Overview

overview

10

Static

static

5

4eb7984ea3...18.exe

windows7-x64

10

4eb7984ea3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    17-05-2024 06:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4eb7984ea3d87d5079e56676f15ff025_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    4eb7984ea3d87d5079e56676f15ff025

  • SHA1

    2d0cb8ce54718c78d0bc2fb6a35a19b49fa6a80c

  • SHA256

    24ef993d84f25870daa35e8eedc2c475ed8460487acb23b9bb1311be6286eabb

  • SHA512

    b3a7c4967b9b557560a207a6d2f609804400ec0dd075ef304bd08ead13e98cd17437aaef67c389bb36f215d57a7ce0e12ce56718ab4fa45228de90e0ad89d46d

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4eb7984ea3d87d5079e56676f15ff025_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4eb7984ea3d87d5079e56676f15ff025_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\SysWOW64\cppiiwondk.exe
      cppiiwondk.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\SysWOW64\yndcfhsj.exe
        C:\Windows\system32\yndcfhsj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2644
    • C:\Windows\SysWOW64\trzziylevugyavv.exe
      trzziylevugyavv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2628
    • C:\Windows\SysWOW64\yndcfhsj.exe
      yndcfhsj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2896
    • C:\Windows\SysWOW64\bpfayycisbldw.exe
      bpfayycisbldw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2476
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2472
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    2baaeac8b6dd2b7c41b9006042666e49

    SHA1

    739c38d0b62685e26973608163a3eb7f1a7fdd5a

    SHA256

    3118e17142dab9f31fb193d88496f1e1d2bbc0f8ca10ff1332cd9d391147b252

    SHA512

    3c5b333966e9e6579d37e06418006779203f2a86ca9660426209d365f3514bb555d40dc6663d619e850ba9865ae24593d24e38c0266eeb43f136df7fea9a2dca

    Download Submit

  • C:\Windows\SysWOW64\trzziylevugyavv.exe
    Filesize

    512KB

    MD5

    7eee25d10d5ffff25e6e15f2a5d68910

    SHA1

    73bd282c304715168a23db1516cfaa375ab36332

    SHA256

    a347f65fd8aa7c100abc4536d8e0c56e5ea91267d91b619953008ee553711ac8

    SHA512

    8843205d2a040bca3ef4d51b2f4bc79a19420ff0d31721a1135f9aee03dc9776306c5772720c84371b058a563590fe49a83c2a67e9052c8c58d2220ddb316f66

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \Windows\SysWOW64\bpfayycisbldw.exe
    Filesize

    512KB

    MD5

    df487e3729f27d99871dc194182cb1f0

    SHA1

    9f4018c28b0263577889ebdbf04ddc93c3c2bbf5

    SHA256

    024af321372af81a6edeb761c1d5bf35c5e467e792f446fcd5c58709066752ec

    SHA512

    8e9964bfb2b10fef070cb3fd22689b010832ccd667dc03b9ce00bc90282fd9384e284c1023d8d50b818a770aff33176b9acdb6f26e61b717a018adf1990ebe91

    Download Submit

  • \Windows\SysWOW64\cppiiwondk.exe
    Filesize

    512KB

    MD5

    2c6773b05df01b8254049690941efe8e

    SHA1

    ed7f922d35e7abe969fdf1542e306500668fefd2

    SHA256

    199ad77542aa6144a85bf038e19bcb548f90071778c6a6a8ffbe3217262b2c61

    SHA512

    b7ece0e56419fcfd63a376ce01ed65469840da179a870838c135eb52e9d9ab3ea606a6fec8d8ecf923ab2a32decb7241f27d498624466ba970047a37ed2b359b

    Download Submit

  • \Windows\SysWOW64\yndcfhsj.exe
    Filesize

    512KB

    MD5

    e5b1a2264e5f169aa7bd6d4d9b447686

    SHA1

    c09055ad6b28cef80c8197abd41dc7aad5545e20

    SHA256

    81b67518a98c250d2d2da4f25dacef1d99663be525f3d9de8f0b105c1895f823

    SHA512

    36c50550d7b0ad9857780ec359772c139e0e3b969f042b810441b5fe5d34e6294990a26e500c09537f81cedca5d48d0944059c04040d3b38bbf6247333db7146

    Download Submit

  • memory/2472-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2732-78-0x0000000002980000-0x0000000002990000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2956-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download