Overview

overview

10

Static

static

5

646eb58571...18.exe

windows7-x64

10

646eb58571...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 19:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    646eb58571f043feeeb858b74b55b7f7_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    646eb58571f043feeeb858b74b55b7f7

  • SHA1

    a7a3783d7b692ff6fcd67e4517c240a357c868cd

  • SHA256

    aafe4c210acaa99b8c5061db170214b324fb960831fd39b6c05fc363c5c3726c

  • SHA512

    6165f77c4032271bfd3f220dc8864a3c177374046c2d9b8e7a57d77d860a9e5f37ff5a550c5bad5619c4e2d46ba27223d2ec1e7f2203d64775a37ea3fc56d90c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\646eb58571f043feeeb858b74b55b7f7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\646eb58571f043feeeb858b74b55b7f7_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Windows\SysWOW64\aftuajahrf.exe
      aftuajahrf.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\SysWOW64\xksrgxul.exe
        C:\Windows\system32\xksrgxul.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:696
    • C:\Windows\SysWOW64\insnvdbawjfbdud.exe
      insnvdbawjfbdud.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1940
    • C:\Windows\SysWOW64\xksrgxul.exe
      xksrgxul.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1264
    • C:\Windows\SysWOW64\odntoiauxyzhv.exe
      odntoiauxyzhv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4612
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          91249bcadf573da852609c6a2216fcdf

          SHA1

          e5f51cf7dd6d57525e70765b03c447a9fe1fdba3

          SHA256

          3607c4f7653ba5492ebe925fa2fe3e4652547872e151b27eb3f21ec567ea9ca5

          SHA512

          94caf114889005ac64498abdadfdea63aae3738f3e50629ea1b9c07e85774c166516f26144f51bc1b64a1159222e83b1c7ddbb18785b49dacfb95e797bcba31f

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          809346f6b90b7c9b87ab2b4c2a8b61e9

          SHA1

          f70c6a6969cdb4030e8c9c8ac22db0bfe9e44d4d

          SHA256

          c88518c4ccd2a439ff108f01352db9c5809c176a5642b7feb4c37cfad47cacd6

          SHA512

          f277b42a5b4846d92406ac394aa0e4a6571bbcce6df381b0af6fdd3b044a4efb26fdefab4174226ed4673dad48cb380f9113d91fb2ca2d4dec86194b832c6c1a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TCD8361.tmp\sist02.xsl
          Filesize

          245KB

          MD5

          f883b260a8d67082ea895c14bf56dd56

          SHA1

          7954565c1f243d46ad3b1e2f1baf3281451fc14b

          SHA256

          ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

          SHA512

          d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          Filesize

          239B

          MD5

          361ba5cdfe246f4303b0a1638e0daf43

          SHA1

          eced7199b1af3c8e92209a68cb9a925ff3f369a3

          SHA256

          507143acb38e64408d03a0dd98e16bd34ca557294c466ae8ec9c7c763eb3a2a5

          SHA512

          81b9d124396d138717aea4dc71cec59426a3b65b47eaa0d13523adf030c5e3df9fa670ed48f7634d0301812d4b546dd43bc5bf863b58112570a2ab049bc7ab54

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          3KB

          MD5

          c85248323feb447863a00e94e12d4309

          SHA1

          d2b9fa1269b4bbf8b9d43a6582c927fff5d3ce96

          SHA256

          8d72f8f79e685602815778b4a3f9875004c014fbd2ac0ab472a9e6215e931d9d

          SHA512

          2194ffbf84f8eb1d02ad7f14db58b3b21a6246e1bb34280a83e0371991fc73e468a5eae9680ddf20075885e18a07aa505976570d07a9b3250d8cd9300eaccf42

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          3KB

          MD5

          c373030bff606c52ebd9ded0a182d1a3

          SHA1

          980fc31248bbd7a39cc28ab58a675a39a2d26252

          SHA256

          cc31e0cf6f6e67349507ab875db46084e7f620fabc2ef3dd715757ed072c413b

          SHA512

          82fbe5858f2b2ff362b26eb8aa7b65b415c3ce2e49f15286b236ded359ec92ac102d0c925ea1338e49edc3d2395abc75e84ab1fbb36aa958161d6eb94a8659bf

