Overview

overview

10

Static

static

5

ebc05c58de...18.exe

windows7-x64

10

ebc05c58de...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    156s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 18:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ebc05c58dea353da225008fff45f8509_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    ebc05c58dea353da225008fff45f8509

  • SHA1

    634c23c1078e10a01d346e961297634ac233fd72

  • SHA256

    92c9220ac6b96ec6a438ecfb70b1ad50af1c34673f3d53ec0df7b8b92053bb91

  • SHA512

    54cd1358d4b4220805a589ea6cf44e4d66f12918ac84d7f320e4981d51d21473ed02f864d5109ccb7f60c7106e025f2ffc8b5fa4454ec6ff784aa64a16a1b23a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebc05c58dea353da225008fff45f8509_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ebc05c58dea353da225008fff45f8509_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\SysWOW64\bqwgqnlevc.exe
      bqwgqnlevc.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Windows\SysWOW64\wnkkagoa.exe
        C:\Windows\system32\wnkkagoa.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2328
    • C:\Windows\SysWOW64\ukzrwpodwptmwff.exe
      ukzrwpodwptmwff.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2296
    • C:\Windows\SysWOW64\wnkkagoa.exe
      wnkkagoa.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2916
    • C:\Windows\SysWOW64\pwqhsxsysarnl.exe
      pwqhsxsysarnl.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2524
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1128

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            5295aa7d4088f08e6c5f14e2b22f6f3e

            SHA1

            be568bd9e043eb4fffa75544aaf56b5759d9cfb4

            SHA256

            8a7b69e5eb566f8a06cf5a9d2592ff236826592db84d80d94de527abaf2e5c8e

            SHA512

            cae01e39b6febd23b9db14244075fb5b89d8fcc4971d266be17390ce36d4a6feb078e23b10fb3f744979e96e9eb50be1a951555b1aed785a1fb9047a1ca89ef5

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            ab14984c721f897c8d17787b5d7e8b8e

            SHA1

            d53fad3a0dad2cbeaf4d708e12e4df0771d3ba6b

            SHA256

            0bedd829ef1ca85d26cdd81cde5e49bc9abe79cb0fade4c5899e961925875f80

            SHA512

            3f9fdcccfbe23c80544fb149d89b430bc81abe89908322652eecdeef9dab4d98ffcc4e1250e01beb8ce83bdf85a7ad7de9799d62982846388e36ddfd5b4be8d4

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            1e1149d156f096f01ea8810fc09fcd9d

            SHA1

            542e8190ae47032bc7589c4e78ce965bdbc69ef4

            SHA256

            0041c2fd02aaaa7e06af1db263252c6da40fc708f42a2c82ba6941646f10b219

            SHA512

            caf5063bddca339cfd579087cc809251d0b2f6ee59b371f7fdce218ad2f98ecdd1922c659d383edb6cea11a8547bcef455118bad280a88e714e9b672584b261b

            Download Submit

          • C:\Windows\SysWOW64\ukzrwpodwptmwff.exe
            Filesize

            512KB

            MD5

            6ec20f818fab79decfe69c3f7fea9b2e

            SHA1

            bc74bdc622e68d5b8d78272945c863d4a795e54d

            SHA256

            4bbf1c3af5ae6ba665ea294d57721e0c8a8eaa292c6fa7f4e2f0a8f929446126

            SHA512

            7168ef99481b0adbc28a14ad348f9e975a858a9f2a53e5c28bb10b37af33feeb3603fb9bd4c9fbe0b7b5839e52afb0c65be5a694e28dbfe8eef415bbbc586df9

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\bqwgqnlevc.exe
            Filesize

            512KB

            MD5

            78cdd0dbf777218c9da574d3e7b0b549

            SHA1

            196a9d27d532b0a9323b39b8d4a5fc649b495087

            SHA256

            51f6bef21b684e1078683bbe300e1a081b8fc449a62c7c9403e5f20c4aa99406

            SHA512

            719b7642884ff7c78ebf86c411632ec5de593cbf99e915b3d27c58620618eef74545a7a69e26fc1ebc7b9350b67fcad1e2a4c15b0aaf709471743a1597b20d96

            Download Submit

          • \Windows\SysWOW64\pwqhsxsysarnl.exe
            Filesize

            512KB

            MD5

            1cf6c5a7349adfe83e7a4714ca266228

            SHA1

            3c3c7d650864356edefe27882dde64a18f60a409

            SHA256

            5d4633e3a088a688fe4727516e373358ce47714b230b82f9c438a01cfc7096c4

            SHA512

            a4f4ab6056cf8644a6c8207607ea25d6a7016f2d4a0459f123908abd62dd844a4508d0c8f63fa183a22c94a4e7888b4156dcc61f02fa09ae788bce916a7da744

            Download Submit

          • \Windows\SysWOW64\wnkkagoa.exe
            Filesize

            512KB

            MD5

            7fe47a842a8c723c2cd65596ecb726f1

            SHA1

            ddd2f1d0441a2923e5b798857013e108389c544a

            SHA256

            fa49046e5eac98eb16f3c420fa3fe3b4e34e30518aa22d0b5a1f1c8e92c696c0

            SHA512

            d352c776a6c1f5d707fbdd24acc50ea4b29c2fe63e8b677c4bcbbe9d7aa0f56d95aa52410d9a32a43d6a102162d1d5d58455720ece45836e68c2fc9be1a6be31

            Download Submit

          • memory/552-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/552-65-0x00000000713DD000-0x00000000713E8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/552-47-0x00000000713DD000-0x00000000713E8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/552-45-0x000000002FF71000-0x000000002FF72000-memory.dmp

            Filesize

            4KB

            Download

          • memory/552-99-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/552-100-0x00000000713DD000-0x00000000713E8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2208-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download