Overview

overview

10

Static

static

5

4583dc20ee...18.exe

windows7-x64

10

4583dc20ee...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-05-2024 09:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4583dc20ee9c673bfcd517fab7d88bbf_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    4583dc20ee9c673bfcd517fab7d88bbf

  • SHA1

    cc4fdf65702ff682b9e1692ce83aa9d3e2828111

  • SHA256

    478e070b3f86342ff2fc22562142633932121d6244bb55160ae4713159580cb1

  • SHA512

    d06f549136eb15f83001f405a3005594b1544e9944c14c1c85eaf57079fe701ef03a729c29a5365321a63fd909f51b889a152ec16fd01f89c257056edd7c9d97

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4583dc20ee9c673bfcd517fab7d88bbf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4583dc20ee9c673bfcd517fab7d88bbf_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Windows\SysWOW64\lnqxmwlilf.exe
      lnqxmwlilf.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\lmwdudnu.exe
        C:\Windows\system32\lmwdudnu.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2756
    • C:\Windows\SysWOW64\chhubaelvzqzmxk.exe
      chhubaelvzqzmxk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2796
    • C:\Windows\SysWOW64\lmwdudnu.exe
      lmwdudnu.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2712
    • C:\Windows\SysWOW64\erzvdgmpdcivy.exe
      erzvdgmpdcivy.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2596
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      d23e1c996aa714526b7cece49a79d3ce

      SHA1

      5e59cde85f99bfcfa46bb2bf307bbe3e7b0250f2

      SHA256

      a74a4f44499031a66214324baacd20cfd3f22bb14639cad5abbc601d38eeac6d

      SHA512

      ae64acd97faa8684585907ecf979af954bd783bc0a892b30d8c783ba38968ced42e526bbef8eb3924db66db9bd94ab3df406abf3b13ac81258c05a4aecfbeee3

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      cdd7e80138170812ee7dbc9dd8d5b0d4

      SHA1

      1949f256d2c2743bed6fddef8cc3cb5321d11ef0

      SHA256

      ab479f364d3bf7709a44db9adb65f799401524463784a50bcc2bea30229c7379

      SHA512

      6d58d341fe4f4e8a39f16cc1d12a6818e249fa85cf836a7635e94595ae0a9d1452d8f15155b3a3b36a6025cbb2b565bbbf04d4f1e759f4dc69b47e09c1f900b2

      Download Submit

    • C:\Windows\SysWOW64\chhubaelvzqzmxk.exe
      Filesize

      512KB

      MD5

      1c8ea5c4c8ac121f451e33f8d6391aae

      SHA1

      45012525a899362e9462de16162a67a7f466d11e

      SHA256

      55cdd588184c355544756d79fd441a7676a2b85df1384266225f992986e70415

      SHA512

      713263deea5da5a137c8fd872a2e24ccfd7cb9964a4157f6cfdb61d0f88bf93348e32b783803a1680cb1d64684fa96872dc7d206a0b8ae4b9a688ef521ac3447

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\erzvdgmpdcivy.exe
      Filesize

      512KB

      MD5

      b731b2c60e24205631f27a81ee08ee2d

      SHA1

      0b5256a9685e926b2ab51cbea604ffb14bec7512

      SHA256

      26601f10829d81a617c7aa897f261177b93529451f9131d7c36ba293cbf52f21

      SHA512

      6b1cafea5b3d4b5fe48b59147aacf26fd6b2a45b854c006e7ed9c246c1f4a39a148d2410c50aba31f271c883afec64ee6649a59af0e40743fb94a88f8fa87adf

      Download Submit

    • \Windows\SysWOW64\lmwdudnu.exe
      Filesize

      512KB

      MD5

      8e9ad3bb1709d169f4c3200493ebc2ef

      SHA1

      d347561f472b439efb2754406d2766c2004b6d7e

      SHA256

      9c1556e749b6a3cdbdb1177b523332af8c46b3a41bfe00101365609bf6faabd2

      SHA512

      44aee769f8b4629f482f1c842b03fec834d42d9251f5af0892fb26d488177f95f496989e1fd941c59dd9c185e3d6282d5515d7c6fc37778e546f7d91388ac50b

      Download Submit

    • \Windows\SysWOW64\lnqxmwlilf.exe
      Filesize

      512KB

      MD5

      3694ff1b12a9e3d23dd005ec8d00c53a

      SHA1

      2bc2db7225f1e1581194620ccddcd851d152e701

      SHA256

      ba5c35fd4deddddbb5cc1b972f74d5d884101ba79900faa89579098828ab86a9

      SHA512

      fff898d5a0a38fd1f4f5340f9f967f763284e8e3613c9ed7549979fb450e85ba5f1a77bd71b99a883cf402be6d4d765fab9abf026fd3062d78aa07882213d568

      Download Submit

    • memory/2460-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2460-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2784-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download