Overview

overview

10

Static

static

5

6a2bb8c0e4...18.exe

windows7-x64

10

6a2bb8c0e4...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 07:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6a2bb8c0e4b33a844771d9eeb3c505bc_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6a2bb8c0e4b33a844771d9eeb3c505bc

  • SHA1

    27b9fcb78efd53a7dc3e6fc8cf1a87015ae09b5d

  • SHA256

    333fd0d25877ece61378b308ede4afaaa5ee5e162e8b908f8be06c5821f73ce7

  • SHA512

    6efd6595a9d04d1c6649221a88b9b265f37fae54b545e4faa4debf8afba2e20ab5b0c6bf7c9c02a479c061e5ce4f7da4a5f17a5cbe43fd152ad547c1c3a9a72f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a2bb8c0e4b33a844771d9eeb3c505bc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a2bb8c0e4b33a844771d9eeb3c505bc_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Windows\SysWOW64\twinxsjlnx.exe
      twinxsjlnx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Windows\SysWOW64\vezavusu.exe
        C:\Windows\system32\vezavusu.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:60
    • C:\Windows\SysWOW64\qoecyyymnntauep.exe
      qoecyyymnntauep.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4984
    • C:\Windows\SysWOW64\vezavusu.exe
      vezavusu.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4364
    • C:\Windows\SysWOW64\sawzouplbsxee.exe
      sawzouplbsxee.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1636
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    56f24f0a5f710abd6643f11a2490a566

    SHA1

    38d37d6627cf9abc72c3d624a86a447ce1a74cc6

    SHA256

    73300970b3016b65265ea8743d30dd91fa9fdc8e5c397d020c8f98d12464752c

    SHA512

    edd6ef58032b19d16e6b7496c455bc0ae55556bc720edb5411fb13973319bd114b325c18df4a715f7b1ed4b5775507ae7ac3345e695db84f8b84613b38ab973a

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    2ab5a0ecdcc20049b8134ea26b77dfff

    SHA1

    379909358e12c8202b357ef9742d6623b3cec24d

    SHA256

    d551432522ef00ce37761033973918f0c446e5cbd04bc3c35ae9bb170f0b07c4

    SHA512

    f7f115dad25d56a1a0ed1921a6f599312bcf91ffd861a3e13a5b1b736d9dddcbedcac259d179f76270c526dc04fccde4662d6fc8e8b037d633b6f506906915ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDCE61.tmp\iso690.xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    bdd0599c66d4189af28570fcc33afc1d

    SHA1

    32cdb10e70c0c4df1f19589a3b3f06ab25a7b56d

    SHA256

    dbb8b102307dd53bdbd80b103ea126755d00c14decfcfbbe3e142bdfa3194bf1

    SHA512

    a3d6881cf422e4b5aef10ee203c671dd435d06e8cba9a0c03681975a343af1ce5a495a4d13b37872f30fa31596048be32c50e8ff69f497a27c81cd2f1f47b14a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    848cdc21b4ae0fdebb0a8d6150ed3bc5

    SHA1

    7a556b56e9767a3124b635308c6d0cb5c3d4efa2

    SHA256

    ec349b9b082cd465cbafda1676e1125bdecfe2b845e0d2b42b866992f743b8bd

    SHA512

    70464aafa60c704b609c6c7cb93feac3590a267bfc98795669addada0b114e9880104dcefd80477eb57d71c7e743d0105d71533223ca0e3b5445bf51aac58cf0

    Download Submit

  • C:\Users\Admin\Documents\OpenUnpublish.doc.exe
    Filesize

    512KB

    MD5

    52e7389907ba6529da59f6d5bd0138bd

    SHA1

    61621b46d49fa2511c3d6bf119b8c674a07a6fa6

    SHA256

    b43e50f5ce99b0eb8f0674940b5fb65299ee5591f49e223c79dd7f7d2855d001

    SHA512

    b843b6a12a84141bc58721dba39e506d2d5740b8f7be6be63967f8f1c54982ab6ddf047f6ac45d9aadc0c0703bf6cd608afa55c69fdcf4f587f9a215b49611c1

    Download Submit

  • C:\Users\Admin\Documents\RenameLock.doc.exe
    Filesize

    512KB

    MD5

    1d6282c55d6ee1b6017a6155d6ad8c53

    SHA1

    2d2163f4e3d6804a7f011a47107a62661d369811

    SHA256

    17f7e5632202f9af924a8352262ac3a467cf78067e2792012c29317b488f0f7c

    SHA512

    481011e7b3cb31aca411fc1302d0aa19a8b4f3462a387ff24c27aababc65d477323962a7835ce6a8845a96b50f50a78aded55188b160f920406ba61123b6d01a

    Download Submit

  • C:\Windows\SysWOW64\qoecyyymnntauep.exe
    Filesize

    512KB

    MD5

    aeb6b021ff3d96a94951c7b913b71f1e

    SHA1

    c553ec554ad8162d56d1eb80086afb84f379457e

    SHA256

    95cd4a18d5561daa1dfa8955bbe3d8fe7f4e882274e206f0c2e747ff01968030

    SHA512

    16bd6a3ae2bc7d8ef1141075bb3a4a9af567b09a0e068c5f268a20ac0f5a1165509bd0a06e1b2064af971f8f79f23fd82d503da6ace0b943380da058934b90f7

    Download Submit

  • C:\Windows\SysWOW64\sawzouplbsxee.exe
    Filesize

    512KB

    MD5

    78823b3cbb9d87558e4fe7410907fe7a

    SHA1

    a04d0e53d25fdf2f3b9bd5d15dbbcb55a8794359

    SHA256

    b8c14f51b58f28d276d534a06a99b820ba5e20e52cf0d5a636d365a0c49fd758

    SHA512

    a3ad81369aea7989d30ef2d14026a5226299cc71745f4d626df665a612aba90516505430d791bb90ad3d18fb481b08f8b414a4fc58ba9c0d20ed36194ca96d9f

    Download Submit

  • C:\Windows\SysWOW64\twinxsjlnx.exe
    Filesize

    512KB

    MD5

    58b520b6d3bebce2e38ad8da16557c0f

    SHA1

    7debd67209193e6729ed2a14be0e5cda083772dc

    SHA256

    192931c44be06644e9f563101f56ec826e0e94aff75366df9f9adf4f64041129

    SHA512

    dafba6e493b56b46b865b08935031e9859842c698d8bd8d872c8fe1cbb9b53d4b2e70fe965aca30a1640cc2c86febe84817c5c3050b49e47a723902ae65c3e31

    Download Submit

  • C:\Windows\SysWOW64\vezavusu.exe
    Filesize

    512KB

    MD5

    07900fe969f2d3a8a66c835759dd824c

    SHA1

    98a863c844152058a1b7b3a345129c01f2eb8832

    SHA256

    d8879c661c5a95cf7ac5d70e610556b4f13264f76f0f07470e4c3683f85a098f

    SHA512

    7e9641ac80141d98c273b5d239aea71c95ab3a4fa31086cf729acb6dddbc06fad1bcbfd794a607c168c5b3c9747a5e13eddb20566e854cabc15fc956b046e5cf

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    2b4e3f55bdbd32c5be5f41f7f1ba1cf2

    SHA1

    29cf96e397ae36ecfa64f35d3dfb6f20951910a3

    SHA256

    6fc09bac0ee131e87fe974722d46a818ba4d608aa893dee58d9162e619808fb3

    SHA512

    03e4bf4a4e437fda8df254dc0e4ef227f7b89c694ee728232047ccc3484819eaeeda3b5c818a1b97d9cc56968da4a432b13e25b72ac68309acf75dfa9225e91b

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    8a6bd83e8cb3724fe1592f785c6fd5b9

    SHA1

    5bd679801915b754aaaf4c2482d5817aee26d529

    SHA256

    1c1f7af958ca7e5ccd01c9b3077fac1096e7d24aa7b0b7169be255facbd07b53

    SHA512

    15ab881b50c81e398551798970047873d7cfbed0d7d648436217225d2c2dd2f16e94851a9b1dd1463a8d85e80dc3bdc92f86f943b8099c16b80e436efbbbaa56

    Download Submit

  • memory/1668-39-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-38-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-36-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-37-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-40-0x00007FFD89B50000-0x00007FFD89B60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-35-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-41-0x00007FFD89B50000-0x00007FFD89B60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-607-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-608-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-606-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-609-0x00007FFD8C4B0000-0x00007FFD8C4C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4540-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download