Overview

overview

10

Static

static

5

69af959794...18.exe

windows7-x64

10

69af959794...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 04:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69af959794532432a508040c0b496ccb_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    69af959794532432a508040c0b496ccb

  • SHA1

    032f20c3b0225859ab53f23b59087f858a6f066e

  • SHA256

    b667fa0a0ee06d7237e16ef8ca43c6e4b6704ff2e32262be8c63a25ca61cfe67

  • SHA512

    964454aabc120f66172a4f5be7d44c048233be9558e31fb606a049bf46ac1583c469e39a067623c94c33c77befc444f5429bcafaf1c6fa0e15fb0fca3428c4df

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69af959794532432a508040c0b496ccb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69af959794532432a508040c0b496ccb_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Windows\SysWOW64\uzbabeblux.exe
      uzbabeblux.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Windows\SysWOW64\ksukkfmm.exe
        C:\Windows\system32\ksukkfmm.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4216
    • C:\Windows\SysWOW64\ibolntfdapjypzf.exe
      ibolntfdapjypzf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1364
    • C:\Windows\SysWOW64\ksukkfmm.exe
      ksukkfmm.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2080
    • C:\Windows\SysWOW64\necjjhggpibfy.exe
      necjjhggpibfy.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3508
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:5060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\EditResume.doc.exe
    Filesize

    512KB

    MD5

    f188f1f2f567d1ded42fe5db323b0854

    SHA1

    2b4f71420071328f4403b5092e1df42a75e9cfb3

    SHA256

    a63735cbde131ae339520f1d51976ecdebcb9975d6367fc394660f7346ba9c88

    SHA512

    6ac21caa2427e15a6bea9428ebfd7ba4694e218365fbdce64c591892cbc07f84b12fb86e8c5adf2f80a2b7c7c652a538c3c88ba2517ce17617dcb2ec68b82276

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    2ef6f0e95bac9099eee7eca067ce84af

    SHA1

    19674b85916f8c9b0edd84cf381138fe819ca066

    SHA256

    b0379f7fe9f94b3d458353b6d67bdf0aa492339c3da5220e6e0c348f0b4008b3

    SHA512

    bbedd7ce9982c02a82d5f65060544d7c00a052b493921a79912524e2e768cb665eefa0784f8e6ec2bcbfb4371423f1deb2217bd763bb56b3bd6e7aad31a99596

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\TCDAEA6.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    247B

    MD5

    1b529425a37b1334b8b33ebd890269a4

    SHA1

    84768e6475b45e3431d5dd62968dde9b92bcb799

    SHA256

    774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440

    SHA512

    8d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    9c46bb1c73b2dcf353c68cc7afb8fe52

    SHA1

    0d70ef6fe1c5ba4e9884bf6f9e52f4f6a2d9ce00

    SHA256

    8a140d644e89025e7e264418462da6096f889fbc3ce25f6721a014a3b69048e6

    SHA512

    016b064fb021699ddcf2f4adaa60d322a9a105c40897063a19e37ca1d5052f43547cc90e712faed4ceb67d43b27fa02a310712815c05c8ad3f8862ae295c337b

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    0620882c81f2807ded448b7a190483cb

    SHA1

    7c26f1f651d86bb027e13477fb2ed29f6e6bc9d7

    SHA256

    542b4d843ada9bdffcc0adcd2cfc73a2585d6dff8c0286ef5f06cef44e75e369

    SHA512

    291a635a34666e7efa0982196daa8cee38126def61f71d141e13b521f8dbb0e1df5bc0742f91fd8c54504e451e45c2c6875e8ddc9ceda2d062fbcfab6f03ce8a

    Download Submit
  • C:\Users\Admin\Documents\DismountStop.doc.exe
    Filesize

    512KB

    MD5

    c889e404cf3e60b93adce856158d5915

    SHA1

    97d9a875f674d31c3d92e921e0771876a601509d

    SHA256

    fa966d268bcccd0988ccf5c980b4862671d7b0596f7ad3c4b204d5796e011103

    SHA512

    aa234fddc8238c9abcf222df07dc98b78f704efefe95fddb3ed654911e8ecc13c76f4534a701fdb2e778eecbe38f2110543cd471b7efbfa5b2db9cb8a691d555

    Download Submit
  • C:\Windows\SysWOW64\ibolntfdapjypzf.exe
    Filesize

    512KB

    MD5

    9f018355c51ba26888a846ddd6b2ee73

    SHA1

    9dfa82831aaae7e13f277b82aa4a16ed0dc1d7b4

    SHA256

    b5272baa8f7ef20965eb42e954581f3ce24bc98bddb658f98676e6896deb47bc

    SHA512

    ec678766c9c8f8b09228357b384223a6c60e6a62898d4d789ae274e696b9b7f69b7b16d98dc8f23f79eae334fa3f704dd0910d70069f13f949f26ada339712f3

    Download Submit
  • C:\Windows\SysWOW64\ksukkfmm.exe
    Filesize

    512KB

    MD5

    6e58d8061aa49c54bd288cbdd15b5f18

    SHA1

    510fbc56e39fd7313b514b8319eacdb797096241

    SHA256

    f45939e0d463c4a1843b7d8b0b4b2a5db3401e6f680825397116937cca37b703

    SHA512

    75582d683c78156a9cd26d3cc476541ab4a665487367b935110c0b2ec42ac44816af6c89218f39d35d9e64f4de1f645dbf344279effaead861d1b45c4b2d32be

    Download Submit
  • C:\Windows\SysWOW64\necjjhggpibfy.exe
    Filesize

    512KB

    MD5

    4e9c2273f54dfa878ed895c99a985a6c

    SHA1

    a175c69bbd2bfab75fc8f3d6217385efda399326

    SHA256

    b57cf05d51191de1b41070a86c411ed7a387f1dc688700565a49260504f5edaa

    SHA512

    4fea6b08739c3b087b08326d7ec8d4dd68a66fee51b4c960cab67304fe8c936d4df63d9985066167a5d2abb6d82da5907920e0cdf18d5532d0ab2db7c9937c89

    Download Submit
  • C:\Windows\SysWOW64\uzbabeblux.exe
    Filesize

    512KB

    MD5

    0ee68474ce486aa4093ed7a76e53de5f

    SHA1

    0a1d0ede79d1f94ff6fef723daf94b804c155891

    SHA256

    332acf216ead8c4c46b33a4356ae775e137462b2a8b9b41a51cc981371c766ed

    SHA512

    dcc657ad4024e67ebcf55ce72777cb0d2ea8bb3a59510b2da239e4fb7600d27ca6bc4ee44cd3680fbdd689182194dc515eccf9cd771175d243a332051d4f3414

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    6d394b8aa12865fcd9d5e3f8fd0f900b

    SHA1

    abae817b9e9d6616e68432c19f645e9e8ec8315e

    SHA256

    a3bea818e596ebaf5d4d2b87a615315b5f30be6cdb8faaf64ad4aab9d5a83f79

    SHA512

    0e4abd0d854b1cbc4581bb2c65d13ed65853aaea9d54267d3b8cc71f47ac4226a623f0400401704f9016149618e53534d4947bcbdfe6f680db64b5d54d445129

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    9abc0062a61c97f54b4c281b66d92911

    SHA1

    1f568f3892923a62eef3bde6d97f418b39abac38

    SHA256

    5418aee06ac15e572f79d397e311ccb0ee95b10d6c4ad34c3c16f81ee59533e7

    SHA512

    9d215b51d616601fd5bbc93f51c348541cfc324923625a7221c3fec17c1151da88ac0c32aadd1b0fd5ac7f00d80f5a0e69c3e6636ee9d9b267b52e49362a309b

    Download Submit
  • memory/4000-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download
  • memory/5060-39-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-36-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-38-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-37-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-40-0x00007FF9D4A70000-0x00007FF9D4A80000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-35-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-41-0x00007FF9D4A70000-0x00007FF9D4A80000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-606-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-607-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-609-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5060-608-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp
    Filesize

    64KB

    Download