Overview

overview

10

Static

static

5

106fe205ca...18.exe

windows7-x64

10

106fe205ca...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 11:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    106fe205ca4aa54d81a5c56401dc49d5_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    106fe205ca4aa54d81a5c56401dc49d5

  • SHA1

    030af7eecf6698fbd94dc7396cf73d28f9d615f9

  • SHA256

    fffa54ac4f2d502023e81a92abe83c3dc0859ab156c15f5ea2a1fdb16351740d

  • SHA512

    4fca826b42b67ff794eb2d33d88bf59eb16c79f3424584310f3351fa7aca301619c2c8634143b8abab584a37d01b3f9750c124da2c77be54b5e493061af314f0

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\106fe205ca4aa54d81a5c56401dc49d5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\106fe205ca4aa54d81a5c56401dc49d5_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\SysWOW64\jlrudeqgjr.exe
      jlrudeqgjr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:344
      • C:\Windows\SysWOW64\kckodawr.exe
        C:\Windows\system32\kckodawr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5036
    • C:\Windows\SysWOW64\rntxvkqbjtiptys.exe
      rntxvkqbjtiptys.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2112
    • C:\Windows\SysWOW64\kckodawr.exe
      kckodawr.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:908
    • C:\Windows\SysWOW64\didmseqndclnw.exe
      didmseqndclnw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2908
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    044953599c1f95be537f42b176797041

    SHA1

    6ebb30fed12df367fffb863af4422575f8e0062e

    SHA256

    3c6b0ee0cad1315c756e1a91d02fe50605b5ec2bd6c098caf8501df5ae85899f

    SHA512

    1c4e24d18bec7c3a8d2bf990e2d62bf9819a0d4997dff0316cac67a953ae860c44c1ca45d4bda6483ffd19f6f65bfdc408930d3ee4982b5de6158fbaa3b97537

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    166fdc3c304b27dd401318b685730478

    SHA1

    b451d2af03855448cba70103c40d496bba2d04d8

    SHA256

    a85553875594718a2c06e88eb175fc781d624d3e94dbaebb601e69d04fa2d725

    SHA512

    ec4abfa47afb4d4e9cc3e5190cba71b2017bf789d42e16545241709dcb5ee628027e6f650c00024c7b5599f372cb6c4876519bfcc8f1231bf212f2e02d1dbf1f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl
    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    ca53c447d318e740d1b513aac324b35e

    SHA1

    5dfab9ccc99cef7497751995e2d34d3ef44ae65a

    SHA256

    d4be8af7e6df93fe6b07b3c1f8ce93a9e7ad79fe2fff72e116a7836306d3485e

    SHA512

    a0831fd593ab8b070ce3b5ee9187d8137ee490c95c55f640dd2e6642f7cbb05bacc35f841e93c25edf15a926e17765b34d52177b695d1f5e1ae42cb9e6a740f0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    cd1390203cd8f5b0deeb7a2305f1d36d

    SHA1

    3bb335311ef24030275392dd2bb1f5abe124d5f8

    SHA256

    91a87eda90ff24e4a853a0ff4830b08fdb3fcea9556585c56fb1447e0ab7974c

    SHA512

    24808932acab9b4f0f7aa4217adfb65c20305b8627707455f319b31dad6d91390cc863d6dd3d2a0b738e4658f7acc211a7ea37112c94313bd44fa954baff79f6

    Download Submit

  • C:\Users\Admin\Desktop\MeasureUndo.doc.exe
    Filesize

    512KB

    MD5

    6e541b9e06eccf4deb27706351c73a89

    SHA1

    d185a3908d084df247acfa505433af9565ec8927

    SHA256

    1eb739ce0d8785191fa775f25b5557e88be16a6568a328ffaa12e9bf80e2aca8

    SHA512

    4c7edaeffef2265b97ae95a314b78a685d76dedbb2614890a3382d4b46d8ac83b6f074555cc4b08696b1a59ca3c2e8f4a0edfef73c272d835925fa82114f1de2

    Download Submit

  • C:\Windows\SysWOW64\didmseqndclnw.exe
    Filesize

    512KB

    MD5

    26166bd97da04e69ddb3bbfdef7c831d

    SHA1

    6d3bd52df846b11073185ddf5238a4af55f3929e

    SHA256

    612644329e175b9b50f2ec8638b5004aad797dff3700f9c016f4ed691bb582d6

    SHA512

    1bd8b0ae4ce6d8291e848c539e226faa2804bea369d87f165b387036c157167e79751778a6d57fc8377ab02b34028d7e73542e85aab416e8e1712e6bf0f6e375

    Download Submit

  • C:\Windows\SysWOW64\jlrudeqgjr.exe
    Filesize

    512KB

    MD5

    c92c038ff8562a7410de27e3b39d9431

    SHA1

    a78f686ed6331f88ab96a9f7f55148c31615447a

    SHA256

    e2a824c79026f2b7a1e8894e78856ee60dad1ba94ff4120a8aba3dfbbcecce46

    SHA512

    403e80967fa54286b436b062d856425be3dd874f9430d179687ee1a42c40aea5105fb5afacdc13a52bec8eb734481f191d3cff8a94860e293ca93461c8068625

    Download Submit

  • C:\Windows\SysWOW64\kckodawr.exe
    Filesize

    512KB

    MD5

    3a407cf4c1289a62cadcc2c6d43c9f3d

    SHA1

    0598624d7578d2f3318dbc27d82ee33ddf3e6204

    SHA256

    a1aa494b8b6619422aa55c4bc75ccbf3df56aa3e049d661c9708e3e825c228cc

    SHA512

    22496db58675f34a8503830fe436f8f4438825a997c6114f44f3d13818fff1bc679905dbbf3ad89fbb1c7d5e6fa7f5b6b0ce87fb05e68d369c49eca5acaeb001

    Download Submit

  • C:\Windows\SysWOW64\rntxvkqbjtiptys.exe
    Filesize

    512KB

    MD5

    d3f748c9f5af6a045e5c63c29e25612a

    SHA1

    9bea9a1a7814bb789d5032656faeba31ed645751

    SHA256

    9c7fb2c1e89f1f5188757a6fa859acd8619fa78bf36a031148ea466a18acb3f5

    SHA512

    961cd5a8cc293505dbc527f3344beeee6a9b19c126bb27f6578535b7f31e2d5b99cf8a290d79938d9be390e8f23883fbc27f9210f9d117cf5cd807d34bf3c723

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    46e808c4e3446523afc58999d283b35d

    SHA1

    8744ab2dd43c8603d9e3c5c7702c87d2d90bdfd7

    SHA256

    8e689dfe28c4d9004874719f31ccbacaf59363b27b3db3481bcc224e2b804ed9

    SHA512

    7601d7348f9d2243bd18d2b88786e7ba3fac516cc8500e778ca95fe17347a0e6408c93d9753163ddb890aaea02a3f76b9334a107539ec28d232957953f8309a8

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    ae2e91ab79a1b5db0cdb9f6400e6a582

    SHA1

    0ae0cd5c065418d2960772fc219f78cf5165845e

    SHA256

    fe1aeeafdcdbedea60c687c5ed6099f1d86ed5c44260380416e4cb999e8c92a1

    SHA512

    da9cc9723da0b10c32449965d2fa6862b31c81b590835b4ce21b32fa0c61e8b9d701721312bcff6ef3b051534b96e3db5e985568651cf1a4e6c78ed2e8e9abbd

    Download Submit

  • memory/1336-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/3936-43-0x00007FFDC51A0000-0x00007FFDC51B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-42-0x00007FFDC51A0000-0x00007FFDC51B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-37-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-39-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-36-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-38-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-35-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-604-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-605-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-603-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3936-602-0x00007FFDC79F0000-0x00007FFDC7A00000-memory.dmp

    Filesize

    64KB

    Download