Overview

overview

10

Static

static

5

fa508b3bf1...18.exe

windows7-x64

10

fa508b3bf1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-04-2024 12:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa508b3bf1dd57114caa829fdf6986fd_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    fa508b3bf1dd57114caa829fdf6986fd

  • SHA1

    4ad0ef98787a81827ae6726ec6ae320a0eae50c6

  • SHA256

    3387971ef4a52d243b2f85705ca685deccc9dc210c800a314ea4fa902b7f829a

  • SHA512

    34b4af36896aa3db6a697c6550004a7e897f358f0ef95cd20d3896f7a292014582ee131374ffa7357e23df7a1f4362a05c4cd8e81d4af67372a4b7627536c849

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa508b3bf1dd57114caa829fdf6986fd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa508b3bf1dd57114caa829fdf6986fd_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Windows\SysWOW64\xjpamdjiqe.exe
      xjpamdjiqe.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\waunzsep.exe
        C:\Windows\system32\waunzsep.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3032
    • C:\Windows\SysWOW64\hhtjslikchazdml.exe
      hhtjslikchazdml.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c echgtojwammrb.exe
        3⤵
          PID:2592
      • C:\Windows\SysWOW64\waunzsep.exe
        waunzsep.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2640
      • C:\Windows\SysWOW64\echgtojwammrb.exe
        echgtojwammrb.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3064
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2484
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:2692

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
        Filesize

        512KB

        MD5

        1d7f21015e12ce95909e35782d6329c0

        SHA1

        03229857a0ff73c958b5cf305b9904943c0ea50a

        SHA256

        9b381dc57b19414859ef294816140c651283b6401bbdc37abf1d70534bcbec52

        SHA512

        5a1018f6ae5b42f89d137cee03703f21c291d036d799431b9de5e291612fea4e0bcec5c63b9a5f0699cb715b57fb682cf549aa802dcc0b7b79b48bbf98b3441e

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
        Filesize

        20KB

        MD5

        1c1c2b853126fbfbc3b6b2dc5998ae66

        SHA1

        2ce8a95588351374749563d73a67a82a31729fa6

        SHA256

        a9c9030e8da2d8caa88a91c6535835ca52e87e64c87d6bf23b0d890df302c17d

        SHA512

        c6649e3d7d8f9475dbf42d059e15d6dcdcd2e7d36539a91445b3c567a717c5b9e40c5d5f5f07f9a61373c85361f85900d5c98c7a88a5dbe19def5d5af2e90986

        Download Submit

      • C:\Windows\SysWOW64\echgtojwammrb.exe
        Filesize

        512KB

        MD5

        2c2722fce192701d5ce70bfb8ac3bb48

        SHA1

        02479fba467586ac381b84c350c33d1ca421b08f

        SHA256

        295d49aead07b79c830d835ea5a91fdc4fd79f49bc25b4ed1f4e812088e03d60

        SHA512

        916f5869b9395aecb1e94111061787330eb2146c3aab36b08120d1704185584d7b407d419ba4dc508a2263e3c87d7cf1b4e82bea679fd7e57c38db73bf2874d3

        Download Submit

      • C:\Windows\SysWOW64\hhtjslikchazdml.exe
        Filesize

        512KB

        MD5

        c9b201cb5643edc70d0f7359527eaeae

        SHA1

        4511700c0dc77a546f1f49267fc61e21c462848f

        SHA256

        2ba5098255f0dcf318c3d8ab0bf49aa30b99ae4a633b419b1baa33fe75fc51fb

        SHA512

        a831a9e0bedc551b74428538e123c9e1ec122e8c0c4cfe6b5d7308e430620422693280df0f6a300a131ee41ea63edc0a2af45f7afe8366090532d9f1b957449f

        Download Submit

      • C:\Windows\SysWOW64\waunzsep.exe
        Filesize

        512KB

        MD5

        071790685aa20cbbd50902696d610202

        SHA1

        2eb658457e1097cb65ca0fdd40432a3771068146

        SHA256

        66002fb3d6bcc3148e352593e06acd3af258d4bc3f2be850def21d6d9178d532

        SHA512

        cfb4bafcebad43b91f835e8d7bffcf8cea258881073e56a0e60cf2f6f7b1a29c786b27b23820c2337ace459c9260fab6ebc3e89f445e857336bb197a98bc0631

        Download Submit

      • C:\Windows\mydoc.rtf
        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        Download Submit

      • \Windows\SysWOW64\xjpamdjiqe.exe
        Filesize

        512KB

        MD5

        268f0cd3a91acf59607cd9a5e2d960c4

        SHA1

        acb4b89dd44c9b84724f66970fd0d11e59629104

        SHA256

        a2d96f40ff656e334308e122d2f6f0354eece6ffff0eb9ff0f1af15c2089d684

        SHA512

        573c5b96b18a90d14e298bc27e3b06525835b53d73286894e42632f29f8496a1535513905f83459bd6e91ad102e28ada947e64bc674c97b1b3021b8aa86d3eb6

        Download Submit

      • memory/2484-45-0x000000002F581000-0x000000002F582000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2484-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2484-47-0x000000007198D000-0x0000000071998000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2484-80-0x000000007198D000-0x0000000071998000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2484-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3024-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB

        Download