Overview

overview

10

Static

static

5

39af28b86b...18.exe

windows7-x64

10

39af28b86b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 10:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39af28b86b2461068924c163bda0ff96_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    39af28b86b2461068924c163bda0ff96

  • SHA1

    e8f0b6d89a1df9c1b82f74bf12474347db88cf43

  • SHA256

    74cfe911ca7254c0b5dcaa3e6888f63bf4b53b4a1d573e79177a2b49ab4101a0

  • SHA512

    acb27efc9868868c07b229379e342cbab9f8fb72decf052eb7659825451385604faf732d4bfa4c54e5d16ccc5cd9ce42c9e45997e25511cd5e0952398c24449b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39af28b86b2461068924c163bda0ff96_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\39af28b86b2461068924c163bda0ff96_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\gnfhgbmqmx.exe
      gnfhgbmqmx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\mbvadgyv.exe
        C:\Windows\system32\mbvadgyv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2664
    • C:\Windows\SysWOW64\exwxsqmnrurlfmx.exe
      exwxsqmnrurlfmx.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2600
    • C:\Windows\SysWOW64\mbvadgyv.exe
      mbvadgyv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2552
    • C:\Windows\SysWOW64\bpjiqbnwgnxts.exe
      bpjiqbnwgnxts.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2684
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      e9f6c1a1987bea93d5f0e0adf4588b52

      SHA1

      519b38bec54b51d637fb89aabeaf954f7560de7f

      SHA256

      fb6d8d67872e6efc69b8aedc19025e1ac5356d5c1eb643fb3d0a61bc7a40133a

      SHA512

      4ddd3cbc312b936e3e2771e39c69784addca5f3ac115a8f3ed3f8df3471c37eb4a2bb922944994e013ab85ef8145030b0ccae1e5cf8915eacd91fdb4175aca95

      Download Submit

    • C:\Windows\SysWOW64\exwxsqmnrurlfmx.exe
      Filesize

      512KB

      MD5

      2adaaf2074d41154d06ca4663715c78c

      SHA1

      ef0bcff80a4d467632340022d9b157f8a33b4e5d

      SHA256

      251471c5cbb69be30dd7ccf082c2fa1162185e3e58d68e0ce3135ce9ddef3222

      SHA512

      f201a12eae29ef243363740c6e7556189c0cd06f8001dd11a61ebeb5c9b428e7a5ee5a7f4bd820d2a925260a7c412488e052769f522608a28adf56dda88efe3d

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\bpjiqbnwgnxts.exe
      Filesize

      512KB

      MD5

      95838be367e240cef48dd7ef768b6e13

      SHA1

      ef04c5141a1d8cc794860d1629b653b16c458c0d

      SHA256

      e0345717e9b54e705fe6617a17493ee50b5cf51dd17551a1931221368595a33b

      SHA512

      9a6841feafee03dba1f657c4259d1bd66d16e72d3a7083db44c1335f2b8bc6a45136a5ce955eb86756503b96ce75fd2b0a70c203ad7f2798a98ec89b0698537b

      Download Submit

    • \Windows\SysWOW64\gnfhgbmqmx.exe
      Filesize

      512KB

      MD5

      5a2d27341a7af0d45cb1848f882fbe0c

      SHA1

      3d6622721a3851f50288c6f348c87a6ef41a51ab

      SHA256

      3fd8288ff0abde18fee965ab4d97844a628b941edac17d1668e2b5dcbe32c686

      SHA512

      b1e3d171e8fe96a1d45548eebb5fb82269a63856701ba52f74b4b757b6d56a6a3a9b38bb8f8f78e3f9980e5176e5e20d3f704446defed169f603c337dc0a62af

      Download Submit

    • \Windows\SysWOW64\mbvadgyv.exe
      Filesize

      512KB

      MD5

      0e9c9875fbd51a87b927971f0a33b708

      SHA1

      41eedef9672cdb2ac3dcf878137066d8979e5813

      SHA256

      fa6ca6dc4387e6221ef6ebf68f404b5ed93adc6993a85a43a680f53efa37ec69

      SHA512

      931b2eb57520e36e42f85525fd9eddfd1c8a3ca8d8d0028ffb2f667b2eea2ab104ac99816e8258662eaecfe777a6bdbcc717ce4aba11cf6872922c994f5ce6e6

      Download Submit

    • memory/2400-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2400-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download