Overview

overview

10

Static

static

7

1d205905ed...18.exe

windows7-x64

10

1d205905ed...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2024, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1d205905ed1efdf321e775f48f618a06_JaffaCakes118.exe
  • Size 5.6MB
  • Sample240506-srqmpsbe55
  • SHA256 b0ccdbb420f9e8e05ce718a39fa784deac3b56f0256257a7ddec17aff66e9b83
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwareevasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Drivers directory 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • AutoIT Executable 29 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
    stealer
  • Modifies registry class 25 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d205905ed1efdf321e775f48f618a06_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1d205905ed1efdf321e775f48f618a06_JaffaCakes118.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4640
    • C:\Users\Admin\AppData\Local\Temp\1d205905ed1efdf321e775f48f618a06_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1d205905ed1efdf321e775f48f618a06_JaffaCakes118.exe /nstart
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:64
    • C:\Users\Admin\AppData\Local\Temp\tbogszw\jzzbddx.exe
      C:\Users\Admin\AppData\Local\Temp\tbogszw\jzzbddx.exe /nys
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kGtscOc.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:4708
    • C:\Users\Admin\AppData\Local\Temp\wkzjlgu.exe
      C:\Users\Admin\AppData\Local\Temp\wkzjlgu.exe /HomeRegAccess10
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4424
    • C:\Users\Admin\AppData\Local\Temp\~mbeheyv.exe
      C:\Users\Admin\AppData\Local\Temp\~mbeheyv.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3580
    • C:\Users\Admin\AppData\Local\Temp\~mbeheyv.exe
      C:\Users\Admin\AppData\Local\Temp\~mbeheyv.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3172
    • C:\Users\Admin\AppData\Local\Temp\uppmjss.exe
      C:\Users\Admin\AppData\Local\Temp\uppmjss.exe /HomeRegAccess10
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3880
    • C:\Users\Admin\AppData\Local\Temp\~mbeheyv.exe
      C:\Users\Admin\AppData\Local\Temp\~mbeheyv.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:5044
    • C:\Windows\SYSTEM32\Rundll32.exe
      Rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\~sixjaws.inf
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Windows\system32\runonce.exe
        "C:\Windows\system32\runonce.exe" -r
        3⤵
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\System32\grpconv.exe
          "C:\Windows\System32\grpconv.exe" -o
          4⤵
            PID:3752
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\on8zGZM.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:556
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:1472
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\hPgs18S.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3932

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Browser Extensions

          1
          T1176

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Modify Registry

          6
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          3
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          4
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          64yiqayrp
          • Path C:\Users\Admin\AppData\Local\Temp\64yiqayrp
          • Size 392KB
          • SHA256 a33c4b223a3ea62c66090fa5c3ecbeb26953abbe7777f52a39cffb02a2de9a7c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          aut4A19.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\aut4A19.tmp
          • Size 76KB
          • SHA256 84a358de158b976077cba959da15d1567e2e794ddfa2c590d6df11cd4676a5af
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          hPgs18S.bat
          • Path C:\Users\Admin\AppData\Local\Temp\hPgs18S.bat
          • Size 617B
          • SHA256 0ba6e2daa37225e403bfe8b0c159da55178725bc91ade41daee4c6c0d0720e39
          • MD5 SHA1 SHA512
          Submit Download

          kGtscOc.bat
          • Path C:\Users\Admin\AppData\Local\Temp\kGtscOc.bat
          • Size 493B
          • SHA256 189f29177ab56483b0428ce0fe920cc2e1c52001d520d0ed0b38f2740d3e5530
          • MD5 SHA1 SHA512
          Submit Download

          on8zGZM.bat
          • Path C:\Users\Admin\AppData\Local\Temp\on8zGZM.bat
          • Size 465B
          • SHA256 2f5cf318667d0a095cc7b7317ade9b0bdcf9eb4b59356494dd31973c56f9f56c
          • MD5 SHA1 SHA512
          Submit Download

          jzzbddx.exe
          • Path C:\Users\Admin\AppData\Local\Temp\tbogszw\jzzbddx.exe
          • Size 5.6MB
          • SHA256 b0ccdbb420f9e8e05ce718a39fa784deac3b56f0256257a7ddec17aff66e9b83
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ~mbeheyv.exe
          • Path C:\Users\Admin\AppData\Local\Temp\~mbeheyv.exe
          • Size 546KB
          • SHA256 427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ~sixjaws.inf
          • Path C:\Users\Admin\AppData\Local\Temp\~sixjaws.inf
          • Size 32B
          • SHA256 2bce6b9395cc74d16b9c94fd90debd9d524ffb53c6f6ae3a49b6e139671417b2
          • MD5 SHA1 SHA512
          Submit Download

          memory/64-153-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-152-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-134-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-86-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-144-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-140-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-8-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-137-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/64-129-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/1884-145-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-24-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-131-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-135-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-138-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-91-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-141-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-132-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/1884-150-0x0000000000F10000-0x0000000001A84000-memory.dmp
          Download

          memory/3880-84-0x0000000000100000-0x0000000000C74000-memory.dmp
          Download

          memory/3880-63-0x0000000000100000-0x0000000000C74000-memory.dmp
          Download

          memory/4424-25-0x0000000000180000-0x0000000000CF4000-memory.dmp
          Download

          memory/4424-58-0x0000000000180000-0x0000000000CF4000-memory.dmp
          Download

          memory/4640-143-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-0-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-85-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-151-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-139-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-128-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-154-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-160-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-136-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download

          memory/4640-133-0x0000000000CB0000-0x0000000001824000-memory.dmp
          Download