Overview

overview

10

Static

static

5

f5441e675d...18.exe

windows7-x64

10

f5441e675d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 07:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f5441e675d9e0e6453ec9ecf8cfe8bea_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    f5441e675d9e0e6453ec9ecf8cfe8bea

  • SHA1

    095dd32280f4fb97e439ffc551bcd2ffc3f0a050

  • SHA256

    82d8f7e5b4df88d9743b8ca4a1f2a5473eba9c85316819009be8738be98d8834

  • SHA512

    f26d14ba0c514d14c9e2ec800e1b5a7c91027a034dd13e51cd5b0eb961ccd6244b38e8b9cc95d8fec83277250cfdc4ae96ea8d04cae80d8d32da5cd56e546700

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5441e675d9e0e6453ec9ecf8cfe8bea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f5441e675d9e0e6453ec9ecf8cfe8bea_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\zdrvgfxgun.exe
      zdrvgfxgun.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\SysWOW64\jxrzzour.exe
        C:\Windows\system32\jxrzzour.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2176
    • C:\Windows\SysWOW64\qyjcplnofhxdoap.exe
      qyjcplnofhxdoap.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2552
    • C:\Windows\SysWOW64\jxrzzour.exe
      jxrzzour.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2652
    • C:\Windows\SysWOW64\asykekgbpmzqd.exe
      asykekgbpmzqd.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3044
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1172

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      1559f5962e0b09ade1aa1235e56f1fb7

      SHA1

      71813bd31f21ee4f99f6fdf98a14bf59ba1ec746

      SHA256

      84210009fd4e6cbce32bad650fda456d18ad368bafc6d66cbfe4bf1b22a409be

      SHA512

      b3bfe7e6dcee62d172b9b7fbf5b1ea15d6ec1dec9d1a0f3a41de7d7c2110ebb432bfe8979ec36a6a3085d0a4edd7f105a22ca9a2a69670a37dee61f0cae7b429

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      6619946caa0f6e00e1d17ff3d8177d53

      SHA1

      28238e9b9444eff71b80ea2e23b9fcc79123a551

      SHA256

      f4dfc49e9e5321c49abeb56c026536c3a7ccc51f6bcd5853b1d3242bdc156a35

      SHA512

      9a7ab5adf2c2c037daad1ad4010158370dbd68095b0a7208223a8685188078011d9a04db9f2ea11a0a57c84196ca35103bd7f5b2fa3b859468ce16b9f3400021

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      bbf22c337dd184d056c6533239d62ca1

      SHA1

      558ba198f867d1f09c1b25c2da4989550784e9f3

      SHA256

      84db3196e0199090e9b617842a4f4885057cc7a709c14c7ca903f0bbcb0269db

      SHA512

      132e6d5a01d9222fd41293b855297e9247d8571bfcc5dd160a9ae0610bb6e5961891126b86a1cce2cdec228707af5e5c6daad34bca23a7592d5fc9e4943ae417

      Download Submit

    • C:\Windows\SysWOW64\asykekgbpmzqd.exe
      Filesize

      512KB

      MD5

      7cc22b012683b345e202ed1da055f1e5

      SHA1

      cb2f891a55c184d016df8e38461eba8a89eac813

      SHA256

      8b8c35f666f86057d4b9351479e86a5c5aa9468a757f037a6f8e45d74e2f3a90

      SHA512

      3b7d03160c8246ad3bc848f9836d97f78b090f3a6b6fdb9445861e1f309add59bce47f264745c317eeecc1baeb2aa75ea087cb6cc15ba00310c1cf339763376d

      Download Submit

    • C:\Windows\SysWOW64\jxrzzour.exe
      Filesize

      512KB

      MD5

      b986d2a562e50bbce0fbe9a756653bf5

      SHA1

      ce571c7ce5d9ea68a0ca681ccde5a2e205f399f5

      SHA256

      722825ca46c511ade3f7ea188f6bbc2b9b852a5de6948a6a0556ae84741d4c2b

      SHA512

      411948f2545030d9f8542d31e90ad820579429659211a2402fdea00b4aa7a981cdc469ab32c550f7228e174b597a050e59a99ea1328e5e0c627b48c195f02c89

      Download Submit

    • C:\Windows\SysWOW64\qyjcplnofhxdoap.exe
      Filesize

      512KB

      MD5

      3a2a3530a6d78b64db544c33a84f5994

      SHA1

      764d7f71eecaa9dfed64af06437b25abfe5e705e

      SHA256

      d120dbf65808bbeb3784e18bd961decc6c04c1d1be023cabba62a9248e32b0dc

      SHA512

      dd2800b34860ce58c322aa093edd824ad24f876bd22d5c73eed5ce24924364dc93c04d9284d96053a814e7b5e6b59e95f282e798ddd8c67956505cbf35dea4c5

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\zdrvgfxgun.exe
      Filesize

      512KB

      MD5

      ea3b0399ea8b3f092998ecd51f6b7b13

      SHA1

      b66a4c9db481a858d726df1b25630a4f93223c01

      SHA256

      04d485fdbab086001226d3d626c4f41aa13c45d47fcee6ba0bd303f5340d0980

      SHA512

      f62aee2bfc571313056cb5d7b4e9ba4447e214fc6bb3502c44272ca0a7652020a133cf2d9295c633187bfcf4a6ad0ad0e37b4471803dd7d49b2585781f1a4f1e

      Download Submit

    • memory/1612-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2444-45-0x000000002F6F1000-0x000000002F6F2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2444-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2444-47-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2444-81-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2444-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download