8e7dd0f3c8fc0cd3d5a50398ad75fdc0429abc5700e0a693f8ce9f75aabcdd09

General

Target
jaffacakes118_Trojan.Win32.Chifrax.d.exe
Size 1.3MB
Sample261018-2cfcvsbt6s
SHA256 8e7dd0f3c8fc0cd3d5a50398ad75fdc0429abc5700e0a693f8ce9f75aabcdd09
MD5 0bc5c095035930b1e876f7aacbe348e6
SHA1 d26897da0c6b8f3adb4f37767a6e9986154a64e0
SHA512 0a2e446f0c645529192c0c50f4fc18797439a2290d95d5a5c9ad2651b3c5a701384929e6eca077ca3434b4ada95ca353da4770d88e7b0f6b5317ef22543654c4
SSDEEP 24576:QhA7PzrcXlCSkW13WuWzUzttiRLSeSaB9ZeNBXLCdioU6za6athzp/JY:0A7PzQlCJQ3PWzytiRd5ZeNIxNzDspp/
TLSH
T13E552320D6A1896DF4F227305BD663290569F824C768EBDEDB8EB4C72C26BC34538717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3100	PEHJHWA.exe
2992	pc-telephone.exe
720	NVSKVNR.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_Trojan.Win32.Chifrax.d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NVSKVNR.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NVSKVNR.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Chifrax.d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PEHJHWA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pc-telephone.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NVSKVNR.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
720	NVSKVNR.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3100	4140	jaffacakes118_Trojan.Win32.Chifrax.d.exe	90
PID 3100 wrote to memory of 2992	3100	PEHJHWA.exe	92
PID 4140 wrote to memory of 720	4140	jaffacakes118_Trojan.Win32.Chifrax.d.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Chifrax.d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Chifrax.d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PEHJHWA.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PEHJHWA.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Users\Admin\AppData\Local\Temp\pc-telephone.exe
    "C:\Users\Admin\AppData\Local\Temp\pc-telephone.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2992
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NVSKVNR.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NVSKVNR.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NVSKVNR.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NVSKVNR.exe
Size 16KB
SHA256 6d20e69e5d4ced88969d876bcf0edb797951f422f3f9625ea6fb9419b221cb0d
MD5 544778c2c8368139602164cfd76cfbf3
SHA1 eac22e04744d567d210518cedd137a08277805ff
SHA512 405ac05a29c012e0706c5f660cb543f6655ae0d44f7f398fff0278c90ba0fc3b5179236e4e5620b3a960c09b0bee1ec6a4fdc3257144d29c2c1bcb45fb78e263
SSDEEP 96:dFr6CWqhnkSLbZCZCOCsBnqHSdVn3HnSkQ3zYPKjI2:HOqhkSCRJrX3SkQ3zAeI
TLSH
T15E722F82F2CBC523E19501368C638BBD6961FD188F2BD31F72E47B6E2C74A506920F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PEHJHWA.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PEHJHWA.exe
Size 1.2MB
SHA256 070655f110c13eb408c1b6a1858074384777b20df2a873892d265f9499075deb
MD5 b83f87b2f909098320ce42e0dd4ed03e
SHA1 bf3e517361c3326c5483024dafac161fe83f5350
SHA512 a53866360ebc5899336ce1e38edd3bd747ae07262b850e9a13ef25582a046698c5d3fb42e5c3fe86082ba4f07eda03e9df8cdbe35522a6d922b492d06273c85c
SSDEEP 24576:s1Iwbmk/AqD5HxuXzRztPyR1SeVo0d+op6kavatOzVG:WbmM/5HUXzjPyRvdQkWsOzQ
TLSH
T1E655336AD9270E80E4235535C787163EA93ED863C68CF87AEF8935072E827D71F12817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pc-telephone.exe

Path C:\Users\Admin\AppData\Local\Temp\pc-telephone.exe
Size 1.2MB
SHA256 79277510719aa80041e9b6753eccc5cd415abcc6df8a440abc7aa028fbc4daac
MD5 f31dd0f61763482abe43da3311046e08
SHA1 a7c1fd26cfcb7797cc2feb35b5b303115611583a
SHA512 a844c2512a5c525a7f3e6458e8545b8952130812275a98f3e89d5cab12cf3a1305e3eaae0065fc94f5ea283594d6c476d8d3a899dd7b21542242ca63e39a0881
SSDEEP 24576:iIwbmk/AqD5HxuXzRztPyR1SeVo0d+op6kavatOzVr:IbmM/5HUXzjPyRvdQkWsOzR
TLSH
T18D453362CC3B0EC0E4235A35CA83662FB93AD583C2CDF936A6DE10565E877971E43467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2992-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2992-18-0x0000000000435000-0x0000000000436000-memory.dmp

Download

memory/2992-31-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2992-33-0x0000000000435000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads