Overview

overview

10

Static

static

5

6583fa1c4a...18.exe

windows7-x64

10

6583fa1c4a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 01:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6583fa1c4a931884ab20da67ff58c4a7_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6583fa1c4a931884ab20da67ff58c4a7

  • SHA1

    60ce85ffddee5f77b3dcdbbeaa0a18c6b3382670

  • SHA256

    530c3e01f8ca478e81a5f867322d9d8b35369bb1fe0f9e6953a95cb09adfff4a

  • SHA512

    342c49ce337a0db2fca9b9c19b5d63d1ebd45ddfd74fa3f018771c9deeadb643351e40c80e3f29c18489aa85bcc36555ebd02013eb9624d914815762bba4663c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6583fa1c4a931884ab20da67ff58c4a7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6583fa1c4a931884ab20da67ff58c4a7_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\SysWOW64\utblvgbtza.exe
      utblvgbtza.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\djhiazeg.exe
        C:\Windows\system32\djhiazeg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4476
    • C:\Windows\SysWOW64\ncoztvebqoaspha.exe
      ncoztvebqoaspha.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1408
    • C:\Windows\SysWOW64\djhiazeg.exe
      djhiazeg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3464
    • C:\Windows\SysWOW64\xcoopbvwqwzxs.exe
      xcoopbvwqwzxs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1212
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    dd4aab7bb08fc96f9573e0286c1b31e9

    SHA1

    5919e5e531ff84e57b85602acd33239737cf836a

    SHA256

    77e5229c277e25ccf9659ad9eb4aa401f4d54fbc9666369e09be90cb3cc83910

    SHA512

    d423da4a459ead0cb5be00085e2bef5dc5a74ba3cf23cb204b57addc25df55b951b454a717ee7dcb89c34e4c829996b537ebf5b069d81d861a63280b0ede1305

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\TCD78A1.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit
  • C:\Users\Admin\AppData\Roaming\DenyInitialize.doc.exe
    Filesize

    512KB

    MD5

    d31a2abedff3bcf657d3161ff88dc70b

    SHA1

    800f7607b9ecaecbfdceb14b3438b99417b1240b

    SHA256

    bad72e754dab5852e3f726ff4cf3be533c0006a344b24e674038af489f3d917c

    SHA512

    0f2a36a9b4680ab42f3f4821a11c48112e82039fcd42cd65f9641056ab7ab881ae4d7716f3cfe2322ff3bd7f7c4ab83aff3b107f7c2335ff50217b7fe6e79d28

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    d5987e0cc2b319da0d8fd4d9e6dca949

    SHA1

    82b7177003e49dd37d1e9a1fecf76f86a5ad0f9e

    SHA256

    0e3c63ec1c167f88dd105a5788a5dcdb570bf3dafe0354d3f7462fb681fbc3ad

    SHA512

    c0823ea953068ab4ca90519ccce194fe7dcbee1f7f9795ed6596f0c3cd139ecf352c3926022ea1a6253b6572b5173874c59b731540081684fe78501a233d0be6

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    7ba9e2cbbecee50e2c5ccfff3f4da2b6

    SHA1

    bdf1aeb2c78f78d2a7d415047f456775a8dedcb7

    SHA256

    5d55eccde22d6c6b9ab277e38bdb2f7b9e5e9f43f12b77dcaea77b516602797c

    SHA512

    1a13c59ce45c332e56f0fc4cda6e646bcc8b25b6ce967708a21c64477bd2a99583f959207848addd088cccc4fc1219949d648748f78e661b0393b7d0d31225f5

    Download Submit
  • C:\Users\Admin\AppData\Roaming\ReceiveCompare.doc.exe
    Filesize

    512KB

    MD5

    a6327fcee7501f6bf232c249c3eb3a69

    SHA1

    35191f0ffe31b998735499a4e4378c38956f2e0c

    SHA256

    29e4cb4f97a9a6733fdfad485e2224adb4af975055bbda1b7cd47f0b53df85d5

    SHA512

    b8d08214277f57f399f693c8ec6da64b52fd0bf73ba6be8ecd85592d37cc36b3a15017250b1ffeaf1f9c2cda0fed33e748c88930162e3763ff36afe72952f51b

    Download Submit
  • C:\Windows\SysWOW64\djhiazeg.exe
    Filesize

    512KB

    MD5

    0d89480d8fe8cae5e65703ab663a715b

    SHA1

    0374bfd6e094356f1938c5bb16d914af63b80a10

    SHA256

    84100add6c7a7565966ddb022d089185fae72c49e2a5292416f730d592a8c8de

    SHA512

    325d542400ca91a99ca75eec3caffa4b2a1e65a66e248d17a077502b27c43073ebf6609caf056aaf1f08421f262465e24fdc957cf0fe2caddf44be0b05aac980

    Download Submit
  • C:\Windows\SysWOW64\ncoztvebqoaspha.exe
    Filesize

    512KB

    MD5

    cc550d6f8b65a7c215d9d1f6d577f181

    SHA1

    d887f67b597162827ec1fb90ae0ef9512ec4a7bd

    SHA256

    1000338585e6dbf0350693805bc89e47502500f9dc49daacbac44177ccbf7739

    SHA512

    9f82d9591491373bea45ab4b385d7360ce32575159fe883cd8619730a5317abb0429527886714c689deec838628920ed12abf30e9bb18a20c575cdbcb731dd83

    Download Submit
  • C:\Windows\SysWOW64\utblvgbtza.exe
    Filesize

    512KB

    MD5

    c838596925f4c9e287ccb70c1be386fe

    SHA1

    feaefb664abf986390c281ce632f383b11f24cb0

    SHA256

    1046c005e4340a1355e22f20ad9c9a6ce2840abd47764611b9161b96b84cb5a0

    SHA512

    484e5c652dfdb583cadc86e13879d84496f9bbb981949cc315b5009d4beacb20d4670353dff94ee6fc606f19ec834d856a4ddd99d3ca697e171c11ae2a90c038

    Download Submit
  • C:\Windows\SysWOW64\xcoopbvwqwzxs.exe
    Filesize

    512KB

    MD5

    6a10f8f71ee2ffcbbac92a093f8bdb2a

    SHA1

    656d310d43c15fed50c326319e2b43ce88b94edd

    SHA256

    984e87c60f64439f8d25f7701f089b4a6a9463f0620df7064d1449acb0446a31

    SHA512

    33c22626fece0ff1188b32beefac62f702f5394e217069930a84309fe47b4eedbb30d66fecc4edffd1be8a5702890d2121d719b97fd1c58fb4eafba1c36497d1

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    2bf5984d6cb2c8410673c8ac7d8e205d

    SHA1

    b48ff0812198c9b91492d862691ed668ddc641d9

    SHA256

    62faa274a7bd1a6c6016742f4a0cccc845dcfa6e07d665656abd583c5acfc5a6

    SHA512

    1a5fc1c38633c03d1bcdb232d1001595ed4220082df30d39e62dd260d5d9c801e0859aad298f2bdec6931ecb6b2a42ae9bea9d0496c5ca61493cb93cbcbcb507

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    625a6eeeffd6a99ae7f62646ded75b79

    SHA1

    03d8a20030b0cdbe5815b64f8f8f6be388d87e33

    SHA256

    8675487b3bce68f2e9dbb798ad9a32e74c48dd92f3b2ba030937150644b7a70a

    SHA512

    f7dabe2df95ad16ac191edf3ee7ecdad22904c5bd17398767ba2558f5cc83951d5195a6886bbc9358ad5d8004d1d917653e3552e297d05d25705a3183edaabe1

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    e2a0d936a90be9b183c8bc8f68798300

    SHA1

    6a2ff0dbb023b4fab70b59bf0c31fa837d8f389f

    SHA256

    8b574377e96a13cca4ff999563dae7d06bb4142396e095bc09e30c19f0abdc3e

    SHA512

    4eecc339acb5151aa0a89fe6b399b5eddb9b88a013d5a291a5cd42d0f37f73f6eded082fdff0e9378b3c8fbbb9e5ec8adb1be88bf845aca390743fba64d50c7f

    Download Submit
  • memory/2728-38-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-37-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-39-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-36-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-40-0x00007FFB790B0000-0x00007FFB790C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-35-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-43-0x00007FFB790B0000-0x00007FFB790C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-614-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-615-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-617-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2728-616-0x00007FFB7B550000-0x00007FFB7B560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3480-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download