Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 21:14
General
-
Target
68a8e36f1eafc058e7694c0bab7a0951_JaffaCakes118.exe
-
Size
512KB
-
MD5
68a8e36f1eafc058e7694c0bab7a0951
-
SHA1
9329f6ee52bd7689a4be9849e688b4b249b6e062
-
SHA256
0d02cf6e8985b891e6729aee95e6f15ccca05efe98726fa7e52c81e1e532cd39
-
SHA512
4e5b6276a399e1c451a5518cbc427a6f03e07d4208ee902fe499eb1d9b58ef0ce851a895ae3ea64c0e93acd241aaa37de5a55d4336397bfea755640332d710b6
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68a8e36f1eafc058e7694c0bab7a0951_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\68a8e36f1eafc058e7694c0bab7a0951_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\issoqthshx.exeissoqthshx.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nxcflpxi.exeC:\Windows\system32\nxcflpxi.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\pqddrgshxfmoxbm.exepqddrgshxfmoxbm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\nxcflpxi.exenxcflpxi.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\vdixubppzeket.exevdixubppzeket.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD540184ae59707bc02e57f3f0f39bd6fa6
SHA1ff4969cf827a8d6637bc24194d840fd5adc36506
SHA256bf2c2f92dacc87049c266d38f22c73d8ac1e12558a6ee32efad0503b432d8453
SHA5127ec0d3bcd3d86b688c224ee21fe9382d6fba6902823cde8028e97eb9c25a999814259ac1ebfd512fdac9419200e01458fad08132fd15938f9c734ffbd6e9b6b7
-
Filesize
512KB
MD5e709f8952963d742a85210fc1d8c8248
SHA1a61ea8f08d5b5d583ecc59309f0762495acb6c52
SHA256cb395889eb825163b2b520d876afed66f66dd707843fd878e24deff22d8f71bc
SHA512c8ae315745a6be5abfdebf932d0f7ad99c730e82404e1ef43c9f20324ff7ed00839582a204698f257165479f976de165f5ebe0a7ccdfa66ed95a90f05a7271b3
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
247B
MD51b529425a37b1334b8b33ebd890269a4
SHA184768e6475b45e3431d5dd62968dde9b92bcb799
SHA256774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440
SHA5128d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295
-
Filesize
3KB
MD5fb1f5bf2b2dbadd6b11d0268066e4266
SHA10bed2b0b88d92b62db9b9a57556d240aa3623346
SHA256585c7ed2342a395ab2b910001ed1788bf8e16be6c9ae44c78b9f51ae3a4e10ff
SHA512342fef39a936d47fff67f819b5831db0756a295063fbf5645080e1bd585d8f93a32c919882898c7a21e41f1be2ae6dc8253627752986de01e899ebdace525c6d
-
Filesize
3KB
MD5fa54147be35a6cff9a8889005e55db2f
SHA127cdfea4d2f9fe5298f0d1291670b1c9d2171436
SHA2565c4b71de53b51a94c40fdf877d19cd5bb4410b7dd365558a1bb105340d24fd22
SHA512937ae97e7eeb514e08a6939a0f8ff3bad697920ebee3aa92ce7b6eb22b7f45f9c365f7e7b454e298f1c2b11f20f232138cb4f2505831f06a0c66e29f9f95c8c7
-
Filesize
512KB
MD54051fb6971992764c8b8ba4b49ba5d17
SHA118e8e191e37145de02f6f6c577d16c43839f50cd
SHA256769fa1a03cb76a87ea64fcd00ea7198fab16c90ecd019c6e6ecaacdec4710240
SHA5127901f2284e750aac72221db06be0ce67c9369ff95160f6734d6338f4ef538c4fa3b85566c582b3ee350764aaf2d78db4bb7ed34a4c041165e935cf8e245b100e
-
Filesize
512KB
MD55b5a4f381eb2547e8857d5878739568c
SHA1819d70bbcfc2612b99cbe7435a83dadf92702ec8
SHA256d1106e6fa6dc84fb8ce5cb452d39f18b26d89a9562b96de7de801485fcb6030c
SHA512effd1262a514cfab41d2df49febca2f24970581a563c4c6a96dca1ff70c1f48efce31939138bbc367c1561ede5113760d5caf14c936f8e9aef73ec7686e6b391
-
Filesize
512KB
MD5131485ee6107819941546f2b46c2341e
SHA1567b07b2299316562f8bde5a9265dc8d95cf513b
SHA25642e1a02e65289b270ed2f463bb626847582aed2e45b2e4a637a12c7539ffa467
SHA51261b8ba57b9924da6114f643e342331fa383adfd488a63fb884b043034fe931e9f27ca9079bc5a898724e0c30a853739f54a50651ab4bf4d450af90a5190208f8
-
Filesize
512KB
MD599af3ea55b4e61bbaa3f3ab2ff35e53f
SHA1e394db8d5613c6dcb77874b402b662b0b533e24f
SHA256148c0f3bc75bf602b3ada0934353cc884bced6e674ffdcb603b2cdccdf788e59
SHA512c70ef88cdaac76b2786623182ce62743fc75a131e45a39cbd9eb4946e975c2f177ca490b19e09e4bfd7dbc1dfd480865980497bf9d23b4871646548fa1ebcc44
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD532e83455b2ef564adff9cfbdc95b5bf3
SHA15f367825b7c6ff9388989f8839f7749e6065d753
SHA25662a045cb0f2859b27d56f42bade6d09d1391f4847352591cb422a58f0cada66d
SHA512896ed2db3e8b74966d8d7b51ad3429c8e9a2baed71b55e84586df72cf7de1839cce3dc360ec13a2187322e7eaaf7090798b4985ce7b1e5c07c259fc6cba459b4
-
Filesize
512KB
MD504970c182f28dfd8d8a2266bffcc740c
SHA1bc469bc2520aa44d49b54a06cf7c9bbb17c9da36
SHA2562a86b3a8f24f55b2dbc1b68656a529504d2067a09de7fd2bed61b20a83872044
SHA5121934ffce8c41e2ef71221ee1144fc43846599815837cdc961f6980bdb31a3e1b245cedf7422614b403ce72483aed9572b058f21b015e53228fc05e82191a52f6
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB