Overview

overview

10

Static

static

5

63a24a8d6c...18.exe

windows7-x64

10

63a24a8d6c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 14:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63a24a8d6ca7b81f9ab13a3573856d53_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    63a24a8d6ca7b81f9ab13a3573856d53

  • SHA1

    8f3fb98762af2aedde63d30306b2e16d527d88eb

  • SHA256

    ab59175e370241bd828506dcbeacef6982a1db97aa5ca4135585336e6a994530

  • SHA512

    382fdc9f01f667dd8eb1f0b283c42a19c981e2442af128ffc01790061f96a85e98d62010c9201e1be9e1ff27713a8c274130fdf2e030d0393e82031befda1169

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63a24a8d6ca7b81f9ab13a3573856d53_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63a24a8d6ca7b81f9ab13a3573856d53_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\SysWOW64\ckdnmoxqiu.exe
      ckdnmoxqiu.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Windows\SysWOW64\lopfarui.exe
        C:\Windows\system32\lopfarui.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4236
    • C:\Windows\SysWOW64\ueostodmhprvyhi.exe
      ueostodmhprvyhi.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4912
    • C:\Windows\SysWOW64\lopfarui.exe
      lopfarui.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:428
    • C:\Windows\SysWOW64\sswleozvrtoeo.exe
      sswleozvrtoeo.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4820
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2408

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    f5e4bc94ba4711cb5e91ffd9dc00964b

    SHA1

    955143c89a2e8cd94861a4ef15cf8ccea22f22aa

    SHA256

    c1e622053018ddf652c1400ad9fe8b404d095e056a39d1a3144eb3c5a7971782

    SHA512

    8b6c4e5ccd6b29af170ac2a869feab04401d8b157f0a879153478099522cc0a7dbd8b62a955c5b129f8a4276e31cd38179f1c74a4308ae6b0897c3bf0d6725fd

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    db8b2b771d5831da2bb897fbd3849326

    SHA1

    188bd82abaaa564330a07542e7437f31451e0687

    SHA256

    64f00909c7bce6f07e83bab73347c60a0108cb95145cda75e0b39d3f01f229c5

    SHA512

    17bf469812f893ae35a04a4bbe5b9ab93f5746ad4f49af2d40ed08f87825bd4cd130379e3302ed12116b8d02244ee9e1cec8b160238c031d65ddc2d61cc0794e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\TCD8B90.tmp\iso690.xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    602dad6ee0e60cde6698692534ef100b

    SHA1

    c3e20be4cf62746964ff865964f4f354d412bfac

    SHA256

    596069f7c5d4c9cea8266af60fcc730fbaec42eb5dd0c6f4203e463b742fb598

    SHA512

    bc1fdcc479d9d46977847557985ca1744f1d4f135da27d82dd2f131419c16fbc70968eb27458a1769e59a9a166847be39aa81b82936e39e753d578ee13df8669

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    f9be6cdd252a302f2e57175928faa091

    SHA1

    c6aa8dd58af43549cc4e66b499fe0a1133215e70

    SHA256

    6fb011a399e156736ab3805a23b790f9ac0ea8c9d08adc4c9d217bdca801db89

    SHA512

    1f9d2bfcb0372f8f9a39b57050fac8b1ce968cd671f6eeba626d337145ba2b5fc15e798b0eebe66e3da126b85ea8e4d9318a775321d2825f46d2ed789bd3d330

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    ab26f568bcc3b13df71049ae701b0260

    SHA1

    c6ff11e727ae415d8f3faeda0d67d074aa2e4520

    SHA256

    f2599a8499b591d980175de853c5d67b1dfe67af7ba4fdc28dcc386a5b1fa422

    SHA512

    26bbd5ef556325bf63e514b1f5bf1d9addd90e0372fcc1ab6f68255ea4bf41fbb8724ea55e4e603b75f1f553fa301d27b644b8d40b22723306597c5eac0a6bc4

    Download Submit
  • C:\Users\Admin\Documents\MeasureLock.doc.exe
    Filesize

    512KB

    MD5

    dad13e53a1d4f5d404ceb2c1a7e2e9a4

    SHA1

    f0412372a76dbf2f9d4d3648cbedc1cbcabfebab

    SHA256

    6c0b412bc6e12a0e8ec916f57975021f2a39728d639274a3121559751de2b92b

    SHA512

    4668333dcc3f31e72bdfdfad2f4ecbe34af594c27778645c2ccf4d472eb204b63a191f881a41ebd157d9e7ee3b93d0b304280041f6d2ed4bcc3bf950bdd73eb9

    Download Submit
  • C:\Windows\SysWOW64\ckdnmoxqiu.exe
    Filesize

    512KB

    MD5

    a86b9858e94d006d18d52242f51ff208

    SHA1

    65598bf49023d178fc1cfa319b1af87b5011e092

    SHA256

    4634433766264e4dd910cc9517ebb35f9ec00ef8b58fd00c9cf4a8a426584bf4

    SHA512

    0c1946aff02525e50526306382e48e7f5a203fb7407ba3a507012b3592e130f5a12c643a94d6886d5f1cffac1961d91b9a617fc8acbc39c4041af552c1e2ee20

    Download Submit
  • C:\Windows\SysWOW64\lopfarui.exe
    Filesize

    512KB

    MD5

    573c1f4a212e01737089e9c954395803

    SHA1

    b43c5ec144668aba265057f39f175a859b83dc47

    SHA256

    ec66457e0baaa5d9b7cdbbee1fb920f5994ec182a128db71c61326ff471f2605

    SHA512

    5751aa86e45119a6ac74fa45e46754fef0695d65a8065dfd5b776d459d537d22e650805eb0004b8b5763b54ed4e93b4b9103a67b54fef562826f16b5d58a85c5

    Download Submit
  • C:\Windows\SysWOW64\sswleozvrtoeo.exe
    Filesize

    512KB

    MD5

    06bdee874adc46a291228a1b4f4eccc7

    SHA1

    f3f5a0f19e43d98b3447cf96c8bf2350d8dc9a49

    SHA256

    6d352ef6837150b6f7ec504b28c0ca815438ebbc5e5a00d80a6503423650e968

    SHA512

    19f336c0ee834393beecb56b92a754c7a3847a7b5a41e08bbc29fcad47557d5bea9b36faccbed52747d8e7a9c7d301f1d012ec4d173de8c518e2c05b6918a0d1

    Download Submit
  • C:\Windows\SysWOW64\ueostodmhprvyhi.exe
    Filesize

    512KB

    MD5

    a9ad1d96394a062eb3ab1ce789276dff

    SHA1

    304bb3ffd17824eaf1e6a53044dea2a038f55b61

    SHA256

    de3217608282c5f88c694cef27f5dfb220390b77f0248d84aad8121c558bc1d5

    SHA512

    20f966a3fa45ca350697746551d005e79c3948598e3c523f5bb55d5ae9037ea04fa216407a88bb60d1a5a4255dc0dd3571358f69b83bcbf7c85f7fe554002c1e

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    b9e4c85b3fbb81f55acf15b9c8da2333

    SHA1

    bf2f47599f1391707fe6a5582d2d6ecf5c48099c

    SHA256

    35baaec48213eb1d4db7f410936604aeb8c5edec84a009ae6947554c1c76916d

    SHA512

    57c7cdef2995d6dab84ccae64fa5c0feeea00377031c021556013fe5834dd138475f34b28fb7c2e932c35dcc6b2ad025373a65ead7a156637ad0a70baf91b64d

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    7ea1022bd907067b9be326b70af227d5

    SHA1

    dd5c44c9e7cc964426e8ecbc968866541b57f27e

    SHA256

    9f49d1445de4a6fca9a0a69b7af773264973833859c58286cdf393c64f6b0c0b

    SHA512

    976fa62aea847d3950400126af513ef8347bc4207f998d234ae72051d54526b5624993324360667c237d586aec70c8f4b2ad4cb96cbde97fd0695740b1bcf8af

    Download Submit
  • memory/2408-41-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-40-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-39-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-38-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-42-0x00007FF836C90000-0x00007FF836CA0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-36-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-43-0x00007FF836C90000-0x00007FF836CA0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-608-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-607-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-605-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2408-606-0x00007FF8394B0000-0x00007FF8394C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4768-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download