Overview

overview

10

Static

static

5

4b9d3c5d9c...18.exe

windows7-x64

10

4b9d3c5d9c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 14:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4b9d3c5d9c4a5f84c18ec3b49f8f576c_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    4b9d3c5d9c4a5f84c18ec3b49f8f576c

  • SHA1

    4a3095caa18c8c0ec562031bb4c99667c204d207

  • SHA256

    73af60d819746977990fdce3d54ccbee3b22118aaef44b7d6f3090faa9362a8e

  • SHA512

    27216d72d803ef2314176d65d5cc7782e4ec3f433243415b79703bb971a389d1ca759b174168089ab725fef869852c1b0ed75525fa892cf0f1734895d291de22

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b9d3c5d9c4a5f84c18ec3b49f8f576c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4b9d3c5d9c4a5f84c18ec3b49f8f576c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\SysWOW64\sioynbwxrl.exe
      sioynbwxrl.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\zwidwqou.exe
        C:\Windows\system32\zwidwqou.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2804
    • C:\Windows\SysWOW64\ncqkoxbtgnoulob.exe
      ncqkoxbtgnoulob.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1884
    • C:\Windows\SysWOW64\zwidwqou.exe
      zwidwqou.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2052
    • C:\Windows\SysWOW64\yxcylrzfciewu.exe
      yxcylrzfciewu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2540
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1920

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            c04b479d5d40adf085409a462b07c0ed

            SHA1

            34183fd8d1f83c8a3f10904a002a706ccea67d46

            SHA256

            631f72823e06dae22d9346718345fcd6401f850f101a49c88bd935ce28c48015

            SHA512

            1e9a5d21a8f65174d770089b18d54b760900bdebec8b179c3f6feaa438d643935e3f75789a86b2288c6f1bf6799861fcba79975f2d0ec8c7b5ab9710f0f52232

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            ce2be59b47935a194695da6c3246a393

            SHA1

            63c8157c131f6f8e45fbf1b155850fe70e8cff15

            SHA256

            fab1e4dd3f78dcc934cf14c8d154bfd1edbd447e17c894525a20c48a22f6f263

            SHA512

            dba84ae6a34f25cc1076ed17ba88afbfa3e1ceed38e144541a76c7616df62105e8e2191bbee2921c576068632d8ed2fd1f790ea0c66323c1ff96c3abb53e4328

            Download Submit

          • C:\Users\Admin\Downloads\UnblockMeasure.doc.exe
            Filesize

            512KB

            MD5

            e656c731082e07b252167a484ee8c679

            SHA1

            2ac9e1817cec1b72a87e952fb137040dd7e14bb2

            SHA256

            1914656c2bfc68464553d26c03db92e32b17b9d80ea57dab075791ed5f3b7f89

            SHA512

            92715f31d098a995630e0089d93157e121a40ab2152cff4b65f322d8ccaa00f15da810062dca364520f52ad56e567fff17e13ffcef1f046e01c8893ea083a05e

            Download Submit

          • C:\Windows\SysWOW64\ncqkoxbtgnoulob.exe
            Filesize

            512KB

            MD5

            45dd44b09504b1107f018a06cea631d1

            SHA1

            e3886ae7768e0001e644b9fa9a3b3bc641e17a45

            SHA256

            e564fdd8b6b35891d99ca50aa13088eaa217703e269456f6b29269548e145af4

            SHA512

            f16cf30398062f827f524239ea4d52eef8a9eddb925c042ae5a319c533d439d2e64023090ec70182b03d96884c934e8e74f496e14ee7874e674d8bbeda8fa598

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\sioynbwxrl.exe
            Filesize

            512KB

            MD5

            d550a13c3362e290830b9e5ec029c98f

            SHA1

            6fb6032f3417ce8a74928066dddb24ff9070dc7c

            SHA256

            401a99bb1b08597d8dca9cbbcbfc896106270a2dbb8bb754ea0c2b1409873b2a

            SHA512

            c9842ebb1d2a9c4d9c63a0f1bfd3c658cc34d402e6470d3989524fb2a5e9e88b2279a3ccd385b877e5444ba69c8b699cc28a870cbdbedfbdb2c013714b7b8192

            Download Submit

          • \Windows\SysWOW64\yxcylrzfciewu.exe
            Filesize

            512KB

            MD5

            93be27cf53f20b6c6c6842d98fbfe96e

            SHA1

            e54cab36e6d4b67eab3a097941e385603887b2a8

            SHA256

            d032c03c6fee3ffa6b91fddd0298497b506a583569459b09b5637328678ea234

            SHA512

            09263a44b8cf5afd255f1c88bec1b6e307706aeee09975ebfc27622f533f97229f9f1eff0b54a969abc8958e72757b3ba255ecc5322c7670174dfbdb60a7fba1

            Download Submit

          • \Windows\SysWOW64\zwidwqou.exe
            Filesize

            512KB

            MD5

            c2ef982f44933ad43f50960b2b1aea59

            SHA1

            e86c4b38371e0b2518c82730d9d301035dc725a6

            SHA256

            1b45c3b946f3079a5d38ed2cb1051d778e8c1522986b57c5a86ad6ad68f56801

            SHA512

            2c8530dbfcc059f20b26a77ce0bef9b7ec0997d15536b70dcce9f952b96d327983f554d1123cec822b0284c61c614f33e2953b2808c8e6646cc91eb9bfd59a53

            Download Submit

          • memory/1972-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2592-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2592-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download