          Download Submit

        • C:\Users\Admin\Music\CheckpointComplete.doc.exe
          Filesize

          512KB

          MD5

          c3d1198e3eb5df85d862b93572c333d9

          SHA1

          23ec5a704616ea822bd4ff9fe6e7086e91f64b44

          SHA256

          75d4dc551b8779fc360b63f726f9e1d6a2049487b140d9d5f7e40e9e4e709166

          SHA512

          85ce65aa59d8ce39ba3a97dadf0c47ce06dcfba1038a4d7b35e3f937330b9293c02f9f949519968ac1d7834f18c581e63e7dd8b500f927a526e0435278497002

          Download Submit

        • C:\Windows\SysWOW64\aftuajahrf.exe
          Filesize

          512KB

          MD5

          66785071ec510a12efe7bc218889c191

          SHA1

          25825eab8ade86345ec04d27552cb68749c3404b

          SHA256

          1e0163c68c8e5fb41c7367f1f57c9077315b6810c50a224208e80561a9953d20

          SHA512

          eb2d34da4880733cdec4dbebd99d6c8c7c0cf779a211709b3a0785371716e73a8f04995544fa3e87c4fab85077e67e7bff7153eb552f0d8b7efe708f775538b2

          Download Submit

        • C:\Windows\SysWOW64\insnvdbawjfbdud.exe
          Filesize

          512KB

          MD5

          1f38a8dff60bce47232d2e14105b2313

          SHA1

          633ed27cc16f0a74bda14a1b7b5b04d184d0880b

          SHA256

          6374f60db69314dd3582f608772863c4f61e905e5758101c2ba6510b545a53b6

          SHA512

          56e0f37143caaca7d8cb0648af3d2b12a57fd3e815972c4e29037e7ba5b0778159e2ebb1a22e08aafe19d51e1b7b73245c7d2ecb8320b12e7e0b6d2feabc009c

          Download Submit

        • C:\Windows\SysWOW64\odntoiauxyzhv.exe
          Filesize

          512KB

          MD5

          3e023f11ace58a233a0c4752afe9fcd0

          SHA1

          6c96709dd0a434c3608bfc81414ae96c8133b9d3

          SHA256

          31c6f1943c85d6064db5aba7acfb595402fb6d626356db8bfc4841163295ae43

          SHA512

          3ec9236818a4df0e7264c0458aad919d5d5a7716926bab4d68985ee974688d540c5854aac1bc513b11b046c87c9af7d73139dd90dcb3338453b92868ee405870

          Download Submit

        • C:\Windows\SysWOW64\xksrgxul.exe
          Filesize

          512KB

          MD5

          b79dc15b192bfa4f736cd46bc68f30ea

          SHA1

          3b17112299679cbdfe17a2b03c3ee24492280e95

          SHA256

          094e4df4f38228be251b155959f6a670b258ac2f0dacc26e2318663368396ae2

          SHA512

          b8a26599b434e629399fcda2e8630e348b265b4a03218b0ea60a91bfd2586a2b0aed21f594c8c089a1bdb9905a7272713ea51123f5506125785088f417af7376

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          a33091b5037db1aa105fb0f1d6dda7e4

          SHA1

          c9067cc548309dde288c2e586a6a63d7252c06dd

          SHA256

          40820b423c9e22f6dcc20f9b2a72ab20664448a0e4ff6af71b7c7295a832db2b

          SHA512

          ed1b2b68df9c9adaae05b21ecc1e11e78e0a30b816837c1a959b1ef61d24c0b7218520ec4721edd2cb2aae1590b3bd523022fdf9dd532716fc55a63e052d2b4b

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          0bd0ae615fb3b829c04d2830b7d88835

          SHA1

          9f575721332ce72c638d4135a55c6151a0255802

          SHA256

          b51c545b3be6eb250b8ecb3c04e24b866bb599bb04fd4127e7c695ff1cbd4d5f

          SHA512

          bf8c156ff36b09bb104d56a475941ee07d738a89bd61f8774676f1669d364dc6a784d2275be11f4a004fdc58b2396243fac649246f9927b86e2b7155852b5eee

          Download Submit

        • memory/4260-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download

        • memory/4524-41-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-40-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-38-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-39-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-42-0x00007FFEEC7C0000-0x00007FFEEC7D0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-37-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-43-0x00007FFEEC7C0000-0x00007FFEEC7D0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-606-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-608-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-609-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4524-607-0x00007FFEEE9B0000-0x00007FFEEE9C0000-memory.dmp

          Filesize

          64KB

          Download