552ac335ba310d22b5efcf21f363924027944fa9d4fcf3cc38b85502c906ff2f

General

Target
jaffacakes118_Trojan-Dropper.Win32.Arbinder.201.a.exe
Size 712KB
Sample261009-v2kwbasx2l
SHA256 552ac335ba310d22b5efcf21f363924027944fa9d4fcf3cc38b85502c906ff2f
MD5 424ec9a3237e7c38196aa67570183560
SHA1 ea0ec1d67aedbbcc51c712f3984070d39023a747
SHA512 8bcf37c0d2af39b129a48d9beb5765d2ec134419d44fa195b20bf862a65985de871fd352db8c89a43cfb6a5d5b521235397fcbdf4b509a860797708892199b00
SSDEEP 12288:awP2qnNetDaPggtx4oe59qN18rhunh/thw9pY1KTACDs+FcWGGUtVZwt/YxQAuz5:aTqnNet/koGN18It7w9uMTAwleEKx8
TLSH
T128F4332A2739C7ECDC6690B720EEABADA0B0581FE5F5EE47889D13F1DF1D92D1009452
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4524	jzwg.exe
2916	123456.exe
2644	IEXPLORE .EXE

Loads dropped DLL 3 IoCs

pid	Process
4524	jzwg.exe
4524	jzwg.exe
4524	jzwg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mssysint = "IEXPLORE .EXE"	123456.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IEXPLORE .EXE	123456.exe
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	IEXPLORE .EXE
File created	C:\Windows\SysWOW64\IEXPLORE .EXE	123456.exe
File created	C:\Windows\SysWOW64\mspbhook.dll	123456.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/480-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/480-16-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jzwg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jzwg.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE .EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Arbinder.201.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jzwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123456.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	123456.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ZPwd_box	IEXPLORE .EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2916	123456.exe
2916	123456.exe
4524	jzwg.exe
4524	jzwg.exe
4524	jzwg.exe
2644	IEXPLORE .EXE
2644	IEXPLORE .EXE
4524	jzwg.exe
4524	jzwg.exe
4524	jzwg.exe
4524	jzwg.exe
4524	jzwg.exe
4524	jzwg.exe
4524	jzwg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 4524	480	jaffacakes118_Trojan-Dropper.Win32.Arbinder.201.a.exe	90
PID 480 wrote to memory of 2916	480	jaffacakes118_Trojan-Dropper.Win32.Arbinder.201.a.exe	91
PID 2916 wrote to memory of 2644	2916	123456.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Arbinder.201.a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Arbinder.201.a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:480
- C:\WINDOWS\TEMP\jzwg.exe
  "C:\WINDOWS\TEMP\jzwg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4524
- C:\WINDOWS\TEMP\123456.exe
  "C:\WINDOWS\TEMP\123456.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\IEXPLORE .EXE
    "C:\Windows\system32\IEXPLORE .EXE"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HtmlView.fnr

Path C:\Users\Admin\AppData\Local\Temp\HtmlView.fnr
Size 212KB
SHA256 a834f9a8f80fd69418d24bbc59139100e6646ad86de361ea4e5417b8ceb285c9
MD5 936104e824aeab25877ed65145a521ac
SHA1 ea07ef7063b6021efd4a2901b3a65037cc9a005b
SHA512 8694d48c93748dedb37a4cf5842f8faa6486bbbce980bf4c0e9b31ab471a2090f580e6f4e7205dcff0a98f91552a4651de2b40b054d9c132a8c54f0d17a5be06
SSDEEP 3072:wMp8K2P3Z0vEA2JUppbZA9wQg6g55VunA/m3mUovNH3vnyfxqK:h8RZ0vEhJ8KDVA/7f
TLSH
T1E0248D1231E0C47AC39F43355E53AF7AB7F8E5508FA18A4B6B50CF5E0D765828E26136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krnln.fnr

Path C:\Users\Admin\AppData\Local\Temp\krnln.fnr
Size 1.1MB
SHA256 95ee40a54cf91774fda6b04f1bb3c393fedd40cd8d4db6267a176294638d4e82
MD5 d612a3ca3f2266227c90adc4720b8fa3
SHA1 898dcf55fb51d39aa331a3917d32d6df18f42eee
SHA512 1696ad0524af98b8dbdd2137e7b37501c29dbed56df927f70376ac56276b56a5535b6f183dbbf0ffe63ba74d123273bfa7d9a4d1690cbc28730b9bcff9572f42
SSDEEP 24576:kVkxkYpIDQi5hmI9ubkGa/UmyHJv5dz+3BS:c2pzIh5cHJBo3o
TLSH
T190457D21769140B8CA0D3B701869773A77398986BB219BB75260FEEDDC3A581DC3B11F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

123456.exe

Path C:\Windows\Temp\123456.exe
Size 164KB
SHA256 b3faa664b8d89d88ee311e401ea8ead1c76f9636f8e79d6bc60a8c33cc5fbc23
MD5 6849e02a01b4f4047c8084ef04914eb0
SHA1 9ea7a129e6ab9fbb73bfb88e38a2414cbfbca421
SHA512 dfac309956e35b7e78c8a697d630fa3b24a2199d9c29eebcbec553a5daca6bede5f41fd6fae5815b298b1be8add1cd04610b09c02c8d436691ef23e2780f0c89
SSDEEP 1536:UtfDrxy3PKoSpcU2r78L1v1GMOG5Ht6tt6igHtp+T1OQxN3VFPh:Utfhy3ccVud1Xt8tzItp+nxRV/
TLSH
T107F37B2B78E1C836E451823A052D47BDF7F7DC381E614887E784AE6FBD366819D24319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jzwg.exe

Path C:\Windows\Temp\jzwg.exe
Size 664KB
SHA256 077274299cfa65cc7e050263b304fefe90388e14d10843708c4d06d1ec99cfc2
MD5 5ac18474d169d00fd150733ac42c4b53
SHA1 7ced25923b4d753b1f6cb0c112f008d70265c9f4
SHA512 e59d3bd5deb84c2d6108a72c682ea39103fb8cbf22ef87293ae409cf9385359e384ea2330452cd9315af1103c8152e422e388d56fb3147576bb8b9c997fc37dd
SSDEEP 12288:mCHxet7q10zjkoeBDE11YH/unh/FhUR3Y1QMoMiFcWG5zVZ+xx:moethe+11YGtTURI2BUK
TLSH
T17FE423361768C3ECC875D0B320D08B7A83B59D0791A9DD8B178C03F9DA2981D7DBA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/480-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/480-16-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4524-24-0x00000000024E0000-0x0000000002518000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads