2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75

General

Target
jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Size 132KB
Sample260925-vstrvss18r
SHA256 2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75
MD5 0a9fac073827b5ad78d6ed95dc237858
SHA1 dc0ebc0225a34747bf00636d2881d6877d78605a
SHA512 43d5b1a659c6661b72ae48dfe181625b9ce8d9ad2722ebef9be6f4dea9160ab970f3f5cd3b0ab94db09ee957b8ce17862571861b7902685d04d0e5d11b17f621
SSDEEP 3072:6myWGkEJYTmdF9Hu2tV1jddoDj/VxHOA1J2y2n:6rSmf9Htr
TLSH
T1A0D38E07F4F28532C591317B28CBCB3DA77EE45C2245D382BB68AC9264A5634777C6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4256	runxhpi32.exe
2740	Common Files32.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runxhpi32.exe \"%1\" %*"	runxhpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runxhpi32.exe \"%1\" %*"	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LoadProfile = "runxhpi32.exe powprof.dll,LoadCurrentUserProfile"	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Common Files = "\"C:\\Program Files (x86)\\Common Files\\Common Files32.exe\""	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dxxhpi16.dll	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Windows\SysWOW64\runxhpi32.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Windows\SysWOW64\1252085032.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Windows\SysWOW64\1252085032.exe.tmp	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\1252085032.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\dxxhpi16.dll	runxhpi32.exe
File opened for modification	C:\Windows\SysWOW64\runxhpi32.exe	Common Files32.exe
File opened for modification	C:\Windows\SysWOW64\xhpia.cfg	Common Files32.exe
File opened for modification	C:\Windows\SysWOW64\xhpia.cfg	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\runxhpi32.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Windows\SysWOW64\runxhpi32.exe.tmp	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\runxhpi32.exe	runxhpi32.exe
File opened for modification	C:\Windows\SysWOW64\xhpia.cfg	runxhpi32.exe
File opened for modification	C:\Windows\SysWOW64\dxxhpi16.dll	Common Files32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Common Files32.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Program Files (x86)\Common Files\Common Files32.exe.tmp	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Program Files (x86)\Common Files\Common Files32.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Win.ini	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\Win.ini	runxhpi32.exe
File opened for modification	C:\Windows\Win.ini	Common Files32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runxhpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Common Files32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runxhpi32.exe \"%1\" %*"	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runxhpi32.exe \"%1\" %*"	runxhpi32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4256	5036	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\runxhpi32.exe
  C:\Windows\system32\runxhpi32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4256

C:\Program Files (x86)\Common Files\Common Files32.exe
"C:\Program Files (x86)\Common Files\Common Files32.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxxhpi16.dll

Path C:\Windows\SysWOW64\dxxhpi16.dll
Size 302B
SHA256 9b6165c7a40413ddde33babae826adfb40db6dfe11894ea841802532585b2c7c
MD5 a8347ff9035cbd5d4242b22172d299fc
SHA1 3289b3fba2201e0167a6c97ef9477da16750d4e8
SHA512 7cdbd0f6f0e41fe133fdefd7df7a4a8beb845a1c63d780007429eb535d69f0410ada4141c49ff29cb46c2ac6489ae6d49fb24013090c61887dfae8b8132dbf48
TLSH
T113E0EB0837B15348D024C0FFC07F1A78C270F14B3E04082808F0A29ECEA556A6EF1C3A
MD5 SHA1 SHA512 TLSH

Submit Download

dxxhpi16.dll

Path C:\Windows\SysWOW64\dxxhpi16.dll
Size 344B
SHA256 d48123c1de2df906a86c7c173376f5fec9c52ab1c6c77ebd1075658cfe0a8b60
MD5 a6135652ac5f47d3cfb00c5976b3d354
SHA1 556e88336157b5e4e0424194f7a8faabaa05b322
SHA512 b78e2f8588bfa0630ec75b599da0da1152f42e61a1024c553d49bb5022307a25f006aa3094a24f0f51189a044e377d24f3d4c36a1c531d30f00ae0b418cccf58
TLSH
T1A3E07D04677153A8D01484FFC17F6E78C230F15A3E94042608E0A6DFDEA556E6E71C7D
MD5 SHA1 SHA512 TLSH

Submit Download

runxhpi32.exe

Path C:\Windows\SysWOW64\runxhpi32.exe
Size 132KB
SHA256 2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75
MD5 0a9fac073827b5ad78d6ed95dc237858
SHA1 dc0ebc0225a34747bf00636d2881d6877d78605a
SHA512 43d5b1a659c6661b72ae48dfe181625b9ce8d9ad2722ebef9be6f4dea9160ab970f3f5cd3b0ab94db09ee957b8ce17862571861b7902685d04d0e5d11b17f621
SSDEEP 3072:6myWGkEJYTmdF9Hu2tV1jddoDj/VxHOA1J2y2n:6rSmf9Htr
TLSH
T1A0D38E07F4F28532C591317B28CBCB3DA77EE45C2245D382BB68AC9264A5634777C6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xhpia.cfg

Path C:\Windows\SysWOW64\xhpia.cfg
Size 203B
SHA256 458a13a57ed12fa40b3497b563cb5a02d4f4c1f12397fe8376170e53a8b9b2b5
MD5 fff5d60b50f4d347f6a32cf3644ce126
SHA1 54de71551f835354c4965bc06c2621e6a803df6e
SHA512 3c3c7705f988e67d196782c8c6a10234afe6baa1a6973903419329638d2af687f98445d8bbf0a5d806edf9eb3cf3dfb59e44820057acaeed8a94f59538e4b53d
TLSH
T1F0D01293351C1150500C4BE012567E8F97E734334F1DFBE5764D1CC900F04299EF4856
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads