Overview

overview

10

Static

static

5

02820d4548...18.exe

windows7-x64

10

02820d4548...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/04/2024, 05:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    02820d454871f5565ab4df063cc3dc43_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    02820d454871f5565ab4df063cc3dc43

  • SHA1

    31c96aacd2d1148168477ecc87c0d385cf9400da

  • SHA256

    89b84fdc41692863ab5c2c1e81879150512b34d0ba7219494d4b44c17985e6f2

  • SHA512

    cd6117c035f840dd3609f5da459bbd7f2c69f2a64c59f96a904db67ff10c2671e2ae714da2d1242c60919a37779a70226bd409e10d6b066eb33c8665cb4ae7d5

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02820d454871f5565ab4df063cc3dc43_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\02820d454871f5565ab4df063cc3dc43_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\SysWOW64\burltfxlzb.exe
      burltfxlzb.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Windows\SysWOW64\jvvrvrmh.exe
        C:\Windows\system32\jvvrvrmh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2512
    • C:\Windows\SysWOW64\nyyauatwqsqbccc.exe
      nyyauatwqsqbccc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2076
    • C:\Windows\SysWOW64\jvvrvrmh.exe
      jvvrvrmh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2524
    • C:\Windows\SysWOW64\vslkjajdlryzs.exe
      vslkjajdlryzs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2588
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1056

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            c6de71e6d69ec87d34134c2f26b4e964

            SHA1

            d306d14860589524dc2a6a5e9b61514317bfaee1

            SHA256

            b3c9597b61ec1f87b2118e6d1de4770c32b37d776116465d60a8b6677676e25f

            SHA512

            3dd2cddcb85a545400f878e5ee8a160580568c856878095b3f86837fb3e072b36ace8599fa2be9e30a0b40bfdf123d482c7937cc19141557421d1a5fecfda000

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            2ebb958e351696f328b142dcf9932baa

            SHA1

            b7cc7f141d8f4eb908c137b89738fa62352a74ce

            SHA256

            91470c35e625c67ca9f4d7c25546c72fb84ce79de929ba393963deaef01cd85b

            SHA512

            71d6af1bf5f9c282b1c12279dc7cc5a697d309b5e7670046a896cac0cc3ef8b041d29c53cd9e583abaeaa2533b77064de5c3421d6e15e073a3f48aa07edf2145

            Download Submit

          • C:\Users\Admin\Downloads\UnblockMeasure.doc.exe
            Filesize

            512KB

            MD5

            1c3fbb32d63fc85df7237fb9c631aaef

            SHA1

            9e75b8618573794173eacf447a6f6e0e81c0f1d4

            SHA256

            6da789e504e8f2c9cb87e18163627c3df9cfd1fe5b66e16e3e2cc352d6efc00f

            SHA512

            97ff0741358bbe18fef79d555765212936c0f53fa85ab475ab675480c1f5b5825eab8345a416ee04709517bb526da9b9923ed0ee6be7e36d988dbbbb0c8d1fa1

            Download Submit

          • C:\Windows\SysWOW64\nyyauatwqsqbccc.exe
            Filesize

            512KB

            MD5

            9ff2e2a3e530cf02a295f4d3a600274f

            SHA1

            e0cb548d25de19c9340e25a5c595c5027edf6342

            SHA256

            a635f6e5469dbe925790bd8d3931eeed9b850290a96723fee4f1bdcfad2bee67

            SHA512

            b3c917d8121801f47879df177aa559d58eb1445d6e16f663419381fc3ad94c7d752672c9c2e1c3df7462ca4eb85f09d6fe7e92e75bd0f9a360748fd70ee98b1b

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\burltfxlzb.exe
            Filesize

            512KB

            MD5

            633bdd750dc8cf92e866e8cc929dbdc7

            SHA1

            e0ba36592904648bb0233cca5fd7e7171d9d6ab3

            SHA256

            b5d9dcfb1d0fc1176007020c77713e2cc9394a4c8bf722a1b15e2ad3c82b2c13

            SHA512

            390867d79d9f1488638f2970872dab03c7e48d7241474a284d225d06535a7f8219a1f1b316d4b5c7ca5de0482893cd1f32d48f4821d752e105031c064133726e

            Download Submit

          • \Windows\SysWOW64\jvvrvrmh.exe
            Filesize

            512KB

            MD5

            bfb12dd52415ea23b2090206bce82654

            SHA1

            e900f73f1601f36b6ad2076b83d13e7959cf6fce

            SHA256

            7c35d90fdc3ac7380c8080f970ec6db5958518adb1b8c5c3b969c509c118e2f9

            SHA512

            7068e3328dfb25760c595cc8e4a7dbd893adc83527eddab3476e3c8b601898cfd5999545a2fd48659dac95118b494deb199b4220e9b7d0ac7c10a724e8c3e7dc

            Download Submit

          • \Windows\SysWOW64\vslkjajdlryzs.exe
            Filesize

            512KB

            MD5

            8a77c15cc90bab245eb178a00c4d13a6

            SHA1

            124970831200c3f9b4be0d223593b1b4c521ed86

            SHA256

            953de8e139e260b418eb85649ec3cc3f598c8b934bb16a053937ec53170e9ee7

            SHA512

            b7087f4506afba52fa7338965bdaf9ce12363f0d51a5e370ca5384dd4b45b620dce6dac9c033747300fb568e2be6ea616c751d5463f3769bd43655c211999ece

            Download Submit

          • memory/2304-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2764-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2764-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download