2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75

General

Target
jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Size 132KB
Sample260925-vstrvss18r
SHA256 2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75
MD5 0a9fac073827b5ad78d6ed95dc237858
SHA1 dc0ebc0225a34747bf00636d2881d6877d78605a
SHA512 43d5b1a659c6661b72ae48dfe181625b9ce8d9ad2722ebef9be6f4dea9160ab970f3f5cd3b0ab94db09ee957b8ce17862571861b7902685d04d0e5d11b17f621
SSDEEP 3072:6myWGkEJYTmdF9Hu2tV1jddoDj/VxHOA1J2y2n:6rSmf9Htr
TLSH
T1A0D38E07F4F28532C591317B28CBCB3DA77EE45C2245D382BB68AC9264A5634777C6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3400	runbdpb32.exe
2708	Windows Mail16.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runbdpb32.exe \"%1\" %*"	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runbdpb32.exe \"%1\" %*"	runbdpb32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LoadProfile = "runbdpb32.exe powprof.dll,LoadCurrentUserProfile"	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Mail = "\"C:\\Program Files (x86)\\Windows Mail\\Windows Mail16.exe\""	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\runbdpb32.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\runbdpb32.exe	runbdpb32.exe
File opened for modification	C:\Windows\SysWOW64\bdpba.cfg	runbdpb32.exe
File opened for modification	C:\Windows\SysWOW64\dxbdpb16.dll	Windows Mail16.exe
File created	C:\Windows\SysWOW64\runbdpb32.exe.tmp	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Windows\SysWOW64\1252085016.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Windows\SysWOW64\1252085016.exe.tmp	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\1252085016.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\dxbdpb16.dll	runbdpb32.exe
File opened for modification	C:\Windows\SysWOW64\runbdpb32.exe	Windows Mail16.exe
File opened for modification	C:\Windows\SysWOW64\bdpba.cfg	Windows Mail16.exe
File opened for modification	C:\Windows\SysWOW64\dxbdpb16.dll	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\SysWOW64\bdpba.cfg	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Windows\SysWOW64\runbdpb32.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\Windows Mail16.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File created	C:\Program Files (x86)\Windows Mail\Windows Mail16.exe.tmp	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\Windows Mail16.exe	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Win.ini	Windows Mail16.exe
File opened for modification	C:\Windows\Win.ini	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
File opened for modification	C:\Windows\Win.ini	runbdpb32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runbdpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Mail16.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runbdpb32.exe \"%1\" %*"	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\runbdpb32.exe \"%1\" %*"	runbdpb32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3400	4504	jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\runbdpb32.exe
  C:\Windows\system32\runbdpb32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3400

C:\Program Files (x86)\Windows Mail\Windows Mail16.exe
"C:\Program Files (x86)\Windows Mail\Windows Mail16.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windows Mail16.exe.tmp

Path C:\Program Files (x86)\Windows Mail\Windows Mail16.exe.tmp
Size 132KB
SHA256 2f35895615873520b157ffebfc9738799c59b4027ebbac0fb017bfb331144e75
MD5 0a9fac073827b5ad78d6ed95dc237858
SHA1 dc0ebc0225a34747bf00636d2881d6877d78605a
SHA512 43d5b1a659c6661b72ae48dfe181625b9ce8d9ad2722ebef9be6f4dea9160ab970f3f5cd3b0ab94db09ee957b8ce17862571861b7902685d04d0e5d11b17f621
SSDEEP 3072:6myWGkEJYTmdF9Hu2tV1jddoDj/VxHOA1J2y2n:6rSmf9Htr
TLSH
T1A0D38E07F4F28532C591317B28CBCB3DA77EE45C2245D382BB68AC9264A5634777C6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdpba.cfg

Path C:\Windows\SysWOW64\bdpba.cfg
Size 203B
SHA256 458a13a57ed12fa40b3497b563cb5a02d4f4c1f12397fe8376170e53a8b9b2b5
MD5 fff5d60b50f4d347f6a32cf3644ce126
SHA1 54de71551f835354c4965bc06c2621e6a803df6e
SHA512 3c3c7705f988e67d196782c8c6a10234afe6baa1a6973903419329638d2af687f98445d8bbf0a5d806edf9eb3cf3dfb59e44820057acaeed8a94f59538e4b53d
TLSH
T1F0D01293351C1150500C4BE012567E8F97E734334F1DFBE5764D1CC900F04299EF4856
MD5 SHA1 SHA512 TLSH

Submit Download

dxbdpb16.dll

Path C:\Windows\SysWOW64\dxbdpb16.dll
Size 344B
SHA256 a231059cd9ea2a762dda3cf701e3d844d9d7fd6a2eaee1d675d6585ad05f4a8b
MD5 e9266354b13ee100f7f48790fe499440
SHA1 ffacd38119640307469fa2cd9b5b24f0d7f4e81c
SHA512 9622f63ed9d330ebc020f327d1dce6b0715dd5c58f8f872fe8d7047d1c40da3d9ec2b1ce30c961f4fdeb1ae06191aa01bb19537b0b61af348aa2d3fa82f78308
TLSH
T151E07D04E7B193E8D01584AFC53F1A79C230F1573E94042608E196DEDD5595E6E71C7E
MD5 SHA1 SHA512 TLSH

Submit Download

dxbdpb16.dll

Path C:\Windows\SysWOW64\dxbdpb16.dll
Size 344B
SHA256 df7cb7350b4c50a6594701e9ab833bff93e33f05ad8d7642c008267d21ef7ba3
MD5 58132178cf35f38088d338b641f38dd7
SHA1 b2f9d9b8c9b94fa3910f500331e15a67be0921a8
SHA512 c10dbcaaeb8008401dc2f02be3c8a05a7cd03c6a61d12645a2bfee98190b564c1741b02ac046b3b49917d8fcf6f00fd6a794abda55918c7d15086826ea012072
TLSH
T19CE02D04E3B153E8D02184AFC03F0A38C230F1073E84082408E096DECD4480B2EB0C3E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads