Overview

overview

10

Static

static

5

34766c7f01...18.exe

windows7-x64

10

34766c7f01...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-05-2024 11:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34766c7f019bea953fa110442d1902c2_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    34766c7f019bea953fa110442d1902c2

  • SHA1

    0cf9c2dc2be06db0d0e3a68d47be69114eca998e

  • SHA256

    77e92063719b543d64dd6b80285d8849e6bb912337fff7cf667e41b4bc250b80

  • SHA512

    910a207a9e0f7d47e55e37ca73367571a66b1f65d0cbd4597006129086ad2b63d905949b7b44339b2a4d7c297b15de97c867bbcd384e9735bb1401f512537e96

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\34766c7f019bea953fa110442d1902c2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\34766c7f019bea953fa110442d1902c2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:360
    • C:\Windows\SysWOW64\bgpdaftowq.exe
      bgpdaftowq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\SysWOW64\ydpvespw.exe
        C:\Windows\system32\ydpvespw.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2752
    • C:\Windows\SysWOW64\whfzqdcahgcviaf.exe
      whfzqdcahgcviaf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2992
    • C:\Windows\SysWOW64\ydpvespw.exe
      ydpvespw.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2628
    • C:\Windows\SysWOW64\cwlwpljzupvps.exe
      cwlwpljzupvps.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2624
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2480
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    405e06fe47580f319665a69f8290160c

    SHA1

    47740a915efaf57f006145af3f48190bb927e3d8

    SHA256

    81452fbd24a00658760b12bec69e323f5f9baba1763b49d810726953311ef8c4

    SHA512

    9fc0d0af7879573d3b60686f7fdc2a74c2dd10dbea646a6df4fc12552c541814c5528e009c4c63f7637e76c633c1b66d988a0be6fbac240f603432cde5d7b5fa

    Download Submit

  • C:\Windows\SysWOW64\cwlwpljzupvps.exe
    Filesize

    512KB

    MD5

    ea92f14a83fd2ab84a27a9a5a33eb326

    SHA1

    1201d6a8bbca18ca384a38b7cce021dca479376b

    SHA256

    5cfadae392d7e7d8a4e5b6c20a9df033cc0a5f53a573502aff7ac15a7d03fa66

    SHA512

    cb564b5f0c11cab8e798a2d3328041dd6ff9d3938166f16fa59f99f284c995ad209ea0de22a15e0eb8eae3c5dd4dadb1c9ae2a5c94a332a7b79fcc432fb6c8fd

    Download Submit

  • C:\Windows\SysWOW64\whfzqdcahgcviaf.exe
    Filesize

    512KB

    MD5

    c1f151900a009dbd35e7a9b55a07f3d5

    SHA1

    79cbf61f2216ce64c286873a8683f46c94566bf0

    SHA256

    28a1e2917cc4b15740def59581777169709f94c2f4c924f3ed871d19c2b5e4a5

    SHA512

    911305b467d36cec8d11299c9ba919065f960eb62615309a354b74a5f36b65c05f53721eface193da077bdedebe9685537e775fb89223f8eba425270cfec05c2

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \Windows\SysWOW64\bgpdaftowq.exe
    Filesize

    512KB

    MD5

    63b4329ee7a5cc1a5a2112b21b5ca5f0

    SHA1

    4a5bb2743f01c0eb010a01d6915b2daacccd0779

    SHA256

    9c6ccbbdfc12e0ab0a0ed6288e4ebed2b299a0a92b44e01c66792dfbed7a49dc

    SHA512

    3c05b8aa7f136bb48f637910e554d6edf14110d7496b540290ff02ab69d6191aad1950f8578c15bea0f7b36169aea6bd43b6697e207bf7308e778e916f6cd937

    Download Submit

  • \Windows\SysWOW64\ydpvespw.exe
    Filesize

    512KB

    MD5

    f8bde756eb4e722ebb296e24b113b5a4

    SHA1

    007d2c8280930025ba76ef2364384e06e8041ac4

    SHA256

    a8c3239cd762454805685fd5ded6c96379885543bc8b2e3026407c0327b8d6a4

    SHA512

    ac19ea7b5d40c946b28f08e7f1a2d55cd5ba0bc70b717543160fc90d91b0ee44b6672ff79828da912017d993c9ba3d393a34a0bfd02e5409e2785c5a2127216e

    Download Submit

  • memory/360-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1956-82-0x0000000003C10000-0x0000000003C20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2480-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download