Overview

overview

10

Static

static

5

0615df66b5...18.exe

windows7-x64

10

0615df66b5...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 21:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0615df66b5bf1fd4631aac4079401c4d_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    0615df66b5bf1fd4631aac4079401c4d

  • SHA1

    5eb69e6b9e32858726084ba2320d7f111a139bd2

  • SHA256

    3cda2b5730b6e58b1dad0481f94a500899f349341745d4f48bf09b1e421dbf4b

  • SHA512

    1b8551463bc37c6be34fefcf9cb72d2d5624e042234e0805845b9edb135de887067bc6751739942716d4e1a2ff6ec633f06b93dc28a3b1cb95138df6e30e3ad9

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0615df66b5bf1fd4631aac4079401c4d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0615df66b5bf1fd4631aac4079401c4d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\SysWOW64\eajcavxyca.exe
      eajcavxyca.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Windows\SysWOW64\hhmnkjyi.exe
        C:\Windows\system32\hhmnkjyi.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2016
    • C:\Windows\SysWOW64\prqddrtjqdifjxi.exe
      prqddrtjqdifjxi.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3120
    • C:\Windows\SysWOW64\hhmnkjyi.exe
      hhmnkjyi.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4164
    • C:\Windows\SysWOW64\ivieljwnxkkyi.exe
      ivieljwnxkkyi.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1876
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:5036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    11e01a21c779f4c5079efb32e4b53158

    SHA1

    c75f4e34c2d13a8f09d38bc4eddaf3faeeb2fff3

    SHA256

    54e50c0e94605447b3a36bab8f4caf5e82b79109e66e10422b096bffcea494bb

    SHA512

    f16e09a2d8c98d49d1fd70b815b23b6a5a01a45b6ea62d77df8d5d64e77c3976aa46aaa4258e0a2748541677a5c621634117f1938b8230c74a9758ff7058b7cf

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    00bf1fcfa29e318e4e14e1d72971d6c6

    SHA1

    263f31bf6a30f55668f932f9b24cfb46a1f4e2fe

    SHA256

    71f8cd2b9d9c348c5bfb18a9badc8504930c6e76a9c2e2fcc7664441726db2d3

    SHA512

    3007f0f282cec6cbc2ef64d1bfc8217ab5f9a736ec189f061970557da5411947dc295e6068835b1c44b9c7e13af59fa9250841ddcb3dc53c4c3b2ef987c734d4

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    247B

    MD5

    1b529425a37b1334b8b33ebd890269a4

    SHA1

    84768e6475b45e3431d5dd62968dde9b92bcb799

    SHA256

    774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440

    SHA512

    8d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    b455f8324063862ec382afd41c57553e

    SHA1

    5f52917de8d44deba5735497ead44080d2bb3bc2

    SHA256

    ad5a6da5dec16c6041a93cdf02ee041ac140be2b1ccc0df294e506a0b05f8a2e

    SHA512

    4ed51acb36a0c991fa7212024ecaf5afe87b92360fb0f7157c4230126ef7eecfccb578bff8a37da41e1b91107b0b4799738a0569f237bb7f90d55a4fd69e8f6a

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    df99eb0145f7e3c7bc6cde31df4078ce

    SHA1

    d63356b75eaf56f392bb8187776ed354f2b2605e

    SHA256

    2954186cfc7ceab71edd1b7bcf9bfeb05672799bd0cacaa0d5b5da7c0b31b4de

    SHA512

    4a16b91ccc74841e5cd51341160d8033592c775547f2771618e6d75a1478fd08cafc1e1735cc1c361d2ba8fb563e18e82e236db0cddbf9f00d2ae149091d27f5

    Download Submit
  • C:\Users\Admin\Music\BlockBackup.doc.exe
    Filesize

    512KB

    MD5

    275831ef3a073f8f1adf98a3c6324d34

    SHA1

    ced3b29d9daed89f10dcdddb7bf1d25924a05893

    SHA256

    f5c0ff6c0b93425c89de419259d536c4f452eef416e0e0c4a4282df67ddd35c5

    SHA512

    798ca52f808bb73aeb59f11571bbf76cccc391127b6b4c29d718207ba9cd04641be84a85b2a91aca91efa726ad018c29553d6a6359465410a5ac94d275ea3d06

    Download Submit
  • C:\Windows\SysWOW64\eajcavxyca.exe
    Filesize

    512KB

    MD5

    ea506c68913b61e9e20a46e3c8a1b059

    SHA1

    e811fa3710c735a800f5cfc933c4bf958481dde8

    SHA256

    bcd8d0dd2acecb33fd266ff4af42b629b8991445b25dde4fbceca553eb31ba71

    SHA512

    13a924d9e399604722cbad43f0d84568ae6249109e56c066a639361bcd1f26250f5a51d231e63f55d278539a96c27788d7ad049f8cb9b9c24fb7c9daadb42582

    Download Submit
  • C:\Windows\SysWOW64\hhmnkjyi.exe
    Filesize

    512KB

    MD5

    3296c8ab3f0db55d6c78d16688ea3687

    SHA1

    a03be733e0d22c50f86e09813b33694ee41300ad

    SHA256

    b5b6c11c306e410784bac70b5d196db1ab2cb283438247c5cc29854d6a6a9fbf

    SHA512

    2336527492541d21de52a4271c522146d2c6efe7ac8c3f865f1b2a3832876dab8164cad3d38c6c368edcd6c650766fc1536969996da628ec88ee7c767ac072c3

    Download Submit
  • C:\Windows\SysWOW64\ivieljwnxkkyi.exe
    Filesize

    512KB

    MD5

    7a8fb56d25c160b4fa269d0af84e2a61

    SHA1

    082bd0007e7e7657eb9d702644b59546f0629beb

    SHA256

    be1227a28f5e8284a924fe1961b5a7c37038df1b3cdde395f0b85a3e5bea1e3f

    SHA512

    27d997d7a002ad8cf7bfc4c3b5a09c9baeb0276a9569e789eba277d9867aadfdf0de3874c2a12b4953b07971f64f8bdb5f61b4aa32faffdbdf1338437406ada3

    Download Submit
  • C:\Windows\SysWOW64\prqddrtjqdifjxi.exe
    Filesize

    512KB

    MD5

    8e9841934f48b3ed30795f8af78cfa22

    SHA1

    3f2a97ed31bc4f239e92d2e6bf26be6ca264608c

    SHA256

    26006d6f10319649d687e7e9eb979a40ccd2db5b446bedbb3e22e075f93bc133

    SHA512

    96adeb6aec778dc7dccd69b5cd4ff72b002567c5a323f5407eab9140a276d9dd17676b095970307a61cedf12bea524d87eb468e17d4fdf1bdf6e97bedfe0c74a

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    6345d5afb749fd978d5e6780252eb1fc

    SHA1

    a9031b528a39c47f2fd76f7e2f4190fb9f263a98

    SHA256

    a8a8dd024f54526155cc2b6fac5c335755220d749b9b0bbb60460906d6698a46

    SHA512

    000a7fc637fa33c2421daa24f6076d49197e711476d23353d95a0abc98ddbe3eec7337d056c10594a2570bf4da893be974808fc1e5814fb0c24babc937874261

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    eba130d893e33f5e047092e647765324

    SHA1

    547f311d4aacc51eb0e4dcbaee6144348091ee6f

    SHA256

    b9d9b9672e9838b028b0b25529b20f97cf11235c6d3656f94c51ef5675def3ee

    SHA512

    82f3754a4e3c06e6d4e56013d6b6dd4bf34ac3748b5a8fa2a2671ee407c63cac414e96b3a66ae57721ce40bea644540870ca2b2353f4b8239b40ef8f7d56eb26

    Download Submit
  • memory/1520-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download
  • memory/5036-39-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-37-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-38-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-36-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-35-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-41-0x00007FFF48A30000-0x00007FFF48A40000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-40-0x00007FFF48A30000-0x00007FFF48A40000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-116-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-117-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-119-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5036-118-0x00007FFF4B030000-0x00007FFF4B040000-memory.dmp
    Filesize

    64KB

    Download