Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 14:28
General
-
Target
639d4a12b9c4643504550ff9736a95ad_JaffaCakes118.exe
-
Size
513KB
-
MD5
639d4a12b9c4643504550ff9736a95ad
-
SHA1
d37ade9894cd58a8e41e9b255e20d46f3080816f
-
SHA256
5d7a9888a35001f79776ca1bd7306aa5abe05babf308fb8d2ca8735db8193bee
-
SHA512
c175d5fa7358e402890e92cba9635a02bb058819cf322ab0f496fef24233d45bd813296c3a32ca68354476a9b986125a4ca4961f55b24802ed31e19ef397c54a
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\639d4a12b9c4643504550ff9736a95ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\639d4a12b9c4643504550ff9736a95ad_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rnpolsqpai.exernpolsqpai.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\lgrliwlx.exeC:\Windows\system32\lgrliwlx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\nsoavdrdfettmgr.exensoavdrdfettmgr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\lgrliwlx.exelgrliwlx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\snjfcquwtecus.exesnjfcquwtecus.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
513KB
MD57051b64644787edd3f04935561e2d167
SHA194c8392575c8294410acf66166e64c44437af497
SHA2562cea8e3c519244c0cf2fa35240eef14efd9ae184960bef52b9d07bc7a3ed2aa7
SHA512df0b90d52ee5248a4efc4d19ac11e400ab9428e11bab4956ba0b588fd1691b0a61566c440d1019823a54bc5211c62c24beb74cb245c1f533f522407478fe0a2b
-
Filesize
513KB
MD555be863277c7a10cb02b9f017a034c73
SHA1efd1c51349bb5c5dc285da02bb63c937dc7b2935
SHA25607912cbdd1c6fa4c7eced6d5af6a68593d7ebf17896c56199e4585700aa8ba7e
SHA512c2f650b9dd4d627a8ee599505b499e5e59ca117c09bea218cfc08573c6a809ec9546cc5022638e9e960b2c40153da88cce24eb9ebee605351cbb7938f71cb98d
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD5f28fc18156ceeb6e2a1aa3ed1293523f
SHA1d1c05b30093eb0a42461c43dfe1b467b781de5fb
SHA2568d2e634a8870b726d70e026bf76a901769dc790298f9ed8d1278f45457676f36
SHA512718f0444578887dc44d7e54b3ed5fabf4f781c50ecb766cb06a89680221ad30389738d4fee63141666cdc6e91de3e144c433f321e6d324722d8a93fbfd387e33
-
Filesize
3KB
MD5199573ee0e1b1b44801216d85fef9a2d
SHA1759db0f7d4b0fcf088c3ec19f317ecbc7ed189e1
SHA25607efb1b0fa42ddd69415fd7a1e8f850fac3626bedc00fa13cb780638d20e1f90
SHA512e30912a555d34eff381ab2aea27152ca47be5d763cd94bfaac577927716749ff3ac01045aaa33a76110e65a434ec027da09bdeb0262bd4be9b0df0f76e9a4469
-
Filesize
513KB
MD50be3abcb912682fef49a14a0b91fa846
SHA1d736edd96ad963626d807c38040ca87cb79c5ebf
SHA2565c3e6ae0991b69043f12e1e1bc6ecadc1e851bb39c99ef3d5b7f95aa7e6b83a4
SHA512e56f0f5ac3bb9ab4f8ce1ab048fafa7e3c6fe63a6caa6349cd933bf204f707e239ed1cb728121c54d06988cdeaef41cd8e6efeadc23de4c93a922e39d1ac6cac
-
Filesize
513KB
MD5e2ca74d37a2bc16f2d83e2c0ce0a67b1
SHA15591b84ab6b4bc4d980bddf9bf28f368314334bd
SHA256ab7632ba17d518d31d2d4d7a15f121e41ce515652723e3964672ba4ae0e196aa
SHA512573389fe43565b393130ddd7543df2fd15a54810129c9da76cb41915cb529782ff8f2da90e8896f5a4286c34891b4664f9b99ebf652c8a407d4e36802044ec16
-
Filesize
513KB
MD599e2623b50ee9267d2df33b3b720c3d3
SHA14a40857d91adeccc1fe1f4d5296f53dddb476f31
SHA25638c5cfb93870d2343e49c9c29b0a017f333de51d9aa2788eda49ac3d7d2904c3
SHA51223db74d20aca9f3c0803c1acb79786ebeb644eae5d84499188627564fe66066a9d412a86725845cef1d8b416da0938598ac40beea5ed509a50ec3f0e076424fd
-
Filesize
513KB
MD5f67286284592f133f1381ae003739801
SHA1caf3e485d058afbf72c8effe8837093d650600e4
SHA25650fb8b8846cc555fa3311d3c95c0f166ca374eaa87da169f617cf30d9088310e
SHA5121f4305055b59c93eb7b0b3268f5570c8b5a7741a46b0d19a0af82bfa826287208edae65eacd49931f5f3396c76dc77941ec273d8d7b2a3ecb21bf78053b00a8a
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
513KB
MD50341c199b261694ca6d62f6abd254b09
SHA139720425da65b441eda8824cbb4b7419fc34e345
SHA2564dfbc4b81ce2bf81a515bcfe86cf6154665af37cab61ffecf0ce83c782434276
SHA512002cdbaa10df90fe96faefd5c5400ce4ce0df83b2088bbcb24dfa25d0415e35eb169b066c35066a7ec9547c6fa9c9b3d38159fe8b6fb977d61cfa7991315b8f1
-
Filesize
513KB
MD5338af3e3f38607c6a94f34fe8ab1c2b2
SHA19ad3ab0046c55925b2081e6576036055f360c33b
SHA2568daef9923ae95f498c2b23e3b0f378b587c31820e9c8cd3fccc8ade7c5b09533
SHA51265c5a05a05200676e825416ebe97eb22b92ec5251c056ae51e86bb635fa4454761d60b7a045e2ba84951606947721708134ba1aa58f4d2ba9799d98307405364
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB