Overview

overview

10

Static

static

5

691c5c1186...18.exe

windows7-x64

10

691c5c1186...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 00:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    691c5c1186c1c886308e587b1d0812a1_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    691c5c1186c1c886308e587b1d0812a1

  • SHA1

    c54137582681733ad897e331ca2d0a414f24e3ec

  • SHA256

    44125ca888c97f6f3396171426c72b77d1a8df376ff82b0c19112f7713571e46

  • SHA512

    a7eaf74da7254d44899f8f852189ce8dd9434c323a2751243332fe31ab56300c60dfe507b5773083bb43584947aa8db597f1a235755e6fa8047cbf584ec9a4f3

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\691c5c1186c1c886308e587b1d0812a1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\691c5c1186c1c886308e587b1d0812a1_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Windows\SysWOW64\dbjpgikdul.exe
      dbjpgikdul.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\SysWOW64\gvwkcsou.exe
        C:\Windows\system32\gvwkcsou.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2952
    • C:\Windows\SysWOW64\sdrchastmsiekew.exe
      sdrchastmsiekew.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3764
    • C:\Windows\SysWOW64\gvwkcsou.exe
      gvwkcsou.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3920
    • C:\Windows\SysWOW64\qsahcerlebjzi.exe
      qsahcerlebjzi.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3020
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    22213c2ffe8b0928d1bfe9bffa224908

    SHA1

    6e227cf9bd7b6742cd2c57b3888e35b35651eee3

    SHA256

    3c1f7acd1ef99db6926203f4ce4631bc990e9cafc80264a21b56fac0c0d1c049

    SHA512

    740cea42feb9447feb2919bf041a1e36c06e0f96ddc834879727993b222b37bf6e2cf41a4089e9f0dabf124f74f1932f64593b43985c7b4e38a63e7946f18ee7

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    9906ef9b46fb8bade5affdc221d567ae

    SHA1

    74fa0aba1971b3452cc8928a3fa878ad05b0d97c

    SHA256

    73d63926cb9bb06ce9b3f410e312ad42a2e078c3de3219d7d184e388b908646d

    SHA512

    4e623e9976a2f43cd5198ac11f9fdc17ae10e7ec66d77adb435a0c4be94c8b858197ad9f22ea65bf14bc8c8f6d62aabcdea502ed92546d364f86cf3219e66eb6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD9FE2.tmp\iso690.xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    9ee5cc05bdbf459cafe92159e91fbb79

    SHA1

    9cfd40020645806a23a36b3756e76876f7cf9f6a

    SHA256

    d0f394fe347075fb9319067c83b437a4ac78e9980d5c2c9a3049a252ce3ef344

    SHA512

    546445b8c38bcb6c755d60610e5a6317dbc9ba339a4b6fa14c32190d6fb2b6587342945f03ca135cca696924a434ac297ffc6af117da68b4563a1dffef614d90

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    714f32103439ce3c13ca0234a6cb3c47

    SHA1

    345ab64b85058c795179c4bef76ce7d6895bfd91

    SHA256

    993fde85fc0b90125d3c10725dd5e7d49bd5b4f2b48f6d846a18011702ed667a

    SHA512

    11584a173c8e43af68b013a383aa421c0eab543af7e3668dac0d181bbdf2c3349de7aaef567fe0a09495fea3bb54a74527a7e106a6fd7b50a89291d2878f6d04

    Download Submit

  • C:\Windows\SysWOW64\dbjpgikdul.exe
    Filesize

    512KB

    MD5

    e621d041fbdc8d6e6e59a826f4877efb

    SHA1

    0b19841dbde6ea7c3c09407e8768780ca98ab7bd

    SHA256

    e65ceab79f3400576cd8283a909392e40d812925e4ed4f45c1564b7f726c00d4

    SHA512

    141ce1ddf1e7c71fe66f67b6ed2eab1d57735bb247d9b09138eaefa444c5b40271ccb537f983434d52326c0c2ae5a524382109028a10f050c9ef0e964f95a16c

    Download Submit

  • C:\Windows\SysWOW64\gvwkcsou.exe
    Filesize

    512KB

    MD5

    bfde030e47f67619188fde648b6cbbda

    SHA1

    6f30102c6de6b91c8b955b075ca095c96496d7e7

    SHA256

    7d64ed58c7a8c2b765119978008598048f7e581929e7ff32b99d075eefde773f

    SHA512

    2ff90f5e130cc09932b7d79214055c48377f0c113ddfb7a5c8d1a1b138e926c0286689c37dfa7d605d1d79918eb7647535a2b8e296a5b826a829ee93c44ff7a6

    Download Submit

  • C:\Windows\SysWOW64\qsahcerlebjzi.exe
    Filesize

    512KB

    MD5

    e0111284a647640af0e5c71c21131e4c

    SHA1

    ce048c91ea4073060a332a5a23b58f4985fcd5b8

    SHA256

    b27036be00ab17f9774686b2a55fad6ac031468f3b89d01015cc6a96e86784a2

    SHA512

    556d831f11b3c65ba7ce3eebe66789c6febf74a04edae29620562030cc593d17e5a6ad505b511cc08375d5489753874d7f784fe36fadb55654bffe07154123fa

    Download Submit

  • C:\Windows\SysWOW64\sdrchastmsiekew.exe
    Filesize

    512KB

    MD5

    ef87b6803d240bbaed9ac3aca49db275

    SHA1

    f03564768147747da2ea9b893bc79e770abe86f9

    SHA256

    2b6bd786cc07262082868cdff50bb9e4053276db4cbf244100252851166100bb

    SHA512

    3be914d92075e2dd8956a685643232df412f7a5faa4b485a05f963a1e9d9e9edc57c54d63855a4c4da9de8c3758b621a7f15a94d0ff0ff02ab11681b299e6a3a

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    0e30a69f04b39daeb9964c6972a710bd

    SHA1

    72d2d8f7cdda7b2978f549ab57b23a1978526b86

    SHA256

    49d70221004be822974eb3f257d5b350c133f502fa231983aa87150c05609e65

    SHA512

    532ed3ac08907fa7faa92717236af7d171a241073d224e90912a59131fc7cdca32d1cfd476227840b93133cc5893073fc9209b09f21e43b0b172038715008e54

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    29f2c27e4691e21ff829ef56baee66f2

    SHA1

    bbf09069b24b6e6e0edfde8448464a01a1c4fa76

    SHA256

    872f8d9cda91b597594c045c1c417ae6445e123ab3eee959a02dfb2352d36899

    SHA512

    b531bdd18c10fc8e03d174f4d599a37137232bbca9b8f6af725e504912a84b0b65d8dbfcb46f9f623f27c25da79ae8af15d9a92effd848a67e9ce88ba2b1d5cc

    Download Submit

  • memory/1672-39-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-41-0x00007FFDE9630000-0x00007FFDE9640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-38-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-37-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-36-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-35-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-40-0x00007FFDE9630000-0x00007FFDE9640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-597-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-598-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-596-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1672-599-0x00007FFDEBE90000-0x00007FFDEBEA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4308-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download