Overview

overview

10

Static

static

5

677a3fad29...18.exe

windows7-x64

10

677a3fad29...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2024, 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    677a3fad29658f3d41d487b738b9895b_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    677a3fad29658f3d41d487b738b9895b

  • SHA1

    123ced95c6899aa55b0b013c8ef256e758665274

  • SHA256

    565e3f634d953484608978477ae95335ff2509cd1f33010c3c952c62bf4abd61

  • SHA512

    eff88fccb0a656e2ad08ba3b8ebbb07e09d0c363c5e2941c6ad4132cfe76fb34feec9001e7fb3980c595595de5b66776d2bf39be74a00bd8c10b2efd344e3ddf

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\677a3fad29658f3d41d487b738b9895b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\677a3fad29658f3d41d487b738b9895b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Windows\SysWOW64\adcoefhmya.exe
      adcoefhmya.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Windows\SysWOW64\jpmeatpy.exe
        C:\Windows\system32\jpmeatpy.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4100
    • C:\Windows\SysWOW64\xvrpjcwxzxjfxso.exe
      xvrpjcwxzxjfxso.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1012
    • C:\Windows\SysWOW64\jpmeatpy.exe
      jpmeatpy.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4920
    • C:\Windows\SysWOW64\uzriqopdanzqe.exe
      uzriqopdanzqe.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3940
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    bed514434ae2502db1a0f8fd43e42928

    SHA1

    1e3d17f673f19198cb9d0b1c0fe34b32fba90196

    SHA256

    f500fcc191d328171aa782ebea6c5f797d4ff9928e9bf1ec98d61c51f5d46f0e

    SHA512

    779bc9c2209b9ac42a509c395db570d9123e0c4271faeec6923334a876e7786493f7c9b280f305ccc0928761278bb70062a5a4c3ea6f09dc4bd8b22a62e0bdda

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    1c3fd63e591b959d4d9300b26a050700

    SHA1

    b380ab673554b7e7902f57bfd4032d8e5c126e95

    SHA256

    120965f4127a3566de9fc3ce1299280ca0d49e94cd90cbd93af37b420f0ea7a3

    SHA512

    b524069dce49202ca030f888b1800622ea10367c176064253db6bcc1b7c8b016760c226644e65d1c85861a503ce483d4e8e7d5deb352e5f9cba02f2f8bd0f4b2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD941C.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    4fc1f828dd87e3f805a1d05968142405

    SHA1

    a006b33df8c378b387c02ee714bf3878485a809a

    SHA256

    583975bb177910a9d1003052331ea3a60f8c942d3e76f110bfef3d0928873b43

    SHA512

    9e390e65d84ed1830aa04084abd07ca4103898ad2f620e2e97df7ceba80f899a04b7b865e691c5b4ec17f6542cd85f0b9a38d89f4f1f2e409a287e43c885366a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    5e14569f9659f1e5883d47fc36617651

    SHA1

    412e219897ff0dbf16eac8ad4490773667176f9b

    SHA256

    8b46268975e4a35e36d76531997d9d10bac7186b49397a2d47547c5da13c54b7

    SHA512

    9dabde90ad84cbc95bf0646553c15a48e2f859413f4159f10b0f074f443c83c510fbc3203ede749f0fcea51f63ec4457c8ed0837e419bcfeff9e3d92f150cb80

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    6f38371fdb5da0b59d46793e7c65df98

    SHA1

    567b2bf635ca07dbb7291aa3a8475f2d24e771b9

    SHA256

    794c79ed9739bcb4bf4637344bd6e937505dc4e93b89363ae62cba7296b7c862

    SHA512

    89dede18b72f6f99ba8db0da459effac81dcc31b7c55c9d8219516252e6e6b161a466bda6e7323fdf3b2349bc4880e43df774b7d06f5c547e8c521c49d573014

    Download Submit

  • C:\Users\Admin\Documents\ResizeSubmit.doc.exe
    Filesize

    512KB

    MD5

    f164c797d054c4d2ea7b4b122fad791a

    SHA1

    2c52e9d478c30ebbc6af05d81aaa45b4c394cfaa

    SHA256

    7e88a04518380b5dbdf3e1515684a1a94d47424b3a3d31e182bccfaa83548cc1

    SHA512

    524f6f2ce08259366322d20d20c58d3d24c923462ed1524782daff602fe57b0f4aeb56ad422b127f9189dce4f727bef9a2d9e1a1c6c5d976d81d73e81cd340d1

    Download Submit

  • C:\Users\Admin\Documents\StepLock.doc.exe
    Filesize

    512KB

    MD5

    3a5773a6ef0383c8162fe7fea9a1d0e8

    SHA1

    6149d8b8fa3561b4ecd8a85e481ec756e316eba0

    SHA256

    c0b71d51d548e1cb95220a474d06a9a9a7d25b560a4efe6ba1ef9bd41333100e

    SHA512

    8966b69032d756a5c96109c899f5d5925a7da1b9591b95e25546ac4a1b9bf689cc05b18578d8716df0d3dc258842670db1d1d8c71a593a936cd9b347b51ecbf9

    Download Submit

  • C:\Windows\SysWOW64\adcoefhmya.exe
    Filesize

    512KB

    MD5

    de937e588d2d84a9250b04402b20e274

    SHA1

    f2db9de56a2d5de32547f3647c8e77a43808d258

    SHA256

    d5238111562ff792689785cfb6f74b90d82acf063c3a4decf37fa311f2a2bccf

    SHA512

    a5711e8ed6a908030893d21e28a1e958e172a33ca0045e5976cdfa4453b9e4cdb273f101eb400ce30cd6b31141ba79a6f9277268532a11dc81a82c4fe152daa9

    Download Submit

  • C:\Windows\SysWOW64\jpmeatpy.exe
    Filesize

    512KB

    MD5

    4d6f2a4b61d951f9b0b7848f34e5f331

    SHA1

    5d72f6b531ba1a5d2547143eddd810cbf86c9c45

    SHA256

    3275e3a729090d5c8dbc6704384e9a40d05fae535572af9825733680d4c75a00

    SHA512

    cf5d4ea03142de3cf879874094ee1c341f594a3a284a0ada2a16bf7fd5d52214079e2ba25b5fec22ed6e4c89a095e98c888ebf50bd21c56136b77a3fa49b53ad

    Download Submit

  • C:\Windows\SysWOW64\uzriqopdanzqe.exe
    Filesize

    512KB

    MD5

    407207efa7e1da516dcaefb5ae776f97

    SHA1

    73b60c4b4265c4bffd28305d30f71e1a62ad1fc1

    SHA256

    752d3bcdb477d34f3f8f1bac330bf573271845aa50c1e28458df252cb64e0dbe

    SHA512

    e428bb468c54db78df7a47cc28554b0307a9083c8def3d913d9b1b5ee8f693593b995e4b3bee05e7d27e788cc042b804ed9e44757e5aaca4393fb64f80e04aa4

    Download Submit

  • C:\Windows\SysWOW64\xvrpjcwxzxjfxso.exe
    Filesize

    512KB

    MD5

    3efaa38908e01179534fabea8993c34e

    SHA1

    5ea525db273f3a31394b534e3655284c9c56950f

    SHA256

    73ae6b499c7ae1976a62ea1c826361f95fbd95875e21d646499273d9b227d2d5

    SHA512

    81a1764fae0a6792ebe18d385e73ac14f919bff7c30dc566f51b2edfc686dea05d52cd8ff6592c9ddcd1737d9f30a4a6793b0d986d87d1a5ec97bb23575e46de

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    b59c27a4250133520310b8e232a3ff10

    SHA1

    fc29f88f69989c67e715a4062da7ddc1539c388e

    SHA256

    9bdbb06509e3435e5f9f6c9e6ad91d1d2fcae6a79dd2f47a1ccd44113a897887

    SHA512

    ece0bb6f0acf8d93cf993de1294afa70c8b4ac242cb0bda5b9caca49dd18a2a5935bdf8819443c26a296c1e2a38a746dcefd94b20300e9a76cb1f3265c10b3e9

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    8220d3fdfdd9936f723f5c2e241d9381

    SHA1

    921549cafa10c187f0ed3bcb67271391ffa89d00

    SHA256

    e21235b9ab1e5dcf7f2166923f2728e048ec9134aa9186402d0ae90cef05dffa

    SHA512

    5fff44ba70327a70a094809413b0f03a7c5d0a70d8e0295d75c24814337ca147b866fab0d434554c8513ff2dcf60b8eb53c469d2954a54b53b7beba28b64e0a7

    Download Submit

  • memory/336-35-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-39-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-38-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-36-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-42-0x00007FFD8EA90000-0x00007FFD8EAA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-37-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-43-0x00007FFD8EA90000-0x00007FFD8EAA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-601-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-602-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-604-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/336-603-0x00007FFD912F0000-0x00007FFD91300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2904-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download