Overview

overview

10

Static

static

5

63a271d156...18.exe

windows7-x64

10

63a271d156...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    21-05-2024 14:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63a271d1562d1e00a3903e6e48bc33dc_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    63a271d1562d1e00a3903e6e48bc33dc

  • SHA1

    91da9c4745c73bd1987d3005d9f52aec9027095d

  • SHA256

    24fa4395dfaedd03b6cd5cb14a5ed0fae1706e1a40717a2ac41e4d8cc152735f

  • SHA512

    88726b6edd6f9b8d278229559373dec2620ee3fad553f9e452e44c647a944a20ad12c79b5ad4826a642baa461ce23cc9bbb61f7a730d11ad1eb0cbbea1080efa

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63a271d1562d1e00a3903e6e48bc33dc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63a271d1562d1e00a3903e6e48bc33dc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\SysWOW64\dbemmlmzpq.exe
      dbemmlmzpq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\jduxdecz.exe
        C:\Windows\system32\jduxdecz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2612
    • C:\Windows\SysWOW64\kbrfxcsskbckotm.exe
      kbrfxcsskbckotm.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ojyryyhyukrcn.exe
        3⤵
          PID:2860
      • C:\Windows\SysWOW64\jduxdecz.exe
        jduxdecz.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2720
      • C:\Windows\SysWOW64\ojyryyhyukrcn.exe
        ojyryyhyukrcn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2580
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:1060

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Hide Artifacts

      2
      T1564

      Hidden Files and Directories

      2
      T1564.001

      Modify Registry

      7
      T1112

      Impair Defenses

      2
      T1562

      Disable or Modify Tools

      2
      T1562.001

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
        Filesize

        512KB

        MD5

        4d50eb9cd53392e8cf694cef7e92086d

        SHA1

        9043a49381499c3deb00dc7628f63e5ddbfd4e42

        SHA256

        695e463fd13a9016a2f526a64ca37c1a07da9dcbb67fd47a9adf8d5e55e11927

        SHA512

        18738dc0c7a64701356c39ab1d5be8b9131ffcc621661260e5b449f6ebe8e58687c2a6ce808cd7fec0dd81f4db959f135dafa4389afb719f59850162f7d6a305

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
        Filesize

        20KB

        MD5

        6df27674ec720b3cdfc0691f8c07ad3a

        SHA1

        2b2d37d756e0d5965aec84de7661e22141777b32

        SHA256

        171ac16b50a00eeeb8187a72f12317e831fb7416de423300d0f6f27a577a45c8

        SHA512

        71d293c1c66077a7534e87b11cf50303e5b306fc5a43190144fd154d29fc2f5ea38f43f9144e82dc3556923bac8a80d2b22b3ca9b73920db7269cab278bbd19e

        Download Submit
      • C:\Windows\SysWOW64\jduxdecz.exe
        Filesize

        512KB

        MD5

        23e1638848876a2c2b4d31755e87bd97

        SHA1

        db3f84944d6f8e3a3d99cc640c05150103a74a90

        SHA256

        46b86044be1ab9ab8cc0ea83997cdb81c6c1033019f2f5d03934f51884f8f11f

        SHA512

        aa331b206d353f7c93f3e892c8fcc24a7a410d91e292e9b5029b2f04922d3d96a939dc6f4c7a459adca56e6cfd815a0c9ebc5f7ecd5434efbb971b920b1cb934

        Download Submit
      • C:\Windows\SysWOW64\kbrfxcsskbckotm.exe
        Filesize

        512KB

        MD5

        1970d0861d997ee9aa0aa9544d63fb7d

        SHA1

        9ea2aafcf5e4ca7f1e123fb611123a8bd6a9bc6b

        SHA256

        07491ccb61ced5ef21b204e0bbd594bc2ea815127b4a6492f2a6902652417442

        SHA512

        2b32a139fcf81b236dbdab46d55bc57350ceac0ec6180ea1d05502759632b1eb7a95990be8f2e9d6baba43e95e458e67885b7af4639707ad073d7444c4f3dc7c

        Download Submit
      • C:\Windows\mydoc.rtf
        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        Download Submit
      • \Windows\SysWOW64\dbemmlmzpq.exe
        Filesize

        512KB

        MD5

        267a38b4d31bb0d1df33a2d554584a63

        SHA1

        468eb8887ddcdcbb4d836ae8770d61971a372055

        SHA256

        5a3a326bfd26221b328e0f09435d39c1915151cb6629bd998c43c847f84feb18

        SHA512

        8afc0897f3ea9f6d059b18bd4039730aeb0bb45900984217036bc55ea44d323d3faa16ccbb4042d462253ab022e80d96f10b67946f3304d9ef1573f4a11995ae

        Download Submit
      • \Windows\SysWOW64\ojyryyhyukrcn.exe
        Filesize

        512KB

        MD5

        7e2c35c5f09c279be0c17e800e3abcec

        SHA1

        9d7883ce506f1d7f0f12822e50ce844a469c7886

        SHA256

        58503f14b9f2631289de9564bd9dd3904530359bec1cdffb1ec5cfad1fb4f367

        SHA512

        eedfe1cd9183c74cc1b918e462b856f3b7ab288b8d68dc00d2f79a309e884e48ba88991c1ed240ee70c97ff13d7d9143756e0d59af7773f9215109a045959c78

        Download Submit
      • memory/2368-0-0x0000000000400000-0x0000000000496000-memory.dmp
        Filesize

        600KB

        Download
      • memory/2452-45-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2452-92-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

        Download