Overview

overview

10

Static

static

5

106fe205ca...18.exe

windows7-x64

10

106fe205ca...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/05/2024, 11:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    106fe205ca4aa54d81a5c56401dc49d5_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    106fe205ca4aa54d81a5c56401dc49d5

  • SHA1

    030af7eecf6698fbd94dc7396cf73d28f9d615f9

  • SHA256

    fffa54ac4f2d502023e81a92abe83c3dc0859ab156c15f5ea2a1fdb16351740d

  • SHA512

    4fca826b42b67ff794eb2d33d88bf59eb16c79f3424584310f3351fa7aca301619c2c8634143b8abab584a37d01b3f9750c124da2c77be54b5e493061af314f0

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\106fe205ca4aa54d81a5c56401dc49d5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\106fe205ca4aa54d81a5c56401dc49d5_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\SysWOW64\vndtgvxurf.exe
      vndtgvxurf.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\SysWOW64\hgsrbmgw.exe
        C:\Windows\system32\hgsrbmgw.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2464
    • C:\Windows\SysWOW64\hufessdqfmifjjt.exe
      hufessdqfmifjjt.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2672
    • C:\Windows\SysWOW64\hgsrbmgw.exe
      hgsrbmgw.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2416
    • C:\Windows\SysWOW64\lukkmkabecfny.exe
      lukkmkabecfny.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2620
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2484
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1372

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          674f7f15197f897b4dff7428e976b0b6

          SHA1

          f15df3516102e05fff2ffcd4f9a7c632be0d1865

          SHA256

          6d20aa6e3a331333c0c8e8de1b79ea70470f988ffbd69700fc3ebdb5b1100b16

          SHA512

          16a41a0e314d550287b23223278af0589be8115dc090d1db937f630931afddca7bae139563d1de8e91e654846106074612ea5a706f079d83449578052b99e06a

          Download Submit

        • C:\Windows\SysWOW64\hufessdqfmifjjt.exe
          Filesize

          512KB

          MD5

          9bcff4f4735b38f21475b7e6b786be11

          SHA1

          9a5f0efa47233df755b0c1155d8de6c414f64d6a

          SHA256

          db1367a779257258d27603061982b456583fb91b8cdbefd17cc4e53cd954a2ae

          SHA512

          a64ef246b3033143754183069cb1284f6bd98a14242999ecc50c43c5c4f24d37e89e3b3e2e65d6a29f26b3a9ffd1dd068488db2b0c4c74fda4a63feb93e000a1

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \Windows\SysWOW64\hgsrbmgw.exe
          Filesize

          512KB

          MD5

          b070becc97c4587eb58b52208e2eb85d

          SHA1

          f7daa0d840edd15ff64e9b0f2b81aae2c0d339f0

          SHA256

          cf7c954b1a7e8ed9ddfda349de57bd8d267cbaf858df25750c1efee92991c05d

          SHA512

          4d990b513a2a5122e5c259b8f97ed7b1fb895cebbec9d26b7f58087af988050c1a66a115d4f64f4c1b1acadd1179a8de90f85c05b9b2ccfaba14d0235631cc66

          Download Submit

        • \Windows\SysWOW64\lukkmkabecfny.exe
          Filesize

          512KB

          MD5

          8c5bf7ef161ed1863f3c8fa4b4a5254f

          SHA1

          50f004d6b636d94f10ef60eec631328ea6a56082

          SHA256

          3e8d1b28c22bc5c073a5bff904e8c29312788c6e599931aa229500c61959e020

          SHA512

          79c871426b973b08a6d9f88cbbc87446276d58574ba415e7b6ac676a760333a924fbca942995a4cf0b1dd2dd3115b7f44833e0b34cd06026da88f8c938c58fc7

          Download Submit

        • \Windows\SysWOW64\vndtgvxurf.exe
          Filesize

          512KB

          MD5

          bbb0f44f14b7e2a240515709af5389f4

          SHA1

          96f4dea98a9840fb23e778ae8b06c82fa914637c

          SHA256

          52098849b802240a005c91b3fb3683f6ce2169959af2f02beaacbae7ceaf84a9

          SHA512

          e7d54d1152289cb568d7dc621f2b36b781681ccaf32146793f960733724c77f4b363fad5cda4a0f5f1fe252213b0d0b9181e560a3c1808076d1112fda0350023

          Download Submit

        • memory/1372-78-0x0000000002840000-0x0000000002850000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1968-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download

        • memory/2484-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

          Download