Overview

overview

8

Static

static

3

caf7f0def5...18.exe

windows7-x64

8

caf7f0def5...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 04:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    caf7f0def54e59ca3718170062e6bffa_JaffaCakes118.exe

  • Size

    62KB

  • MD5

    caf7f0def54e59ca3718170062e6bffa

  • SHA1

    fb88764219b5eb9b57251523b90965a9a88e31ec

  • SHA256

    125cc811640f95956f08e42173509d50755ab24280d26c10463cbbe3c5138018

  • SHA512

    f036270f7cc9c751e29beb8ba8faf0f700b9e174ced59efe11ecd58f29e9c9db0a28ea634ca5a2000059d79f0d8d736abbeea3753dfd9a8ab0fe2a511ada930a

  • SSDEEP

    768:1m/QojCpHfx0lk6SLZRI+WE6F2UzpHjhm8f10+a8m/QojCpHfx0tJztvI:EQojY5LLI+W5ljGQojBtvI

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 6 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 24 IoCs
  • Drops autorun.inf file 1 TTPs 27 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\caf7f0def54e59ca3718170062e6bffa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\caf7f0def54e59ca3718170062e6bffa_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\AE 0124 BE.gif
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4492 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2196
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3624
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:440
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      54268873cc52faf65be905c15a0acb8d

      SHA1

      9ceead9820a6733d8d7b1182dea888dff5587e50

      SHA256

      e2437ffebbe2e4eab5526879179a99eb70a50ebb5a1e98a80e85214db43485c0

      SHA512

      1fb3a3f8962d31871db2c4a37e0ff18bc5d10d0218ad7feb965e1cda920ead34f5f0d4585718a689aa0eb7f08b9d14ecde330b35c06f77a7ddf34b3a81e5384b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      404B

      MD5

      59f9d6c2ce05dcc819e80a3475aea229

      SHA1

      14f0a577a364cb5d04502d21e440697d24687676

      SHA256

      9f682bd078d863d0a80cc4e35439dd873ea9df4c6b087e62fb9b82041a9259a7

      SHA512

      c1c0c6c36aa657a60a25b45960072ab54d31f2e01135d1085965a4f38d02f729b30664b1b188b551ac9375b5b8530d670c2370c54acace668c1d685aae2e4645

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-US
      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      Download Submit

    • C:\Windows\AE 0124 BE.gif
      Filesize

      62KB

      MD5

      46dd0e82e31edc49b359602d5cd45fba

      SHA1

      7f96a9937cacbc4569881e31135bb259fcd204c8

      SHA256

      b230d931692ebb3aedd0ec3543355b6ab561bb26b118413695cb717791ed7a49

      SHA512

      b1bbb8cec3d72484df98eca9aa240b60ace3802369f5f0bfc5c29cd39a0590912991188d77f9f849b3e7e1c9ba805625e4a5c3dc749a9b9bbe84ffef736e90ff

      Download Submit

    • C:\Windows\Msvbvm60.dll
      Filesize

      1.4MB

      MD5

      25f62c02619174b35851b0e0455b3d94

      SHA1

      4e8ee85157f1769f6e3f61c0acbe59072209da71

      SHA256

      898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

      SHA512

      f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

      Download Submit

    • C:\Windows\SysWOW64\drivers\winlogon.exe
      Filesize

      120KB

      MD5

      955234385e9fa3669ba26e8b0648b454

      SHA1

      ed3b1dc334cc35e6131bcf833993cd0852a8c3d1

      SHA256

      8c6bab5818abcbec4770fea40ec782041812902e788f841c851fa8c5cc1908cc

      SHA512

      3b891660ffe266ab0861c377619f127e883f33a1d95875a3f028e786a2ddf70388bd59abe683196280092a0025cc40f6de60bf5fa13cbfc79ab2d320a8faf86e

      Download Submit

    • \??\c:\B1uv3nth3x1.diz
      Filesize

      25B

      MD5

      589b6886a49054d03b739309a1de9fcc

      SHA1

      0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

      SHA256

      564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

      SHA512

      4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

      Download Submit