Overview

overview

10

Static

static

5

68d39512f6...18.exe

windows7-x64

10

68d39512f6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 22:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68d39512f62c68cb8679a8aab38a95bc_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    68d39512f62c68cb8679a8aab38a95bc

  • SHA1

    b9b313c1f465a4ea90fb46e55bc91ff529c91c04

  • SHA256

    a93919d83383eb8f0a1a90735797f6434880a51719ab6672f2c7e665dbe39a81

  • SHA512

    0a3566a997d170a26160bf693b63e15ac69a7955673d9b4ce0d1cce2a980ad5de54c8d619059798bc7a702912d3b33a1f62b0fc4189da929817c1123fcf4a02a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68d39512f62c68cb8679a8aab38a95bc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\68d39512f62c68cb8679a8aab38a95bc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\SysWOW64\wtzlcahlpe.exe
      wtzlcahlpe.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\SysWOW64\somipvjf.exe
        C:\Windows\system32\somipvjf.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2520
    • C:\Windows\SysWOW64\kovcyootocjmair.exe
      kovcyootocjmair.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c iqkgzrzmjrefc.exe
        3⤵
          PID:2716
      • C:\Windows\SysWOW64\somipvjf.exe
        somipvjf.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2664
      • C:\Windows\SysWOW64\iqkgzrzmjrefc.exe
        iqkgzrzmjrefc.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1152
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:1992

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
        Filesize

        512KB

        MD5

        5da605b18d2d64f4000f8777d596b636

        SHA1

        89f22487365b519d6373e7aa681ad73738209fbb

        SHA256

        f21e5b44adb29ee7da50e1584ba49c9861a8f674bc56a9c4927096e4cf322104

        SHA512

        04c35d7531f085d452cbdcddde4dab62ae4f544f366383553014f7b0b08124fd4d68f3ea71e5ab41f4841ff84bb514a5b10c8b0fde6ace60db256140cdaa38ba

        Download Submit

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
        Filesize

        512KB

        MD5

        61804c01c8a937c7da9ecb2ff198b911

        SHA1

        84d2395f29b8ea735b523564b033fb7d69a0abbe

        SHA256

        80f7ef9a0dfc906bc026a3634a289a07bbeb034c6609f7c3fbaa9738cddd0d4d

        SHA512

        0ec31d9e3565802588971ac618d68fadc6f249b953b96093ee12b834f1b146eb87d6233eb89e99f0e9941c6e433dde1fcd9f6f96dca9ad079d1bc945275d8f88

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
        Filesize

        20KB

        MD5

        d34fb283d6a93fabd2e944bd7bca2959

        SHA1

        d5447e8f4164592fc0932ec663e89d6902c57a3d

        SHA256

        3cd923330ffcf926c3d7ab2f934ac6fe0cb8b92350fac5b0559d55d53914e772

        SHA512

        5f52bceb7873235e4e8359f54b659ca0648078cf74857f21abce4843c1e707a589f7d4be09d10d6cb867c1abb895358253c950a5a8414e4c06fb4a57753dd809

        Download Submit

      • C:\Users\Admin\Downloads\ImportRevoke.doc.exe
        Filesize

        512KB

        MD5

        4c954593373cbd1894e531aa2bf2ba09

        SHA1

        930262186a0608696aab8d260a81bc45d672b4d2

        SHA256

        9d5c1a5699b7b6fab16fc5b5d6911e9f91c5482b7e0d50c4f5fbe9c66d0bd520

        SHA512

        a4edc6490c85014e3c2bcd65ed59b5c1718ef8d7abf117b2b8f5a144a6eb6443b10299c719e50e8e17bbfa756fa9ef59dba75559c3bad450e41b206e556cda6d

        Download Submit

      • C:\Windows\SysWOW64\kovcyootocjmair.exe
        Filesize

        512KB

        MD5

        d6ffef1de8f4699976287b529c347518

        SHA1

        84b6365bc4f2359d75fd02ed89289f7d6c2ee0e4

        SHA256

        6239bd1349d323aff9d4ba5aa9e1fd450d906fa0eade742fa4082a6eca2e4b5b

        SHA512

        13750bf2ad1d357e20c661ecdc01c9bbe6455efb61032a3f5776d0de9e83b2bbf42df6f7ea0449f9a1434ca21d1e3c1f754aa33864d4e7f52649f0abe84c6402

        Download Submit

      • C:\Windows\mydoc.rtf
        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        Download Submit

      • \Windows\SysWOW64\iqkgzrzmjrefc.exe
        Filesize

        512KB

        MD5

        b13152b4c6b5022fed4ed8c9a120ad2f

        SHA1

        6ba95ec5fa2c081ad85bb94179c6bcecae826f5f

        SHA256

        c4b9b3c576bcb1a199d518e3d59e5a6187fac31f574e72d213e749cd62719265

        SHA512

        b16afb07c1a272c4612e7ea18559094ea96a6c1af84ef6fc3459a17ae863418bb065b23b291318fe3f3a22bedbc737f1941730b810d6985d3d37f3f3070ca96d

        Download Submit

      • \Windows\SysWOW64\somipvjf.exe
        Filesize

        512KB

        MD5

        67588fc020041cf544f59b851d217e1b

        SHA1

        72130dc7a53f851c7fd2fc815943553c5fbf08a9

        SHA256

        917aeefb142e3c79d8fb9355a827bb0a5b6c5d847ac09db9311bbdddea2af4d0

        SHA512

        7a8224c881b263c5fa7b852425ec7733e8fd6cb833fe9faa0445fc9f23e56724e6e2e0a385ebb288992d21645a40823b2259275a7eaea244a5998d6430c78b47

        Download Submit

      • \Windows\SysWOW64\wtzlcahlpe.exe
        Filesize

        512KB

        MD5

        6b2de865753ac7173b7f46e9639f861e

        SHA1

        080e1ae584dc9699acaffa806ae67320bb9cd91e

        SHA256

        326d3713e49e62c4ada1db432a27161ba73b9ce336dabd6ccc20b7d7bb802a70

        SHA512

        aeabe8e062f7119d3adeaabb4f7dc1d22c8797dfa8042f946fd4d3b6b87a36a266d97af61d07ddca270f0d5ba1c84f48970abc99daae4d633a74e71428ce7a09

        Download Submit

      • memory/2472-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2472-99-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3016-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB

        Download