15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb

General

Target
jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
Size 26KB
Sample260925-xcwbvsvt3p
SHA256 15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb
MD5 a9cde2bfaf06a15ec9d2287f781fb39e
SHA1 170fedebe2521914720f849f736dc63f3319053e
SHA512 0f12e1cbb39d9f9d24dca6ada9daea14ba89eb88e9a844300cccbad676dfdd499d7f466b8cb58b059e39234ad4b58d01f517847c4e4e4afb6525e9137720986f
SSDEEP 384:JTmKrl1u2Fbfvf5EcJrsTTeC8UeoQp+64liMfT6+r2EZkktGuXQw/ZrBg:J/bfvf5E/TMUJQ4YSlTwuXdhrB
TLSH
T167C22B572B2944F2C1DE06B039582F264F7B9D3417A5A8E3CBF38AC95D6C253B835207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2488	NVDispDrv.exe
4500	tlzptc.exe
2012	ycptak.exe

Loads dropped DLL 4 IoCs

pid	Process
5304	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
2488	NVDispDrv.exe
4500	tlzptc.exe
2012	ycptak.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVDispDrv = "C:\\Windows\\NVDispDrv.exe"	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVDispDrv = "C:\\Windows\\tlzptc.exe"	NVDispDrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVDispDrv = "C:\\Windows\\ycptak.exe"	tlzptc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVDispDrv = "C:\\Windows\\NVDispDrv.exe"	ycptak.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NVDispDrv.dll	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
File created	C:\Windows\SysWOW64\NVDispDrv.dll	NVDispDrv.exe
File created	C:\Windows\SysWOW64\NVDispDrv.dll	tlzptc.exe
File created	C:\Windows\SysWOW64\NVDispDrv.dll	ycptak.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\NVDispDrv.exe	NVDispDrv.exe
File created	C:\Windows\tlzptc.exe	NVDispDrv.exe
File created	C:\Windows\NVDispDrv.exe	tlzptc.exe
File created	C:\Windows\ycptak.exe	tlzptc.exe
File opened for modification	C:\Windows\NVDispDrv.exe	ycptak.exe
File created	C:\Windows\NVDispDrv.exe	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NVDispDrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tlzptc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ycptak.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5304	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
5304	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
2488	NVDispDrv.exe
2488	NVDispDrv.exe
4500	tlzptc.exe
4500	tlzptc.exe
2012	ycptak.exe
2012	ycptak.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5304	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
2488	NVDispDrv.exe
4500	tlzptc.exe
2012	ycptak.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 3500	5304	jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe	81
PID 2488 wrote to memory of 3500	2488	NVDispDrv.exe	81
PID 4500 wrote to memory of 3500	4500	tlzptc.exe	81
PID 2012 wrote to memory of 3500	2012	ycptak.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5304

C:\Windows\NVDispDrv.exe
C:\Windows\NVDispDrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\tlzptc.exe
C:\Windows\tlzptc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500

C:\Windows\ycptak.exe
C:\Windows\ycptak.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NVDispDrv.exe

Path C:\Windows\NVDispDrv.exe
Size 26KB
SHA256 15a980e74f1e1023ee133afaaa10f84c9098444b271053827cdb3a8811b89ccb
MD5 a9cde2bfaf06a15ec9d2287f781fb39e
SHA1 170fedebe2521914720f849f736dc63f3319053e
SHA512 0f12e1cbb39d9f9d24dca6ada9daea14ba89eb88e9a844300cccbad676dfdd499d7f466b8cb58b059e39234ad4b58d01f517847c4e4e4afb6525e9137720986f
SSDEEP 384:JTmKrl1u2Fbfvf5EcJrsTTeC8UeoQp+64liMfT6+r2EZkktGuXQw/ZrBg:J/bfvf5E/TMUJQ4YSlTwuXdhrB
TLSH
T167C22B572B2944F2C1DE06B039582F264F7B9D3417A5A8E3CBF38AC95D6C253B835207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NVDispDrv.dll

Path C:\Windows\SysWOW64\NVDispDrv.dll
Size 18KB
SHA256 774a20dd75c6cff34f3c62e673ed2e0df7a0934a015f2f1adf7cb0afdd65731a
MD5 738819139358cedd712b47b140bbaf23
SHA1 b3c4e54df9b6212c49c4caee316e43402f73a60f
SHA512 f301c14a05d875622f0c68d9f9ef9969f1e14f897ff8b56ef6c0838644cb03c878199c3592e22ddbcbffbe8a307c3f10fc2c675e0e3531479624f10dd42b7f59
SSDEEP 384:rEcJrsTTeC8UeoQp+64liMfT6+r2EZkktGuXQw/ZrBg:rE/TMUJQ4YSlTwuXdhrB
TLSH
T1A2825A572B2A84B6C2EE067078A93F220D7B8D742CE16893CBF34E995D1C493B835617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2012-31-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/3500-1-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/3500-3-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads