7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2

General

Target
jaffacakes118_7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2.exe
Size 6KB
Sample260924-kkdess1fmc
SHA256 7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2
MD5 1acaed496aca5497b1f7f7378a156946
SHA1 956419f5e732f5f93f6f763ae3e6d252b9343465
SHA512 d43a9009f93ef40b9de945eb8be7f48e46f329ea6fba19294bdf8b2e4ca91dc20d2b36dba55cdb014d28ccd28789d27c1c1f6d322cea046b2df27ab0c592d828
SSDEEP 96:ZVYdPZ5f93M7XbqX0j89J/XOJCFrOiFZWyPcejQkg63eRVMO:YPDoOEIHf1FKifPc4QW38mO
TLSH
T1BBD12AF3A66965B0D241353A0AC7D61B9DBCE16327AFCF4149982477284F280E238F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundll32.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000001b846-3.dat	acprotect
behavioral2/memory/1120-9-0x0000000010000000-0x0000000010008000-memory.dmp	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1120	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cpan.dll	jaffacakes118_7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000001b846-3.dat	upx
behavioral2/memory/1120-9-0x0000000010000000-0x0000000010008000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hh.htt	rundll32.exe
File created	C:\Windows\hh.htt	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Styles\User Stylesheet = "C:\\Windows\\hh.htt"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Styles\Use My Stylesheet = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://aifind.info/"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://aifind.info/"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\SearchURL = "http://aifind.info/"	rundll32.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://aifind.info/"	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1120	756	jaffacakes118_7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7314bc83b816f1747621419847d85d1a896d5a41f599f0a7dfc63a38321261a2.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe cpan,Restore
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Privilege Escalation

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cpan.DLL

Path C:\Windows\SysWOW64\cpan.DLL
Size 5KB
SHA256 fa34c779390523b284b96f86bdc34b31b9ddfa57aa7bfeac3604508e839cfaf7
MD5 a9e1f52bd3d65ce3f1e33b5939eed690
SHA1 591cb3abc89c731d96e00264d44b83b601e8aa3a
SHA512 bb3cf370123624674882b5dca624037de7cab6ab28723c7a2e2c24291c997aaa48ad710b3aaab6c7b8bc7f7f19c064f96c212a55c8a3780950d994342c622914
SSDEEP 96:EPZ5f93M7XbqX0j89J/XOJCFrOiFZWyPcejQkg63eRVM:EPDoOEIHf1FKifPc4QW38m
TLSH
T15FB14CD3BA797670D291353F0B87D61998BCE15057BF8A81495C3473288F2C1A239F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 56B
SHA256 9114c1e7eef9951099269fee069bdf181e8965b32110f962f98e09738168f246
MD5 720a44e6261a566723b5ae1b7b21322a
SHA1 e16c023c6ebb8c4827b356d89ad80da47a9880ec
SHA512 877f37df8a84be6cdd571848d517bcb4d47ee30e2900e0764c4beb46dc6cdca603909e01ad9f1dae39124e7f9ecb124199a30eb2b9cfe2f0cd8daf53bf284a4a
TLSH
T1C49002E1081184C145A5155085215410F07288445254FC83423A7941855192C7036075
MD5 SHA1 SHA512 TLSH

Submit Download

hh.htt

Path C:\Windows\hh.htt
Size 486B
SHA256 e9a35ef3cedd43a2098a34b21be0068e0c63e64d25ce11d8050e6e3e3f4bf8ea
MD5 dfc51ebe89410270fa0ea12fd48fa830
SHA1 c177bf979d92c95183674772d8e6db631e15746b
SHA512 d38f7a719fa33f2be1c20f42b06bfe0bd700618960c901405e1273f18c7c62bde9cb1eacf5fcca3543987c6fdf797fbd3e1c39594b8c35cc6b97a9aa73996f3f
TLSH
T138F0D46175C0143568E5D76BD5F0CA577221B082D3315D12F41C552151E8F076D7F9CC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-0-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/756-2-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/1120-9-0x0000000010000000-0x0000000010008000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads