Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 14:34
General
-
Target
63a271d1562d1e00a3903e6e48bc33dc_JaffaCakes118.exe
-
Size
512KB
-
MD5
63a271d1562d1e00a3903e6e48bc33dc
-
SHA1
91da9c4745c73bd1987d3005d9f52aec9027095d
-
SHA256
24fa4395dfaedd03b6cd5cb14a5ed0fae1706e1a40717a2ac41e4d8cc152735f
-
SHA512
88726b6edd6f9b8d278229559373dec2620ee3fad553f9e452e44c647a944a20ad12c79b5ad4826a642baa461ce23cc9bbb61f7a730d11ad1eb0cbbea1080efa
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63a271d1562d1e00a3903e6e48bc33dc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63a271d1562d1e00a3903e6e48bc33dc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\saebifaqki.exesaebifaqki.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tjvuaium.exeC:\Windows\system32\tjvuaium.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ylcnyvndflrcljo.exeylcnyvndflrcljo.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\tjvuaium.exetjvuaium.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\bscstmrorjweg.exebscstmrorjweg.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5f3fbb4f82c8feb8d77259b2b1ecddf80
SHA13d1ebf062879c1fac108c3339c49ff17968ce391
SHA25682b522d2f827a6001f3d6a34a9bd0ce5f4e6719cd27c342d19422a9d7bc634d1
SHA512edaaeacf664c6363a8d1858002dd333c2337c2c4096be179c5734ffa512f3bc4dc62c8a0b6b1972846f22f8dfc0137b48f45f7b67b693e745b9fd2e6d225256a
-
Filesize
512KB
MD5426675bcd29f584f76d0bd7bf7c06ac9
SHA1fb84a235b4eb69807652c78c526267c1585863a0
SHA256f608a912f623696e17fdcfa9a5a23bdde10c4576a9cdf0c6705f9303eabb3aba
SHA5123ed7bd339e967ef84abc257af1ad5f7925633c1e4ba11376684f24ca2b4a0ad2c422e71ee181a2dbe778c2bc65de4c5f5e7eb82037a7ffb757bffa0e90723c40
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD521e03aa411333a4fcdcc4faf9eac1ec8
SHA1b5b0f8875f8daaa3a01bfa7e0ddf5f4fcd344584
SHA256712bd915768a6b2d48de45d476217d9155c4888b0201d17feef4f36cfca802d3
SHA512ef54be697ae36b06e310a98ab61e9d386c2ecbcf274139c1e74999f835c76ca3b9c2d270074db27bd52c902b19ded05d5941db383a761258526005ae0fc408e7
-
Filesize
3KB
MD5c1ba6d19053a7a67023b1f96374f9207
SHA1dc521bce13edbc8ee134fa6d3075b1f15027df94
SHA256bf4d1f6f13a3811f2d33f24b6204d3e87c4570538d8ccce85c8466cad593185a
SHA51221e8c6a45b05105f5a3fa35e86bfe214c30088c353c2cd9c92ddccdfaf17afa6e6856b074a395222e88aabde8dc51a597e7331f68d3c8f6acb89ee4efd9230cf
-
Filesize
512KB
MD5ea48b855dad9c168aece407775c36ae6
SHA154f82180566b6534c8bdef55b86f5b6371a38131
SHA2567aeba073e735675b313533468eb0b04c8b70ac757000eca2b01b9c3d9db40fde
SHA512b5de6620211154f5e6563357858b5b40634d0dfe1d5fe758242f729027781b5014aa4f5f23efe9120b3e06e6743f543165770aba8ac4c08a2c8f4d2dab428468
-
Filesize
512KB
MD5b9d3c9ebdee934bcd396f8e5a40c397a
SHA1e31806aa82a3d3ed8723e103758660bbb8433dae
SHA2566337244f84d5a3aed9ceec9ffde6fdbf86452f8b0fec8fd855ecc974d4ac6e5c
SHA5124ab0e4c9493dd63075c0013a9a1ba744ceb9610572ab8f027c509f8809dc7c90f47d2c52ecffce68206a8480d24304854bcca2c0392e2d51c9f203fdd6cfe64f
-
Filesize
512KB
MD589ba646336f5fdd46284def03cc6e142
SHA12763b2755722c13533dac4a20d1cb8f3465e079d
SHA256d42dab7257d3397dc6d6fb5a5ae08dd9b6caa81470f3b5e09f391cc7b30fb38f
SHA512e174131843fa7600e1ce1c8ea08f70e6e1286b4579d33583a2c32a7e4294396ee77b141be35bf3b35e167a8c6241edf39b70403aa130fe2dc4ede67e6381ca41
-
Filesize
512KB
MD53f7972ae5641e6f9a617118d3649617c
SHA19f94c048c6c8da5720e181133b3d5e8b4dff7507
SHA2565beba2bedc4991ce0c1d4ed63ffd8c90da9ff3c5ed2248de9764636313f4e294
SHA5128789d55841af0c773512873dbf0913b8c963ac9839276c343b3c98ff373f2cde74d9aa86e8a4861997fcaa2674fb7c3dff1baf111f6c22ecb53dcff78a4e5903
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD50d7a73353dc926ba69cee676deb61b0b
SHA198cf1ac671b1484241d1281bd0ec1f256799a5ce
SHA256b40890afd0240f0ecbde4d36b15e973c233a09a3736a183054833043853c6111
SHA51235f717b3b451b9a65dcce5b07621a1db08a3665eba506963a5abde5c7d63f07a764df364ddfd92609a2e0b3a0b548f2a02b2f1809e5b994e31e2b592dbcf0ed6
-
Filesize
512KB
MD54fad64a24be5b3ec0ee2f71ad6d7941b
SHA1f76cf2103c8de8ac348ebd3005949be2978c1c1f
SHA25606aba200fc23c8b55ea38bb8656a34f9f9284e6040e2ee69029363a9c0954a48
SHA51289a8daabc7059438b44dc2381ecc0afe944cf5093c98a173aa5ac95f89df7222922fda4ec1f403c4b4d7e272a328eb0ed989f38c1b7d622dfa6aa339b03f8d1a
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB