Overview

overview

10

Static

static

5

04542f2677...18.exe

windows7-x64

10

04542f2677...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 04:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04542f267718e0a8555ce33cf08ea44e_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    04542f267718e0a8555ce33cf08ea44e

  • SHA1

    0a387dfbeab37809d90b523fcf7cd2c09f8ae2ba

  • SHA256

    c676c2895844d4715fd167281457e073e535e6045d4bcadd9a7a27398b84de7b

  • SHA512

    ca83799a0ec9e0d0aeae33750e4e4820f2dcc8922c247eafd2ba1abf0d94739407eb4a0bb67d83aba7405a0fc7afad1ef8c919d227d9a3711d7def2c6d8bc0e1

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04542f267718e0a8555ce33cf08ea44e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04542f267718e0a8555ce33cf08ea44e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Windows\SysWOW64\btgxbcuzsy.exe
      btgxbcuzsy.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\SysWOW64\jnqnoqek.exe
        C:\Windows\system32\jnqnoqek.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2480
    • C:\Windows\SysWOW64\aermlnjnpwzvkhb.exe
      aermlnjnpwzvkhb.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5112
    • C:\Windows\SysWOW64\jnqnoqek.exe
      jnqnoqek.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2192
    • C:\Windows\SysWOW64\lfqattgnmuozm.exe
      lfqattgnmuozm.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2612
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2872
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2952

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      982d2e60bd19eaa7e5189738dffbb642

      SHA1

      e323de3624ee37222861e8ab6da5c7fb9b3d9667

      SHA256

      253e1f7995827802738cfc2cea3e65e4f24dc8841488fca4b5747a3f0191f4f6

      SHA512

      1d90c9e6ddfe13129ed6090d2e7a82ff6db7c715f906cac7c193ef84567d61b2e9a6d7ed5a81a4c8bf67d7936e3e3958014eae9d03101e00e00dd44bb233658b

      Download Submit

    • C:\Program Files\WaitTest.doc.exe
      Filesize

      512KB

      MD5

      9b4dd6c556cbc7985392886fca9c5575

      SHA1

      5ad93c2076ac031f083be42d704d5bf5c485a5e3

      SHA256

      5ff7a0f818046dde97be7d76b04ad0d5e23ba37317be45bc5292602d09967532

      SHA512

      80499df3e10dab7832a78a42c8744c2c7ad6d94dfb6928a1c8639124b2fc65e9a5dab9f8ea09b5b567a63bc3873b75457a2d2d74bb871420c6e1aa411d0a4be8

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      239B

      MD5

      12b138a5a40ffb88d1850866bf2959cd

      SHA1

      57001ba2de61329118440de3e9f8a81074cb28a2

      SHA256

      9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

      SHA512

      9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      3KB

      MD5

      527bd5a91b7d45071059b9efd284a356

      SHA1

      7fb534994de2e77456336fd1fcd0ffce1ab07fdb

      SHA256

      e7d0e7eb409b709ed39a856306de51a25a1ba1321eb6097bb4982c5578df50c9

      SHA512

      7a18e0696d13a814aabaf3825e77dd0bb156cdb8fec868a6e120ae0d4856657fd780c45340da11b189bdabecf37d7b7c2eb84511ca57866fdbb51a54af4f96b1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      3KB

      MD5

      703fde0d4ced8d4354431be15dcb5f76

      SHA1

      859bdc4b55459797a766984010d7098c7efd1c24

      SHA256

      aa041d553c167455ef342743016a75a6eba006f00ca3cccb0a42fdcfeb0e4a5a

      SHA512

      22c4dff7c5ffe0a23e3e38c122f98b9978a9e57b7e75ece0308db05373c9e507931d319a9feb83e9b220f4bacb7382b3ab0bed71fe7de3332adf0d686048a91e

      Download Submit

    • C:\Windows\SysWOW64\aermlnjnpwzvkhb.exe
      Filesize

      512KB

      MD5

      0b0bfbb213b3e941ffa48793c411f749

      SHA1

      cc6ac48218f9c4863deb9ea8dca392905d3a5f31

      SHA256

      f03271d4d8dfa7d9dcaa8057c2007b0f30853aecef2b5e80ca2f73b9721adf37

      SHA512

      238fc8140594312c144fe9fad1bc8a689209acd77d4202388860c6f5f16e8b42b0ff9b1fe209a3e8302eda1cf25e5589e9dfa32a7b913c8723226aa09e2b3928

      Download Submit

    • C:\Windows\SysWOW64\btgxbcuzsy.exe
      Filesize

      512KB

      MD5

      7f54dde321107affe7183176cf12e32a

      SHA1

      aa3005c827323d68637bd22d4c38d714dc82cd14

      SHA256

      518e1b5309a4d33cc30f88c4a5843cb0232a3f282d65f76024ad781e674dbb72

      SHA512

      8844767ebb2fbc94554d437317353b7288c71bb34937f292aa1af0a3fee09ad871ff3cc061470d69e1a84a10e383bc5afa981fb3d6b0b5911172823891d3ece4

      Download Submit

    • C:\Windows\SysWOW64\jnqnoqek.exe
      Filesize

      512KB

      MD5

      b8c7246d07e5036ef094d0ec266d07d4

      SHA1

      4aaf04189f82153a2195b2af8e3dff52714c5143

      SHA256

      97abd40104b82712fdc694ad98f69ea03058abe14f028f617367a4468509b7c1

      SHA512

      acada5e34df2ef2673e75c1bf2e2c6f4a9c0719730a70d2177752a2251c7c5053deb05ba7e255dcd746d1bab33591b080a3dd2ae856ffbbf643abc5eeedafa9f

      Download Submit

    • C:\Windows\SysWOW64\lfqattgnmuozm.exe
      Filesize

      512KB

      MD5

      af1c7fa75e660ab2c06a574427e7f64e

      SHA1

      49200150ef5b319edc31c3d7dbb42a24ebc66aca

      SHA256

      647e63ccdb127ade5b6c3f3657ec5bb8bf8b53051029e1b70a3db01b2ca18e6a

      SHA512

      58f458b58163cba066d0a9c32c9dc32c27755eaf3bff977ecb08b346da13f8e07cc44a650edafeb831a92f705f8e7e52ac7e4ff4336fe164d57beb3c55b8f651

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      917f92718947bbf4dc52ee6913387b7f

      SHA1

      c8e7f8b5f55015b162632a31dd343d1f52c305c7

      SHA256

      a57fe8c0dca61ebf51b34307f141de48fa7e71fe6ddc2a7a649dcd7fb63ef1f0

      SHA512

      bbb308dc6bb4067f90eb52400a7b82f05af41155b87bd290126edea53fdab924c8c236257db8c4c0bfb39ef83ffe747fd66ad651055e22cd7add9d959c26d30a

      Download Submit

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      455048992d89a8beca332903d6135530

      SHA1

      f970147115288913fef264e42852878f7a9dce4c

      SHA256

      5f650936dacb9c1e28dd8efe97eda399c3da15c3eff437d0147a9a13b202fe45

      SHA512

      e5a85f2f2d960fa1cceb5070f55016e78eae1f20a828b6d86edd6378f96a9a837ab457a106e284f3e6e18c792b6b255f6d90da7f07a9912ea82fb709f62585db

      Download Submit

    • memory/2872-37-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-41-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-40-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-39-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-38-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-43-0x00007FFE68110000-0x00007FFE68120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-42-0x00007FFE68110000-0x00007FFE68120000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-126-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-127-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-125-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-124-0x00007FFE6A690000-0x00007FFE6A6A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4484-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download