3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd

General

Target
jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
Size 60KB
Sample260925-w2pd6sgf73
SHA256 3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd
MD5 f81892b43349b4ba904b0f8bc799a129
SHA1 85adabc470b2873cd7b3438f9e69438ba378aca1
SHA512 3d472dd7fdd8b01efebec386a2fa310b442aec2caff966c6ad87048207a4debde0b0d9e3e1fb8c9432ae693ee0a7e9856d6a8d37c4122c46234bc4571aa70f40
SSDEEP 768:20t8GBj4AmivJ8s5D8/FZuMkmi7dC9q4CD3p88fUL:qyjjWYIgMOdb4U68fa
TLSH
T1E5536D562B4680F2D2EE0674706D2F375FBF98342D549493CF735ADA1D7988BE82830A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1552	msioSvr64.exe
2124	mmmmmm.exe
4348	tttttt.exe
1548	aaaaaa.exe
3860	rrrrrr.exe
1672	yyyyyy.exe
1208	ffffff.exe
3312	gggggg.exe
3592	nnnnnn.exe
3844	eeeeee.exe

Loads dropped DLL 11 IoCs

pid	Process
1112	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
1552	msioSvr64.exe
2124	mmmmmm.exe
4348	tttttt.exe
1548	aaaaaa.exe
3860	rrrrrr.exe
1672	yyyyyy.exe
1208	ffffff.exe
3312	gggggg.exe
3592	nnnnnn.exe
3844	eeeeee.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\tttttt.exe"	mmmmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\aaaaaa.exe"	tttttt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\ffffff.exe"	yyyyyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\gggggg.exe"	ffffff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\nnnnnn.exe"	gggggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\mmmmmm.exe"	msioSvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\rrrrrr.exe"	aaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\yyyyyy.exe"	rrrrrr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\eeeeee.exe"	nnnnnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\gggggg.exe"	eeeeee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\msioSvr64.exe"	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msioSvr64.dll	yyyyyy.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	ffffff.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	tttttt.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	aaaaaa.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	rrrrrr.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	gggggg.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	nnnnnn.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	eeeeee.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	msioSvr64.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	mmmmmm.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\msioSvr64.exe	msioSvr64.exe
File created	C:\Windows\rrrrrr.exe	aaaaaa.exe
File opened for modification	C:\Windows\ffffff.exe	yyyyyy.exe
File created	C:\Windows\nnnnnn.exe	gggggg.exe
File opened for modification	C:\Windows\eeeeee.exe	nnnnnn.exe
File created	C:\Windows\msioSvr64.exe	mmmmmm.exe
File opened for modification	C:\Windows\gggggg.exe	ffffff.exe
File created	C:\Windows\msioSvr64.exe	eeeeee.exe
File opened for modification	C:\Windows\nnnnnn.exe	gggggg.exe
File created	C:\Windows\msioSvr64.exe	nnnnnn.exe
File opened for modification	C:\Windows\mmmmmm.exe	msioSvr64.exe
File opened for modification	C:\Windows\yyyyyy.exe	rrrrrr.exe
File created	C:\Windows\ffffff.exe	yyyyyy.exe
File created	C:\Windows\gggggg.exe	eeeeee.exe
File created	C:\Windows\aaaaaa.exe	tttttt.exe
File created	C:\Windows\msioSvr64.exe	rrrrrr.exe
File created	C:\Windows\tttttt.exe	mmmmmm.exe
File opened for modification	C:\Windows\tttttt.exe	mmmmmm.exe
File opened for modification	C:\Windows\aaaaaa.exe	tttttt.exe
File created	C:\Windows\msioSvr64.exe	aaaaaa.exe
File created	C:\Windows\msioSvr64.exe	ffffff.exe
File created	C:\Windows\yyyyyy.exe	rrrrrr.exe
File created	C:\Windows\gggggg.exe	ffffff.exe
File created	C:\Windows\eeeeee.exe	nnnnnn.exe
File opened for modification	C:\Windows\msioSvr64.exe	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
File created	C:\Windows\mmmmmm.exe	msioSvr64.exe
File created	C:\Windows\msioSvr64.exe	tttttt.exe
File opened for modification	C:\Windows\rrrrrr.exe	aaaaaa.exe
File created	C:\Windows\msioSvr64.exe	yyyyyy.exe
File created	C:\Windows\msioSvr64.exe	gggggg.exe
File created	C:\Windows\msioSvr64.exe	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4796	4348	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msioSvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaaaaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyyyyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gggggg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nnnnnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmmmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tttttt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rrrrrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffffff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eeeeee.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1112	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
1112	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
1552	msioSvr64.exe
1552	msioSvr64.exe
2124	mmmmmm.exe
2124	mmmmmm.exe
4348	tttttt.exe
4348	tttttt.exe
1548	aaaaaa.exe
1548	aaaaaa.exe
3860	rrrrrr.exe
3860	rrrrrr.exe
1672	yyyyyy.exe
1672	yyyyyy.exe
1208	ffffff.exe
1208	ffffff.exe
3312	gggggg.exe
3312	gggggg.exe
3592	nnnnnn.exe
3592	nnnnnn.exe
3844	eeeeee.exe
3844	eeeeee.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1112	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
1552	msioSvr64.exe
2124	mmmmmm.exe
4348	tttttt.exe
1548	aaaaaa.exe
3860	rrrrrr.exe
1672	yyyyyy.exe
1208	ffffff.exe
3312	gggggg.exe
3592	nnnnnn.exe
3844	eeeeee.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 3224	1112	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe	55
PID 1552 wrote to memory of 3224	1552	msioSvr64.exe	55
PID 2124 wrote to memory of 3224	2124	mmmmmm.exe	55
PID 4348 wrote to memory of 3224	4348	tttttt.exe	55
PID 1548 wrote to memory of 3224	1548	aaaaaa.exe	55
PID 3860 wrote to memory of 3224	3860	rrrrrr.exe	55
PID 1672 wrote to memory of 3224	1672	yyyyyy.exe	55
PID 1208 wrote to memory of 3224	1208	ffffff.exe	55
PID 3312 wrote to memory of 3224	3312	gggggg.exe	55
PID 3592 wrote to memory of 3224	3592	nnnnnn.exe	55
PID 3844 wrote to memory of 3224	3844	eeeeee.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1112

C:\Windows\msioSvr64.exe
C:\Windows\msioSvr64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\mmmmmm.exe
C:\Windows\mmmmmm.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\tttttt.exe
C:\Windows\tttttt.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 320
  2⤵
  - Program crash
  PID:4796

C:\Windows\aaaaaa.exe
C:\Windows\aaaaaa.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4348 -ip 4348
1⤵
PID:1860

C:\Windows\rrrrrr.exe
C:\Windows\rrrrrr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\yyyyyy.exe
C:\Windows\yyyyyy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\ffffff.exe
C:\Windows\ffffff.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\gggggg.exe
C:\Windows\gggggg.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312

C:\Windows\nnnnnn.exe
C:\Windows\nnnnnn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\eeeeee.exe
C:\Windows\eeeeee.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msioSvr64.dll

Path C:\Windows\SysWOW64\msioSvr64.dll
Size 40KB
SHA256 c063618d99c2bbf44c081291bf5d5de79f0457a62331a08c5b7f3b7021bc2c6f
MD5 ab115477666b3506fc3a27d26fec2e27
SHA1 5b9bab28c375b0862de2f87b1a7d898564df532b
SHA512 df4d232c7b80c2356f75f165c707aa1cc6e1690a58dd6fa785cb5e0114c0a725171de4ae31c72475d905c03e411657c55880c2ba7cf03ab6ed8e0b67e56b99db
SSDEEP 768:Pj4AmivJ8s5D8/FZuMkmi7dC9q4CD3p88fUL:PjjWYIgMOdb4U68fa
TLSH
T140035D551B0681F2E2EE0534B0AD2F375E7F9D386C545493CF735EEA0D7688AE82470A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msioSvr64.exe

Path C:\Windows\msioSvr64.exe
Size 60KB
SHA256 3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd
MD5 f81892b43349b4ba904b0f8bc799a129
SHA1 85adabc470b2873cd7b3438f9e69438ba378aca1
SHA512 3d472dd7fdd8b01efebec386a2fa310b442aec2caff966c6ad87048207a4debde0b0d9e3e1fb8c9432ae693ee0a7e9856d6a8d37c4122c46234bc4571aa70f40
SSDEEP 768:20t8GBj4AmivJ8s5D8/FZuMkmi7dC9q4CD3p88fUL:qyjjWYIgMOdb4U68fa
TLSH
T1E5536D562B4680F2D2EE0674706D2F375FBF98342D549493CF735ADA1D7988BE82830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-7-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1112-5-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/3224-2-0x0000000002840000-0x0000000002841000-memory.dmp

Download

memory/3224-146-0x0000000008A20000-0x0000000008A21000-memory.dmp

Download

memory/3224-163-0x0000000008F50000-0x0000000008F51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads