Overview

overview

10

Static

static

5

69372530a7...18.exe

windows7-x64

10

69372530a7...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 00:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69372530a76fd92c6fb4d01313d9b370_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    69372530a76fd92c6fb4d01313d9b370

  • SHA1

    7bbadececbf02a60a519e1f9a5b08a25e6a857db

  • SHA256

    a2d2a9f61da9da9b3eff26e050c41411904f89975565fd315fd7c2519fef1875

  • SHA512

    5b2909611e784b97494cfa8fdd00318b87012debdd139363aa560280c7a12f4bb97a3868349d3644e754668c0a08b90b738447f65367737300e8d5a8584b7ee3

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\69372530a76fd92c6fb4d01313d9b370_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69372530a76fd92c6fb4d01313d9b370_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\SysWOW64\wjlyzgarwi.exe
      wjlyzgarwi.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\SysWOW64\stjbgwvi.exe
        C:\Windows\system32\stjbgwvi.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2772
    • C:\Windows\SysWOW64\qjtnymkwmcmsjdp.exe
      qjtnymkwmcmsjdp.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2728
    • C:\Windows\SysWOW64\stjbgwvi.exe
      stjbgwvi.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2936
    • C:\Windows\SysWOW64\gnevukspxsexl.exe
      gnevukspxsexl.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2656
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2948
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1528

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Modify Registry

    8
    T1112

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\qjtnymkwmcmsjdp.exe
      Filesize

      512KB

      MD5

      12da7399d608f4fac1b6b67c8c3964ab

      SHA1

      af01eef920ea632acdbcd121508559be1349876e

      SHA256

      f015aabf090e447f19b4bd162cfebff46f5f758f1fdf3e9a8dcc1dbfb4784b70

      SHA512

      f9096551f27efa683dfd6eecb215b10a5940adf238d8d723cfdcbb8f514593661cff3064ee7e58cc00ae019fbd8993c8a4228cbaaac7f683de84359c8d8110ba

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • \Windows\SysWOW64\gnevukspxsexl.exe
      Filesize

      512KB

      MD5

      7a648910e785456837e1e88b5c55e3f3

      SHA1

      82de25e29c1f39e424af592c34d403eb310e9bb9

      SHA256

      447dd6dd8771acbb31cababf3de9d91dcbff27a0c240824b1f2c9aba7952ace0

      SHA512

      0954615c829e16a0d9709d153c1b5a6bdefb988525ef7873c5288fa3610520bc1a3881a754a1537823b5bd9dd2dd6f3fdd0b1ea07d4d5e5f12e386383ead4c57

      Download Submit
    • \Windows\SysWOW64\stjbgwvi.exe
      Filesize

      512KB

      MD5

      8524259aa6d551faea55a67012d79c81

      SHA1

      88f25f2d0a7668371b8763bbc736eefd1528f32d

      SHA256

      689e4e19b9bb54a22d6c2d8f9f04db6fdc3a9f4e4e291b67aea4e8bca9ca0667

      SHA512

      98181c46270df58f04eb1bfcdf34943e684574bb1c22e75ee5e49b043376c997aafd8ba27a274e7f9c6841629d9ee6b1d75b4fbaaac2300240adf70771a0698d

      Download Submit
    • \Windows\SysWOW64\wjlyzgarwi.exe
      Filesize

      512KB

      MD5

      426761358846e78c07cf80b4033f90cd

      SHA1

      75d791286bbdf17177e92971d040b8ff83f28c78

      SHA256

      f8dc3e88eecb0c7ff819023a05504e37e3e3f97abc6ac443d93dffba7bf1b363

      SHA512

      0b5f34988c4bdcdab47dbf725efa9912b063daf0fe2ea25b0fe8bea7e8c4f91401468e90262d185d142092ea496a5b62be073ea2fda93e72b0f1831a49b129ae

      Download Submit
    • memory/1528-77-0x0000000002B60000-0x0000000002B70000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1688-0-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download
    • memory/2528-45-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download