ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d

General

Target
jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe
Size 81KB
Sample261002-g1cxes1fkc
SHA256 ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d
MD5 101a9585cf9bd871b628aab61e74531a
SHA1 05a2c0204085fc4f201d6a3e54b4aca454688d08
SHA512 0066ec3eb64932c9a87e9ee351d8cda8cfccb66953d6c71428a7c7a4fbb8165f7f1c083826688b3790eef6cbbc8b9817878a165b442ae4b78e520311775ceecb
SSDEEP 1536:ibFbUgdmddXP9QVmsJx2R97Qdp74G6nZ6UwT8AFoyg:ibDdmDFu/Y6CG64n9g
TLSH
T1A2837D4BB74544B3C0E7023066963A3A9A7B6C745A5ABD73EB50B5C63CB10E5E239F03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
4916	rundll32.exe
4916	rundll32.exe
4916	rundll32.exe
1416	rundll32.exe
4120	rundll32.exe
4120	rundll32.exe
4120	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\whhfd008.ocx	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\whh12009.ocx	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe
File opened for modification	C:\Program Files\Common Files\whh12009.ocx	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe
File created	C:\Program Files\Common Files\0E59524Cce.dll	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe
File opened for modification	C:\Program Files\Common Files\0E59524Cce.dll	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1416	rundll32.exe
1416	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4916	rundll32.exe
824	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4916	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4120	3608	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe	89
PID 3608 wrote to memory of 4916	3608	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe	90
PID 3608 wrote to memory of 1416	3608	jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\whhfd008.ocx" pfjieaoidjglkajd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\0E59524Cce.dll" m3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\whh12009.ocx" pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ea734ed45ab9e7c12a4129a94745bbea01e58812f2d297ee281fda3a7297f56d.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0E59524Cce.dll

Path C:\Program Files\Common Files\0E59524Cce.dll
Size 10KB
SHA256 f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13
MD5 f1f49fb85ab029ad86c02ebecb892b12
SHA1 664a602f8e843218c1158571714cd0adee1da939
SHA512 600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673
SSDEEP 192:cjbjEyfon/ZtXNfKpF+vXXxbI/86uyvdo:H+on/ZLIsfhbIl
TLSH
T12022B49B26910663C9950F7412AA3A3D8C2B54F8435F7977EF50D8813CA60D9F63EE83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whh12009.ocx

Path C:\Program Files\Common Files\whh12009.ocx
Size 51KB
SHA256 8e6f1c210eb1c6b6713bbd3d3720159e996c9c5c6dc56a7adc21a4cac9911888
MD5 81ca3a88760014e42820b2a1b7a15b4c
SHA1 02425303d5eb9bd8f5d9edc610fa2e09fa042038
SHA512 c769f1d709e8427a38503c24b4698e6318bc9d4a9e57c5023ec30586c6a605b7a0f0a4971789b062d8f4bc868d649d51cf6adf4d116201bf4e80c554aa3f6d92
SSDEEP 1536:RdXP9QVmsJx2R97Qdp74G6nZ6UwT8AFoyg:XFu/Y6CG64n9g
TLSH
T141337B4BB74554B3C0EB013066963B3A6ABB6C345D54ACB3EB61B18639B21E5E13DF03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whhfd008.ocx

Path C:\Windows\SysWOW64\whhfd008.ocx
Size 14KB
SHA256 672639ce00081bdd6b6ee69e1bc816d0b353ed9713b5a21bac6009907daf3d3b
MD5 731659d09654891912ac223e20cd10ab
SHA1 13cee04adc7b09ef1c0c6b9abc02d0c7bc02a071
SHA512 e2b63a180ff6a9ef523f21a9afe9f71f612f617fbab5b791f763c8bccab14d8cb1986729fadba4bc5f29fe9813766bcb88168018f8c6571ec72efc69639f1116
SSDEEP 192:59Fij7/vSyR07lego8slUOD9kkmZAJ5ihHbr:5rijzvVR0NElUODhdm
TLSH
T1FA52E9CDA7CA8252D1A3467026983A3752BBA4B44C3F226BE75459C53CB84E7E735F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-18-0x0000000010000000-0x0000000010211000-memory.dmp

Download

memory/3608-0-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/3608-10-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/4120-19-0x00000000029F0000-0x0000000002C01000-memory.dmp

Download

memory/4916-20-0x0000000002480000-0x0000000002691000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads