Overview

overview

10

Static

static

5

05f1a6f2b3...18.exe

windows7-x64

10

05f1a6f2b3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 19:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05f1a6f2b37aab8a86235cf3dfb4d535_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    05f1a6f2b37aab8a86235cf3dfb4d535

  • SHA1

    edb8e86bbc0aa9e5bdc25899772b381abb31bc99

  • SHA256

    d4e6a7f307f0f6b685dd293054dd2f6e51a0acaf7f59fb8c577a886b407b30a2

  • SHA512

    f57605db01d72994b926c1aeb011591fcbe9635799b34425a1f8e7db0f39ffc5a5a602bf099acb21d6295cc43018f489c049a891019e3b538f4e80ef4cfc9183

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05f1a6f2b37aab8a86235cf3dfb4d535_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\05f1a6f2b37aab8a86235cf3dfb4d535_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\xrikfexfpo.exe
      xrikfexfpo.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\SysWOW64\pfvfcwnp.exe
        C:\Windows\system32\pfvfcwnp.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4468
    • C:\Windows\SysWOW64\ybnxoashtthulvf.exe
      ybnxoashtthulvf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4188
    • C:\Windows\SysWOW64\pfvfcwnp.exe
      pfvfcwnp.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3788
    • C:\Windows\SysWOW64\joqjihhxqlgef.exe
      joqjihhxqlgef.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3016
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    715c1dced598c78289076c3470338039

    SHA1

    b7d9b546f359d749f8b5fcff754007e82f11e901

    SHA256

    a0608ecf0cf753044546616d770f41bb602be2205699fe2e7f32c745e0e551a6

    SHA512

    28aec6063d39068118a4d5314f085fd86ddeee8d8a797d7552c920065e1607ebb9af287d030e458ffd37b1849c76f778bfd279efd92b3f9303aeef06a78ad461

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    eb5405d7081289db2a265e15ea2c6f7b

    SHA1

    67639878176a6ca093dd732558445f24f8e0b95b

    SHA256

    d2366abd3b380bcbc979bc7308788504175beac9f59d89a230164de88c65b589

    SHA512

    3857707c62a7743e7184b6fc2b69c1fb9ef5f1738aa06b5aadb1b4cd0479a3cb6cd1e9b094bd452476ed69615a5b509129411ba9fa80280bf053c5855c0addea

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    557e218b0e20780b3cd82e427f86aa29

    SHA1

    63f5b2cb9bf3348d1553bec38764a8fb6a78b9aa

    SHA256

    3fc1be08067e63dd4be396fedda4558fa1b73824b18ab71fee42fece19c402df

    SHA512

    baa81f48536d3f518652d81615825b086a0d78f6aa2af4b08f1537fe75929c2cd275a14efd4f3f74786c29eca9b94000cdac8cef23389f6c670d3908455fc79c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    9f8aa0b59e4e96108d3109cfb1a41400

    SHA1

    ed69340b8d75c0a8aed333b2460f92fcc1b03bac

    SHA256

    61efc757d7c99b64d67d51c0e9d1eeaad78e4b7c9b325bea3d2d7de1772f6ec1

    SHA512

    2835a5b0b972859eef64abca71f5d17467b63fd4020b868605097d711c69dd68a8f03957ff022dc33716b9c10a627bd8f50f57c6bfa598c0384c0dd9c7fab842

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    e424a54bbafc04f04c21b5386f8bfc24

    SHA1

    932fbc3494b7e373e51805db1be7494496b0257c

    SHA256

    6ff7597e5779bc0c71e1961482cfb11f901dbb941d1a49c5c4284f607357a433

    SHA512

    1ce6ae331a413b7e6ebd9523a037796c21bd43417fb2893ea9edfbe6ee54db34d092c8d1d3c6920a328215c7c7ea9cb5f696849bfea4321eb36bf11b67280b51

    Download Submit

  • C:\Windows\SysWOW64\joqjihhxqlgef.exe
    Filesize

    512KB

    MD5

    7fbf67a9e6dc2f913094fc2180bcf0b9

    SHA1

    d068509e37126e9e2b8024cfa86b41870d693d58

    SHA256

    290f05015aae7535ce16cfc997713ccc41ae030ff917453c4fd2383ebaec4bdc

    SHA512

    993880fd1811dce414ec573cde2dc066294cd252c9672f92b5bcc430d02d864c6d749fd2e3b974177e8a23c2553852637e5e5aa6d5599a1fba4ff565687dc414

    Download Submit

  • C:\Windows\SysWOW64\pfvfcwnp.exe
    Filesize

    512KB

    MD5

    9b8ee0b5ddc1ffb03e752ba2f4e4f889

    SHA1

    195c7be12b76e2fbf79bdfe5ff3696377b304dc9

    SHA256

    5afbaa0e45cfb4c0b4c10a04f82bcc6e43153f7a061f3542f1518f54b4e35d31

    SHA512

    b641b46dfbca1de245e0b128633ba91a2d0ac179c229715c6f4e1ce03bee17ad048db206b79e0444ba2b6e84304a74c9563a3deaa8cf730dee943faa7b4d73c9

    Download Submit

  • C:\Windows\SysWOW64\xrikfexfpo.exe
    Filesize

    512KB

    MD5

    f5c895adf7e2de2b1a0c1d5c297c3078

    SHA1

    c3fca0ce367836264ffc9758b650258f1f34c1a9

    SHA256

    f3dd382b4b8f5b55ab2bbf86adeb89b7ebb92614c778ebadd0af5e03ba79a263

    SHA512

    9ec80956b7693f4c9f52b61c8dedc3911080146e9a36057c74c9d144a472509c130dc6c21707bc3962af923ee043d41410b704eb9962c3daf8dc6c4b01d1760f

    Download Submit

  • C:\Windows\SysWOW64\ybnxoashtthulvf.exe
    Filesize

    512KB

    MD5

    08efe140cafc902abc265f5e31e9738b

    SHA1

    3b80933d669097f0741f1f0501a0a36cd5496491

    SHA256

    92f71ddb5cfa88c186e113ac2c6c67e3c7e8eb280f6ca18109697fb2a8948bb0

    SHA512

    de055424995f39a06d31c5d2fdba0ed4da91cf082fb67c2f1d09efb74d36a2e3efba46a856cd3da4ad702de80a082ac909884e56be13bd794d801b37b07eac45

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    6d14163625d3dfbde36c12937a292495

    SHA1

    3dda1c074f346169b3f28176a85c1c38e1f81fd7

    SHA256

    870baa2671ad911c9bae51c028baa7e41a4593be26848a0e95161f84c69ad40f

    SHA512

    2cb08d45f09b12ea59ee064b75a73b9bf9006bb5b70b789821d67a4c70a56371487fa9d839cbc974938278d7342bdba28c26ce21bc5b6465a359e134ebe057ed

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    ccde7f5190f113e77caf61a9702307ba

    SHA1

    9565faad9694f5b5104024edd40786acd090d377

    SHA256

    818a87d103fbc85a2c1049965c202597ce68da3619ec7f424d3cb8d48a0a02b1

    SHA512

    1f2d3aef009041e1679b843892a78bd64145d4db172039c0c00bc44652fca554f6ce816e7bcf8a70ca896061add5f4d2e816da8ba2d49538f18b426b72c30d38

    Download Submit

  • memory/1928-35-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-39-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-36-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-38-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-37-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-43-0x00007FF969A30000-0x00007FF969A40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-40-0x00007FF969A30000-0x00007FF969A40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-107-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-108-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-109-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1928-106-0x00007FF96BC30000-0x00007FF96BC40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1960-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download