Overview

overview

10

Static

static

5

64c78c3a84...18.exe

windows7-x64

10

64c78c3a84...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 21:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    64c78c3a847e601eb08f30eae705cfbe_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    64c78c3a847e601eb08f30eae705cfbe

  • SHA1

    a7875430886c05373c7ac9e6b72c0d2f983a6bae

  • SHA256

    db139e175001c4f45ca3e821a8c5d1cecd365c318eec760f538e876c92e3c9af

  • SHA512

    1714d298757d0a3e3710ce1efb70d21747d2ff6209842e659a0c596aa5a03fd58f85d95d493eda462d5ae971560553bac411114327251a06bb01441bd052cf61

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64c78c3a847e601eb08f30eae705cfbe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\64c78c3a847e601eb08f30eae705cfbe_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Windows\SysWOW64\qwbhzlkwwo.exe
      qwbhzlkwwo.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\SysWOW64\etleemfh.exe
        C:\Windows\system32\etleemfh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2816
    • C:\Windows\SysWOW64\meltyjvpfkecnxt.exe
      meltyjvpfkecnxt.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3004
    • C:\Windows\SysWOW64\etleemfh.exe
      etleemfh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2728
    • C:\Windows\SysWOW64\mmciwpbujnynr.exe
      mmciwpbujnynr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2860
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      ba2f47a7c71522495c5869331376ef1d

      SHA1

      886187ed6363ee2bab00e8f6f9bad7db6b361b6b

      SHA256

      3c3db6ef3627c9b5537047c07c69cf9e6210b698e5a5612761ed081513f4f0e2

      SHA512

      1b939e706fa04b2502436f32af415213d03f0e6f5721342e3440b63bccb1df1ca57ff75f06bedb246ad3055f66a64339874aa2a472b616edcf92629c9b85db0d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      64B

      MD5

      12a4abbdf9ec3611213e84f0001e4bfb

      SHA1

      f804761a5b249c84f7981e3b97b524fc4e39375e

      SHA256

      299894db4e3eb54ac0183522818b9b02c317b897d8a404393ccdd03611fa76c6

      SHA512

      af0ec4fae2257801642997df0fa09a6ce0f2c403cfa0fa6b9a2508a22baea7f141df228a35be1583a70f13db33dfd2bc932393d468e71524cd67ec65824b9491

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      993153b3e7e3f43a60f476ae145bd3e2

      SHA1

      06dfdb0391d4ff14d6fac055d7d2df01a470d57a

      SHA256

      82ba517088cf2caee6b15a516e20f56825d71ff29f62d6d184f8a937bed33ca2

      SHA512

      f56a00009909b1f1a0100c1919479abdf47154432cbeef7a8eaf30297c1d581ae48592f4eaf1ddfb50c18fb592cb430863a19438c8b79a57b9003b22e103a5a8

      Download Submit

    • C:\Windows\SysWOW64\etleemfh.exe
      Filesize

      512KB

      MD5

      0369efa2d10a43481341e4503b05f5f7

      SHA1

      9d61d861533201c42f8f82bcff9957e866e04d65

      SHA256

      5b146aa9cf7e87cfe4a3aaa08272b7ccc112709849944c55899d335861eb58d1

      SHA512

      6426785b00aadf3d1ee4caf8ffde0cd66bb930de535c0f37856869098a8182aa81e1183de2a535416ac29fd698aae585fe557eb53b4363ce0ad758dcb635f447

      Download Submit

    • C:\Windows\SysWOW64\meltyjvpfkecnxt.exe
      Filesize

      512KB

      MD5

      c1053f04de409f57005ce0908482c7a9

      SHA1

      2d7a862abfe854970d1fd9237b676a14a0d32242

      SHA256

      68793a6ef44cb5378aa7197efce426766630cd4f242e97612df7314baca7b31c

      SHA512

      6aacb7c4c6734f8dd04a0f43dc812c6e9d5c71a8dc950968f7f01478c443be93ab7f9051b4d0688d8cffdd9f4e1439b092385284c0bfd3b152421175059929eb

      Download Submit

    • C:\Windows\SysWOW64\mmciwpbujnynr.exe
      Filesize

      512KB

      MD5

      972326624f9c0a8e20d995fa6bc437db

      SHA1

      93518c76d51e689603d454dc10d8c7e6262f4d85

      SHA256

      6be7776b9fe32c6eb60923feb8058ca6f7ada9abb65620b7717bd44961e8ca86

      SHA512

      591d76c304faa44d14970869dd515bbaea29a53deb8fba1efda3abc137936c11d738bfae2fd7f9cec763ebc155fdfb57e6922e103892e882039d8b5f44bcd41e

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\qwbhzlkwwo.exe
      Filesize

      512KB

      MD5

      72ec258f72e1b0f71eeaab3353a8d4f6

      SHA1

      da97e89e28226d2b7ffe58dc8e5cca63d97f5212

      SHA256

      4fa76a1e7b393d025b71b7bd169cde64ad1999105f1593a5a18949dedd382a84

      SHA512

      28e42b4d6149d28523b74e058a9a5467f1a662549dd11892981eca15331ef864da36f7c0468e00ea018d7ad5d25ca2274e804052a870dcb550e5dddffae4bf15

      Download Submit

    • memory/1940-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2616-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2616-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download