Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 03:27
General
-
Target
65da43850cad5e51c3c51487c2437fd7_JaffaCakes118.exe
-
Size
512KB
-
MD5
65da43850cad5e51c3c51487c2437fd7
-
SHA1
098c8253fc287c870cee0f2009a106628def9570
-
SHA256
53dc2e3f581a0eface39638520f1b3d589dedb4be74bb7f9d0c388a524204e43
-
SHA512
ce7acc30e7ff1dc5db48d0dfdad189a648d07cbef4c7886357af45881fb6669d7eadd16ff831cd99dec4d07fc42482ecc99159928ed027d8650105998623a37a
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65da43850cad5e51c3c51487c2437fd7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65da43850cad5e51c3c51487c2437fd7_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ohpfenuhqh.exeohpfenuhqh.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\kpnkbhua.exeC:\Windows\system32\kpnkbhua.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ezxxyppnvuiaoaw.exeezxxyppnvuiaoaw.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\kpnkbhua.exekpnkbhua.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cogvtmnwyaonf.execogvtmnwyaonf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5b8f30c204df850241cab08df9ddbee13
SHA130a0cdb9302327800efea7b8cac0b610d344e187
SHA2561c81466697215c355cc41a3b919bc793f65dc0c27fa4d723cb7f8ca601a2c77c
SHA512422cacbb64bdf25cb94a67e08b2383cc4d5a37e5b8a70b21d44c197b0417537b70e86eb5c59d6d331fca7655b82ebaf2f4dd68b607a535f2c0e62dfc78d191bb
-
Filesize
512KB
MD5a537c3f45d6f339565c53d17463e6568
SHA1fd8d20e00329a76f6119a13f21ac554e00f30786
SHA2561cf9d871a5406bee7920aa85a4564d4778b16d6ca189e180dee40d2919707c69
SHA51251ff623e02ca917c7924d6f916e7d6cba05c280e59defc2c5feb32ed34e1c2de14220b7f543386c2dbc3c6525fd27046d6601de782d31f9d34f4fde2bf3e6cc5
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
239B
MD569ab36f887c9aebc03cf2b9924e9af1a
SHA1e89545bd4d84ee79b970724d81406111054e5ede
SHA2567f418960bedd2f787ddffced8647021d08a07fd59577d0f2d012035779122e62
SHA512dc8ae47740aa9109b9646d40500529aeda9c71421f5586f2d6c45a96cdf5a10dd7a4ae45193fbb58d6b3ef918d476af02f699111a1280ddd71cc1f65af38d653
-
Filesize
3KB
MD5ec1fc98658ef76c5f6ef22b4f35d9529
SHA169433347e366e08c9efc8ac8beeb8ca373ec445c
SHA256c203bfffefcc5801f842e9ce3c2566becb43be246d7891f546f0dce69f5e3f86
SHA5127e2d18de4128051745ee958a0f71e7af7f9a53b1fe471298615932819a9fe876a96277aa9727f9efb715a3bec42e31fc8358878ab7609ba3a710503dd99d3441
-
Filesize
3KB
MD5989d1e488b3f46e88b1ee2ac383db886
SHA1daa9f97b10185d1baf89af15e50612acbad599e9
SHA256dcb49ec4e0dfda0bf367fe211b23d76e0085ce8f741519c9f27703c413c96b37
SHA512b941f866090be54342da53d0590c6a7b4766b900cf8a5ebc97d0ab6fb83cd2e8e8db3a390603cc1e3f19372bba820254c7069c2f5d8be81fa701df27a9e30dab
-
Filesize
512KB
MD5f255f43f50fa5a73a59af9eed61f095a
SHA1231947d58fb834f7e3b2e506616b90897641e24a
SHA256e900610dcd1766a1a995176751ea92049e25150661821bd1af65ec189349e331
SHA51259462861a42e6c1fbf776fe2c91ecb01b53555258cb7e175036cc750326e7892d320344f7e4aaee265408f3557d4aec9ea176106a09bb07bcdec867ed3b70a52
-
Filesize
512KB
MD5762ce6a3513facb32925e37cec121d33
SHA195e2c11a71847e13790f1a6fa641fad811a1fb8a
SHA25611e4efc9b7baf0bb68c4ad6c49a597fc3ade305f377127bf0ee84a5dd4df25db
SHA51220275535f03b254eb22a17dfcef41529564b6ed47711f95badfeff0637734c5aeb9c63d9bf4040d7baa42b9cd015af0173f312761de31ecc2557b97d9e7db985
-
Filesize
512KB
MD51835fae57305ae35856b8d3f18af5682
SHA1aa927b6052178fabdacbcc716da07b4629b6d201
SHA25662df060064720d3b8099e62bef4aa690520335450d18a42fd52e97cc45a58387
SHA5129df677574312904a44484fb925fcd1abed6dfdb2c76e8fd8e155c6a19cfd4115d00a57428515f04b9ff1041e8157aac30e4325639a05d4d77b0a372bcf4255d4
-
Filesize
512KB
MD5916f261dbd6b3c3b64faa7ee6f86748b
SHA1c8f20b3a8d0632e6a5f4996edbef3ce4ea367d1c
SHA2561a9c96d3c39b9aea0dffde9d2eed909de0663eb56f230078a3708a9af845ffe9
SHA5123285921c89bbf8cea5b9cab8e4a99cd247b4ece5958eee1c677809cb5b065cf6221dba5b85b1e932216d427701a6aeeacee1040a0b5857018984a6a8cdf1b3d4
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5ff5948c717178e06d334c201c2d0fe26
SHA19ee35c9e079210eaba46cb8ef9b8fd2ed5c55e66
SHA2567175c1a3bfaf44d268149b19520d832d19264e5bfe9306d82f61e4ff948a7faf
SHA5123205090f8badf2a40a732ef98c4159310c9a31f59294b2ecd8fbfe45a494711128c8f2286262cfccf7711db44f1a164e3bbc5b9cf16422e1e891dc4957573466
-
Filesize
512KB
MD5ca15892639444740d6c0e1b67b54df04
SHA11a9888116c4e65ba93a4ae19e7d759976a91e9fd
SHA25625eb7b7fdc3207cfef1b716e3eed24e0542f1b2e08683db86d447cfbc7c9329e
SHA51242bccc38d61ea0d097ae18044b1564fdd18f87edba637a62f92e87feb78d7dddb30a77fddf738bb796869b5a5ffae1d3c5374abd98a613ab881db684d0a0e19f
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB