOW64\meecoxrx.tmp	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
File opened for modification	C:\Windows\SysWOW64\meecoxrx.nls	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3868	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}\InProcServer32	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}\InProcServer32\ = "C:\\Windows\\SysWow64\\meecoxrx.dll"	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
1716	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
1716	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
1716	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3868	1716	jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_995334e5759a3548bfeb2040c88de481460767146cbb0082b65b5c0e9ee0774c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\B116.tmp.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B116.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\B116.tmp.bat
Size 271B
SHA256 8913b558322877041bb3bdc1e139b97fd75f1e9cf67970bfea00c560c97d0e94
MD5 8f02bd8d3118490d10c95fa04c6b67b1
SHA1 3b133a9c207beb01bc00b3f3e3305c6818efba1d
SHA512 f0565eaf115e7099f5a2ba6044353cfd4e89603db1cdc2018274e5643a5ba215977ab8d0aa5e72cf9fb48fa29bb974524ac1d37076ac8732f4abaaee34f25dd3
TLSH
T18BD02B5163964FD80C08540F00260625C0B00F34DBCC1F057570D0E4217503854EA381
MD5 SHA1 SHA512 TLSH

Submit Download

meecoxrx.tmp

Path C:\Windows\SysWOW64\meecoxrx.tmp
Size 2.3MB
SHA256 ed813aa53baf4824dd192d60b2497cddbcde36232ba8d8ffd2bcaa92594dfb46
MD5 0febdd000735fdf217417d730646534d
SHA1 20450e8a43bb5da941c28fcc21790d409d11228b
SHA512 2da37add6b4ddf89bd3d59a3dac1d44eb2652ac410a5682c0d16457f7bf6105023a92ee03d30740f122ed4307b30b0ab21b42b365f844863e9d710eb7e6aefe0
SSDEEP 49152:aEZVk6y3tQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2H:rZ26y3SWGoqZ92yVG/uzGNVG
TLSH
T1B5B533F4AE2445EEDD7C0436B9D8A6234C4287308953216EBFAA04D27663DC793E5F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-13-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/1716-18-0x0000000010000000-0x0000000010008000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads