Analysis
-
max time kernel
149s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28-04-2024 23:18
General
-
Target
064ac1b4428c3448dc84ee62a16415cf_JaffaCakes118.exe
-
Size
512KB
-
MD5
064ac1b4428c3448dc84ee62a16415cf
-
SHA1
ff8ea669d8f96a265f53f995f0e827e644ca1c87
-
SHA256
3a7d4763e1c63b829e6a19aa52cd435009b01a180153eb68a91fde95f565f487
-
SHA512
78eb2f4845f8eeeabd73d5b2610ec3f9b01aa885ecadbb5244e242efb953357cc8a8c3d688fbe6310d18b24b9776b45f74d36734fda23afb1167b735ec5856d7
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\064ac1b4428c3448dc84ee62a16415cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\064ac1b4428c3448dc84ee62a16415cf_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\owhwsbixuo.exeowhwsbixuo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\jdrexxye.exeC:\Windows\system32\jdrexxye.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\wmgneggnnvqqwpt.exewmgneggnnvqqwpt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\jdrexxye.exejdrexxye.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\opahkgtphkydq.exeopahkgtphkydq.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD52b1fb48a80cda20cc8444e373ab98308
SHA17e439ab18cb7bd844632a2d9fb6ed04081b43b50
SHA256e1a2275cbbc766cfe630e013c82c11d8520c041109b14c8198ec928fdb8dd35f
SHA512fad72db37c66b7d9968597714a2348c583602f01f3c59f99ef18c107dc531254af303dc86022561a923e6405434123be2a5ef57782938f2569630e2641c27cb0
-
Filesize
512KB
MD503649923597f26dcf159603798375e6f
SHA1696e808cd2f7dcae069e8acac7410cf66b3bbbcc
SHA256f659a128c8e3d6f1449dd34884c794aab9b0e913ba0c033d2e8af7753fb45e2b
SHA51271461ceb1fb092fc05604f3ab6f8740dc2f288d7544076d8c3cd33e3771ae8a64751d82b360c625edc63064cfb92fcae6af78cc60eb3ad3e21d0fbf4924301ef
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD59220ddd71846a5692fd99a7c53f564b1
SHA1175f5b62d2311599b1898cea2ee023c8c9b08281
SHA256aeee2578a960dce3e6d6e1f72b1f99d2847c273adbca0b5f44cca49fd370a4f8
SHA5125c29196bcb9fd5d264aea3ad854fbfb984e4673c0ff3ace928df0e684b007079b90b5ef634055ff86ec39dd10ceb91e59912d40f635b4d5c4c023bbe93b847f6
-
Filesize
3KB
MD52909949e9e90c5446d18ac9682becaf1
SHA106b764e03253631cf223ede6be077f13aab48dbd
SHA2566e376f04f6edf1926daccd496dc40734acd2704388a1df6b8986e3f81e066e96
SHA51299306a4de8fe3ee74b46b20d015e1c6fff33ab5ddbb8026772ea569fa48845cb0c23d64b05e9223da456e93de80cab0af8c8c49864267edd830848cef21fd7f9
-
Filesize
512KB
MD53c90da35c5fab53222aec9bedce5e08c
SHA19ef47a94e18160ffffc89764a63b917aa8e37e0f
SHA256c35445ff3c5759f135aae411239e3e0b2884912941f1545fd6665ff8fc27fb09
SHA512f4438f53e21133bfdadca9e0d0b897524a76e5a4894da21e6607eea656641e71c2332301ca59b95b9ad0b992fa68a563a7369deab3251cc287a3ba6e1d36b596
-
Filesize
512KB
MD59bc531efe3a1ffa7a63782fcc20942a2
SHA16ca2becbaba1f3a04e7b2d86fe2754b588a72b79
SHA2563a830b7071d625155a2757a5995f0403d8b7ed30ec73216ad63f1748d30be1d9
SHA5122210e5b3b680bf704051074c44fd59bf2df0f65a26a04eba8ad62160c64d175023171c08d72c93e5b8176ce289b2df5af2534993d753d3eea60347a9f2f55a1f
-
Filesize
512KB
MD57dfdf15c1023d384880891899bba1173
SHA1a548ef371e7c88c8c50c11b7888c862d53654fa5
SHA256f6496d1a0484da319c83d6faea302e45edd4a9f9fbb7291595397f9ba930c9a9
SHA51219784b013c37238ee54c06565cd35115fe854990da103022376fc26bf394346f78509ca6d577e4c7ec7bb64ce2f6b112d8bc65b7c7174be2a8d014b50a899e2d
-
Filesize
512KB
MD5821ad7239bdca1f8626a9c9961cb7399
SHA1f346ab85e99d5b1d6d0b54d0da1d6e371475cffb
SHA25621d8a70287ed55f7759a03c72a63408a3240f11da6051922f396aa96ba91ff96
SHA5124edb53ee5efa0851993d40aa6612e2a8e8d6b4e7a9337cfd489ef08ee166194f404e18a0a70b5974c50c0f719322045f7a3f22a139a48ac144445b972ca306f4
-
Filesize
512KB
MD58882b94186e138cddaaef823483bc269
SHA104298749c68acca67a06f2fdceb06b95b3b604d6
SHA256f1c4a4b63cfaa039caee932f430ea9d1c690ecf8890cebeb20bd114dcaa6adb5
SHA512a2cdd2ac990c291faa444da976e233549386002d405a69d3c55d87145380801c4007d5c18bd910abc3aa874a5fee9f22a5ad18f333bbf5058fc13577e42c7750
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5357855c1dd664075140ad78622ea9a4b
SHA1b2c4be03948d8413f33401235c626ea58421be79
SHA256410facc0fc089f0fe885d94858a7aead652998d5bc79091e9fc497e9b3327605
SHA512ad46010178600731d68242661a7d4f5e8c7c1b208c31bc196472ba559a942807e4c43008c08fcb5145acd760a774e8368585c620d20fd6b8c56113a74414024b
-
Filesize
512KB
MD56e633f114338cc2bd73095efcac13eeb
SHA162a6550247389323a967a6c6ceb5883c086d325b
SHA256abc4473a693f7e064cc7c0a135431205e8e29242c27ec235b8d0431ff2461191
SHA5127e4e94e57670e43dfe911453658bae47f32f1db97906b8459c5da1f58cc3d95099869e1769d310038b23d705e07e0d78cebaace43ee8582c975f0379f42f8e76
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB