Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28-04-2024 12:19
General
-
Target
052cd8295dd18cb07514df0393987814_JaffaCakes118.exe
-
Size
512KB
-
MD5
052cd8295dd18cb07514df0393987814
-
SHA1
50cd9381619a473dcba95f242b15830983b56a83
-
SHA256
b50841254e526bacc72fde6332d1f40651e6f78b1f9551b5cbfaef08b64fb505
-
SHA512
7497dd910eeb92cfcbaa75f30a2434203108813be51e6a499c6e0b5bfac1addf2610b1d05ce18ffb300cad414f24af312654684bcb4b9fee6efb4d818bf427bb
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\052cd8295dd18cb07514df0393987814_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\052cd8295dd18cb07514df0393987814_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\oduibtrskg.exeoduibtrskg.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\kgszcxhw.exeC:\Windows\system32\kgszcxhw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\hbrkdtoyxqbjwnr.exehbrkdtoyxqbjwnr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\kgszcxhw.exekgszcxhw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\plncwgzgufirg.exeplncwgzgufirg.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5135384e7b26f7d2c4d7a5b12a5ed7381
SHA1f94b3c857e2b044076b47bf6780521c1aec6c204
SHA256061c08d94604d9ac7cbe4d4416723672821453bc81a58f118ab3f5ad5c3a11ab
SHA51281b83ff103a21b8239f0bff073bb861facb9b4d8ef717ba08571d39f1f6be2ecd7fd3e6b34c672a4e5e615a8d3217a94759d7d32830d075a74985e664a5acce5
-
Filesize
512KB
MD5304a19db8849b72eeadf9fd0569f2179
SHA1b50844c36b09063049ef728254c2983d45a87460
SHA2565154149d74db9ad67b6f3cca44f9212aca3306a7531e6aafd9b890ef3c1fb129
SHA5127f4e66fc818c1c5a6dbdf706ed5b573c0fecf85eb40845e519220c2db6fa29dc385787332e47144fe64c8ae50ae3f37f0efc7afacd28c05eb74af786416fb67f
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD500c0e08b55b287feee769fa74d23cc73
SHA1d4d2cd18e4ce5d22053ab09658c61146f9df6668
SHA2568ccb4e8eeddcd996ca50a1fabfaf71a924113ada3d8006f374141225e0e34427
SHA512d2241c639fd522680bec25f22dda88376dd52637ec3a959f1629fe5d0dbc22fbcc6df92772fbb4c51f4fd18fed3784b3d5e1ea720e84ddf7617b4db4f9ef2040
-
Filesize
3KB
MD57cc57792b57f5ab106cbde5165fbc320
SHA1e93718df9b4f7bf943ea7f6c6d7b9e0a2988c016
SHA2563f8da4b3d484a6575e8ea80000f1e12bfbe330c61afe63e63dd8771fb9fe31f4
SHA5125b6696e9cae40b3fafdc5814f53325fcc485f40abf01022213fb786747f684b4cd744943392cc41f4d16793f18f9e4f88a55161e5cf1d43d783e82711bc3a9b6
-
Filesize
512KB
MD5b7568369ad0dcb285590c3ec070a49d5
SHA1b002a39f4afc41a810aab2cfe95c872fcbf92b86
SHA256bf51497b3d51b7db7a89490de4362fd93812a0ffafdd5394994b4547ff19a858
SHA512b0cd64ef41c37ab97dfba721258846391cb0420127447da67b2df1d8957b296d373c4f937705dfa2b68b2522122c455452cc53750f44c0c672a4b81568b0360a
-
Filesize
512KB
MD57f7e53d9ff0df1b0869c0bcb12f4ea9b
SHA1b62746d446b377049a4c714852b8ff983ebad6d5
SHA2567469ff9e37e05ad319258178ed200488d716d50f76543bf05dd4389a1d498dec
SHA5120bc511ce68f8bac9814da78db41c306981eb924eca7bea7b6c8d190fd25cdb55664dd3d6e6df9cbb90eb3030db95d0370dd60eccbd032aebe256781678557aaa
-
Filesize
512KB
MD592c96695f31daad44c384709dfa458d9
SHA182d7d687d1fbf6e09cd04fc58945f9f055864b57
SHA256597e5ff0b122776484d0fdf4a1eb85800fa0d086e6a88a587bf0f96cec96d4f2
SHA512a579ed6081029bca9b63bf51302413346607e3f6a2e870142acfe7c910c66a5eb88ec5b5d25429510227929893c14ac79d236245081e9f1c09855485507ee48d
-
Filesize
512KB
MD57c60b6eea3c25440fae21d6628bf5b20
SHA1c032dc8a3b65d4097d47e45b4a0ed78455a66e8b
SHA256151fd3d18dbeb85ab4080036139115f12b529d3a95e86bc42084ff279204c97f
SHA51239720013d850289107cf14ca16fda0b3d0c338754c7b6b744ea0731b56ae7b7721e2a10b7adac0686b588b238531dd437efce8b5220ea35c6f94633114d639e1
-
Filesize
512KB
MD539b5e22ed99b24697ee8388b283411f8
SHA18fb35e70f6ba28b0602a12d5c67281a9ef497d2e
SHA256d44656372c515bdb96c2a26fb6e5e3c27f63179536f1cb55e05c3d5cac8b8afe
SHA512f105cfc7c0f66813b10296b672f18cd537e2d58abb2623b7c339a2a906ed41c7dd078a10ed0a8016e490ad369c4efcf79ed9f71ad0ac5ca752f230a4e5755158
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5a44b7405516d15f6010b94c443ce4436
SHA1c8c8c41c2f4727f70c0ebfcf7e3594344aae97f2
SHA2568e6d3dca16b30894f85ead572516f92633693a3ba4b0c1f74de78ca204cea354
SHA512077d01c28d46693c8b3fb745882088130732a901526798a2d7eff56d08d2fa650cb175adebcb0ba575f470d8086f467c8b31e8627a77a07b98f693803593f777
-
Filesize
512KB
MD55c0446684ce17c2b25d9d131c564dff4
SHA1dcf84176081fdd3bdca73173e37f16965f2a4fcd
SHA2568e8152b91c8324ab5b729b2c77ca56b93181d0ecd921795b23b203641ef242cd
SHA5128d158f6ce9f3b3529ea7378eaac6ead41acdd08f41349147f06e1d76f98e8fbe0e1376a2e45f1b953b42b38366e6a1f9fdc0dd68b25dd1647fbe16f7ee9eaca1
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB