Overview

overview

10

Static

static

5

69e0b698b5...18.exe

windows7-x64

10

69e0b698b5...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 05:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69e0b698b55ec6f5a0fbce20d487a8d4_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    69e0b698b55ec6f5a0fbce20d487a8d4

  • SHA1

    dfc5cc42fe6b29a619ffb96926f09e39786572e2

  • SHA256

    9ce290a5cff2493a8e029645c1e4e7b15fd9bf333891db0b1c743aef8e977fda

  • SHA512

    aaef2305d53d4b809fca612cbc02e386f4772d97cd94771e8c8dfd71e15e5e1095c1339f75b6d624aaef48fb245fa3ea5f2b482e0372875c930c8a914c518bde

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69e0b698b55ec6f5a0fbce20d487a8d4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69e0b698b55ec6f5a0fbce20d487a8d4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\SysWOW64\hfuxwabcct.exe
      hfuxwabcct.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Windows\SysWOW64\bgpnesfb.exe
        C:\Windows\system32\bgpnesfb.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1864
    • C:\Windows\SysWOW64\pyathnaxgslofnf.exe
      pyathnaxgslofnf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2792
    • C:\Windows\SysWOW64\bgpnesfb.exe
      bgpnesfb.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3780
    • C:\Windows\SysWOW64\cyorzpiymotft.exe
      cyorzpiymotft.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3140
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    eb750a47bd45a3d983f754b3e5662907

    SHA1

    264b8d0e573d68f3cb9070e6793c9ecee6c04c42

    SHA256

    9f221c885cb39ce364fc33936042843e9a2fb507bf71930aa55988224787d0bb

    SHA512

    04459b75e55647f366441920487942a870210ddcedad3e318a337f103998a4133e70cc5e97c04c166d64192683f26e99ca84a82b743746f74080969ab887d2f8

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    fdc320df35eb692956c290e8fa66239b

    SHA1

    bb84ae84f4e539ae8f7e2f83b744f03ea8b9aab9

    SHA256

    c8f6b66cd00c9e48934f9da1a8a9e7d969826ed221c669c0d2063b9f55914678

    SHA512

    2b80f3a42c62c6e24c9a9c8582b076819a22c6165c198e05d06f059943964c1846318242de2118dbd6790662589df78538eb124cb25bda3d728919334c126e9e

    Download Submit
  • C:\Program Files\StopUnlock.doc.exe
    Filesize

    512KB

    MD5

    223d1c0ccd9895a5f99a32fc197c6a97

    SHA1

    6da1fc06e9cc23d107f63678afe883db2335c07e

    SHA256

    4f8651351aefbf475e435b2e8ef78eabeba2cd4e3873a4e7e3b3a337f30e2f15

    SHA512

    4b6d75d7cf29118789ed7db1bebc6b275f1ac41e9e988e676261c522b784443fe6aa519879c79b972e079c5ec75b5b3a3c5b2774d84d9ce55168ed6eb2bb7786

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    74b61243d0dec13a597ce2484512054b

    SHA1

    4a13aba1279c6a8e31c5e571625d67044d77134c

    SHA256

    c1f05dd9c4f0094af568ac049e3e16073ec7db0e70f88dd7f2a4898f2919016c

    SHA512

    17c2f209d36088b46989245949ad84adfd1be18e82345cf892c618316f4dcff3784fd2459f5fc26a64167ee0690d8f0cd81ad96da16fd126155150dbd7f77593

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    1ef3163b966e4c32db9539d82bfa0500

    SHA1

    dad0f121cd0cc29ce4b196cfc1d69332faa8e1ee

    SHA256

    2e10f6d7a2b2a411d4167dfdccd6c3256c61d0d6e620d244a847dce2a6bd361b

    SHA512

    b9735bce40babd75fe13a645c6189c9822eeb7bde98f47cf15b7617778c0dbe874469a3b4b2a11a5e2453d7ca20464b86587141da15bbfbb3b1d04714e0df985

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    01cddf0b3b0e6bcec38df715eaa86dcc

    SHA1

    f75e9e7ab2015f2f8b6a8186ea1face7dced321f

    SHA256

    f1ac20ff9906445ee6e16bc776574302eaa249e9198f517676c66768d6eae340

    SHA512

    d56e42088c9c947ae7b8c39fbd70819ceda3ae136f04ef50c089a3348d6ffe7d807806554c44c2278a833321e6b682461eadc53a56fbd6a15fa8d21d6eeba0cf

    Download Submit
  • C:\Windows\SysWOW64\bgpnesfb.exe
    Filesize

    512KB

    MD5

    7d41be7de2207d60d641640a0d05ec37

    SHA1

    47655bc952f974579c483407c304dad27204f2ef

    SHA256

    62a5066e08c1d0d5984a05d8c4133d749306d9325c3756d5a064b66c6cd66bea

    SHA512

    c6524e550236b4e1f68cc0999c6968a06933b8126d3c8b1f8e0dc267ea03bd7b35a7be831a84d02a19b5a876da931ef718c69f561d2e31df99ff6541cd268bd1

    Download Submit
  • C:\Windows\SysWOW64\cyorzpiymotft.exe
    Filesize

    512KB

    MD5

    356a25b595545c6998223bce7468b111

    SHA1

    577880f161156e734a9fc221ffff57f1ba37baf7

    SHA256

    949c7f9068905297ae33f95c04673512e53b772e2eca5be772c192e8fb5d25c2

    SHA512

    1167056deb7e446d5ef9ca9e2272a3a7af14a76379577379e8940b39f3a289e84397ea6e8f19081ae19ce1255e8340f6546dcbe5e00cac33b13a3063c4e33718

    Download Submit
  • C:\Windows\SysWOW64\hfuxwabcct.exe
    Filesize

    512KB

    MD5

    4af3f441c544c6b83527fbdd90fd5636

    SHA1

    3ab6f9f973c927265b7f5f5163b3965fa0be738d

    SHA256

    2f04622b19876ab2ea2452263be685c295ffce1ffb9b2ae85052f85cc24f1ee9

    SHA512

    db5c633f3383b4de287ec4d31a1e82f774fe8e94af942a75d1cf19e44d16c665585a7d8a60ce532e0f40d6847d05b1a30f8f5a3b718ec2054a34314388063ec2

    Download Submit
  • C:\Windows\SysWOW64\pyathnaxgslofnf.exe
    Filesize

    512KB

    MD5

    ce00d48fc607721709c592ea4ede18e1

    SHA1

    3c0a5969cae51e50475ed27b5f7d94285b2d11c1

    SHA256

    1f53596888f8fd08f231471d725a6ad26fff1e3002448b0d1c66c0e9d9e638ff

    SHA512

    ca7f05a642c293bcf28a6667c722dea34300c7c5f527920a31f3a9ef83fbc82caad23c819acff7f81408e0b20edf28b5eaa7f56c81781d985b35ab20e283a9ae

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    e1c029fc4923e2c15b502d96857b1b3b

    SHA1

    235361e134ec51d83858b370d3d23ca5bc0d7794

    SHA256

    b21f4bd36ac5a9a80cbcb34d77fddd15560e8793bca993c2588105cf3633e737

    SHA512

    29f9a9b2643c0d9c49eae55e23da6bbfaaa4ec7044a7af075839c40c639461aaeac657819c6fa470b8ce62b212b4ed9259325488ec05ee885d8170a2fd2422e1

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    f78295443c6e98e23cddddbed879dd9c

    SHA1

    8135cf93c30ffc65fe7f86d1d34112b529a410f6

    SHA256

    0650a9d5dc9a44953ba329dbabb2e324720cb46a41f5af11c0b42c83b62e6339

    SHA512

    8dc36233dc5e2bd89ac1ab90160dab027d24e19e138b8ac81fbb307369c412bde8da4a7e761ee7c304ccecca9a93b9d585025409544210228d469baab123e310

    Download Submit
  • memory/1744-41-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-40-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-38-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-39-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-42-0x00007FFAFE050000-0x00007FFAFE060000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-37-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-43-0x00007FFAFE050000-0x00007FFAFE060000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-603-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-604-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-605-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1744-602-0x00007FFB008B0000-0x00007FFB008C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4768-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download