Overview

overview

10

Static

static

5

497df9b535...18.exe

windows7-x64

10

497df9b535...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 04:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    497df9b535bb2b1a38b8b68aaa1141ee_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    497df9b535bb2b1a38b8b68aaa1141ee

  • SHA1

    f70e4b80ab7258879756061e7a5f3a14b5cdc48c

  • SHA256

    ee5e63dacda9d284071f2b540f9ca61677ba4dcaea405dfcbdcabfb95d369745

  • SHA512

    006de69291d7d7953602b6dd47ad2a0f2775ca133954487d1493622673ff3578c0431d032df9a510c7df807b3aeb0029e25ae3fc6b9d3e1f4dc95d1ca027b04c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\497df9b535bb2b1a38b8b68aaa1141ee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\497df9b535bb2b1a38b8b68aaa1141ee_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\SysWOW64\yobbrsmzoy.exe
      yobbrsmzoy.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Windows\SysWOW64\bujinbwt.exe
        C:\Windows\system32\bujinbwt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2708
    • C:\Windows\SysWOW64\zxfjtyalxvsdmlz.exe
      zxfjtyalxvsdmlz.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2208
    • C:\Windows\SysWOW64\bujinbwt.exe
      bujinbwt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2716
    • C:\Windows\SysWOW64\wvjzhonifbixh.exe
      wvjzhonifbixh.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2576
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2712
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1936

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          10f3b0c2aaaa15522f2358bb566b6d64

          SHA1

          a7abff62c4046a8082097e409d545772dbbfec2f

          SHA256

          2cc6588fca6be40ed783858a5729e32c1223f398074677d88a64ac62d593aa23

          SHA512

          cd1b70fc393402be72f60456224226fe126861063e9989d68ca68bcb56ae35642a9439e43bc08b8938228711a8d211e95f373682cd23f9a7d0f25e56caa1bcce

          Download Submit

        • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          9975a6215fd017d167ff3bca8077a381

          SHA1

          7b3345569f0c4a962593c432c326ebe13ad81c74

          SHA256

          9287b6f6b243deaaec87837fefd630cf2dbd65c9bc3651ea791d04e2da09219c

          SHA512

          e76276a7a1e6161eba46b51dce287c7115d4c022d8b8ff0aaa1365b72de445f80776f57e66874fcbecd07106add4e23bd5fe071f40b5c0ca82b7aa1ea1d2f110

          Download Submit

        • C:\Users\Admin\Downloads\UnblockMeasure.doc.exe
          Filesize

          512KB

          MD5

          eea462f7a3e4580cccee0e800359edd0

          SHA1

          5640b7daa8db2ea5831144f92124d1920dd83cca

          SHA256

          cc4cf3db06fea6acb0a0bc5e5322ccc8e71bbd42fd661262cc56bec3639e9425

          SHA512

          c1b9d5fdca62cbd2aff40423ff53f94df404bcf13ea84bf4cbf9c286fe657f8119f85f7cd308c87e984f325c37e1cededf1f90e533c7c5d912cc25b60dbde8f8

          Download Submit

        • C:\Windows\SysWOW64\zxfjtyalxvsdmlz.exe
          Filesize

          512KB

          MD5

          2c233e1766ea233e4a736ade80fe2cb4

          SHA1

          1defc7b70b6566363adc46d1f9e363fc48768b7b

          SHA256

          cf68584af13bf4bcd9835af8ccc8df9e64f93a730cebe0f26589b1e6f93c2245

          SHA512

          02ce2be63786b17d4feab28906c8dc762d08c69c8f5b18f34e034de3571d919346559673f5f009ef6fa2eeb7320a9fa5b0a142b399598bf1a659b623cbe8fc08

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \Windows\SysWOW64\bujinbwt.exe
          Filesize

          512KB

          MD5

          9cedbdc973add0dcb5e22bcdc0cebfe2

          SHA1

          dfe0baeb47d8f5bc6f58639248c5fd9aa9f7e19a

          SHA256

          abc0344c6159e3288574648cdc0d65a31cd786e7ad57ea4787dab1044a59b7e9

          SHA512

          f3996fdf8a68cd08a48230477b0702e20e99a114ee3dedcf4eb93ac91c64ff46946e3e4ff37ac0fddeae1922b15a354d6576f17154dea6a452b1f54169a061e6

          Download Submit

        • \Windows\SysWOW64\wvjzhonifbixh.exe
          Filesize

          512KB

          MD5

          e572ce0452cf5861cfdf28d6bce38168

          SHA1

          c96129b6ebe4f83920b6efee2bb6edcb6c8ed431

          SHA256

          d634a7e3390d1a81482ac43371fa15d19c4e551d702900b0ec077a60c9e5ccbb

          SHA512

          82b1d5d1c629896c720c551cb0e9ebd5000b0187448394a46122a7736cf3102a12425071fd8e1f05dfbc1c2c99b3df73c059dcc1b33177437414681a9becba8a

          Download Submit

        • \Windows\SysWOW64\yobbrsmzoy.exe
          Filesize

          512KB

          MD5

          05874bf8d9c76b98afb75c9c34755e02

          SHA1

          cd764a922db6b920bcfac698514685e5e49f5265

          SHA256

          40ce25f03432522cbda67d070bd585ba52ceb6e7c14201c03d53904e061d4988

          SHA512

          2ce5e5cb7bf87f4e25496a3a3002d5e13113d47f0652a2644f25b319dc85ed2d39c8683820ca3f346b316062b3c68cbbe2649b2092cfe0610652b3685d748501

          Download Submit

        • memory/1936-87-0x0000000003C30000-0x0000000003C40000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1972-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download

        • memory/2712-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

          Download