Overview

overview

10

Static

static

5

0558a4458f...18.exe

windows7-x64

10

0558a4458f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 13:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0558a4458f2ae7f8cdb4374bcb5d59c3_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    0558a4458f2ae7f8cdb4374bcb5d59c3

  • SHA1

    35fef0d8e3cabbab1e0a637aa59aeb8a03025f25

  • SHA256

    0130c611831a1d1fc13740cd600d7eeb505fac3b1c6b1de09415b2655763d57d

  • SHA512

    0070f850a651942d963dba1ae883433c949463c3243d21b75e304589af3a9fd45739566decd898f14388a9ff7e553a1301fff0395dda68c3ea7d3e1ff509ecfb

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0558a4458f2ae7f8cdb4374bcb5d59c3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0558a4458f2ae7f8cdb4374bcb5d59c3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Windows\SysWOW64\wlbswcznug.exe
      wlbswcznug.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\wzwytclq.exe
        C:\Windows\system32\wzwytclq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2436
    • C:\Windows\SysWOW64\vmetczsodewqlke.exe
      vmetczsodewqlke.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2544
    • C:\Windows\SysWOW64\wzwytclq.exe
      wzwytclq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2552
    • C:\Windows\SysWOW64\thqqyyhxbemrf.exe
      thqqyyhxbemrf.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2464
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\SuspendCompare.doc.exe
      Filesize

      512KB

      MD5

      7e79a704dd38dafaacdb5cf838f53140

      SHA1

      b6c141df8a6ec4842100acb1f4df8fab73ca2e39

      SHA256

      9600b4ecd82d3e26f2c39287668dd7bc07adde2b3550d4b7fd435c82c2b57f0b

      SHA512

      76c6e16105c8f2ab2c9cc6d615a2caf378332cde43abde3d90f75b2c4b6a1fccf22329999ae1da6b7085c9381692fa3eb842f0433cb511aa214210189081923c

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      d43f191124ed1f12e9a3555f47b505ab

      SHA1

      11f39489b1106c3ca48f85477d758110b63ea2fa

      SHA256

      87af2a9c9c0618a0621b7faeb38699e010d60235a7f199bee0b33a8836e603e3

      SHA512

      1d3e7ebb5b99e4150b63bd4be79fb1eafe59f3ca38cf9ef46538b344457f98406db86705aff66e501124c5c32b3be51e2ee6d167a69eaed381078e90868a4fff

      Download Submit
    • C:\Windows\SysWOW64\vmetczsodewqlke.exe
      Filesize

      512KB

      MD5

      d0e385a099fc20646cf4ae2a5c7d3aab

      SHA1

      71c9bf3d302e99d78cb61cb6018e08b821ab5530

      SHA256

      b0989391e8c4b5d4861eae1ca769e5665bcb8de73d0885744e58309b4e325d0a

      SHA512

      0d3d4729084a885a687eddaf3de64bd670e44aca1a021da562bcc6080dce08cc1f974b812403fb4633840602e1cd77cdb6fd7e2611437e95488c05ecd12139da

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • \Windows\SysWOW64\thqqyyhxbemrf.exe
      Filesize

      512KB

      MD5

      0d46073c41a37f8b3a657af0b2b35aea

      SHA1

      c7e1689b99da2044fb601b9780a6911df3294de3

      SHA256

      969c6f3ad0b84a9684fd0b62b6d28ee3943a101a00d06f2c99f7bddb449fada4

      SHA512

      1c2f6299ee0eb0cd28e96c31cfc101427c34f240394b66e61a38231ac69bee4d1b86a30e3f84a05e72e752b71407ffef6dbacf9808571ae9264bd1a592862fac

      Download Submit
    • \Windows\SysWOW64\wlbswcznug.exe
      Filesize

      512KB

      MD5

      cab3d715cea12b454f0e2b77deaaef04

      SHA1

      56d9fb71df9a7c82d49c3d205219a1f2ca03d09a

      SHA256

      a4f2f7bfe262fe7103edc17db0e756e6c90ad279cb0c42fd61f46a08b5ac9034

      SHA512

      dc5717ed82b64730a2b11d2bd99c015b6f059d8b6e462ec20e7f765052197cf8ea258e669b0b7efcfe28cf3da0d29ad9265f3a06d2874f7490f4c46deb72d46f

      Download Submit
    • \Windows\SysWOW64\wzwytclq.exe
      Filesize

      512KB

      MD5

      fd2c6ca84f1a2ac37f74fc078a1770f0

      SHA1

      e39cb5e602285e096cbbe32ed3cbaf8f9e66a270

      SHA256

      096be0bad71ce2408031d2155def3564beaff85947b7c968b2a9d3ad1223ad4f

      SHA512

      f199b73e78d2e06a281e38c0cc7bfc93d7021d90f198a5d56a69a8c6b53c9afdc896edc034c0e554315107ded5e53753c2943bf1d039c870710cc55b7b9def6c

      Download Submit
    • memory/2192-45-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2192-102-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2616-0-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download