Overview

overview

10

Static

static

5

6bc7146d38...18.exe

windows7-x64

10

6bc7146d38...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23/05/2024, 17:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6bc7146d386e26ce3ce7519cddf3938b_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6bc7146d386e26ce3ce7519cddf3938b

  • SHA1

    81866157e77f2df4840f23a2f14a38cb85574e1f

  • SHA256

    ea38bfc76603bf0d69cff913671ebfce4fcebfb9574e99754dcf017427360155

  • SHA512

    89b090580e532c508682ea9acfac942d2d06a90a984614ad4ad7743b7ffc995c712231c62d14424eae9d2b6fafcbacc5302e9b27438fd22762fa6ebf3e4e9b37

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bc7146d386e26ce3ce7519cddf3938b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6bc7146d386e26ce3ce7519cddf3938b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\SysWOW64\evgyhclilr.exe
      evgyhclilr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\vqgjloxz.exe
        C:\Windows\system32\vqgjloxz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2560
    • C:\Windows\SysWOW64\vzycdemexuehhfv.exe
      vzycdemexuehhfv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2352
    • C:\Windows\SysWOW64\vqgjloxz.exe
      vqgjloxz.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2744
    • C:\Windows\SysWOW64\lleeqqxiltrup.exe
      lleeqqxiltrup.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2088
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1684

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            9b9fb6971b4dd5e95ee341306872d243

            SHA1

            954cfd5b4d738abe23574183e0a3664f102cae85

            SHA256

            88efef9d26c1d7c3f8e193588b798180c880fa8db421dba168dfb7b0a3f978be

            SHA512

            9f966901f881d12c682ff6cfc4d6d426e28cc183b4c67009ec1dad06c617c919e8b0b7becf9be499b31ac60aa015d0047b3fd844bc640839593220fe0af20b34

            Download Submit

          • C:\Users\Admin\AppData\Roaming\CompressFind.doc.exe
            Filesize

            512KB

            MD5

            02e93cb5a2173f44376705cafefeb330

            SHA1

            aee623072928242f95f6c510e91941a50fe6a996

            SHA256

            9357bc00cfed444e5beb6b59b36b741d4ae6e8a23658450c2268c392d5962c55

            SHA512

            74ee77a0e83a4fa5bbbcdf8bfb8cb1df1d6948bbc8c0a0f3444885c1d2d7cc2683320cfa14b42d0d8e79dad18a39919e95654670b43ee1b709759efc638976b3

            Download Submit

          • C:\Windows\SysWOW64\vzycdemexuehhfv.exe
            Filesize

            512KB

            MD5

            1572811b4e59b977a8a8dade10f1752c

            SHA1

            bd7bd9dc42c2393809287ead22bc14d198d7f8c4

            SHA256

            a71eb35753509c94ce6cde1d921a166284d3206e344ca18db534afc4da8a8f2c

            SHA512

            f12d605152744617e89ddf4dbb8c1bbde4d66228df3cc2eecafbb993ba97a5cc0adaf91e663bd32219c45df79189d9bd551d69d0c886223e04ff7dacdd3a4108

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\evgyhclilr.exe
            Filesize

            512KB

            MD5

            0883cddf8393ee66317e1d49a03fb7c1

            SHA1

            fc7d6bcc3948742a135e9c76e2d8960ef9b4a659

            SHA256

            b230b944f0ba29ffdcf88b82924bfc3c088d6daeed3a30baf50a4a11e5cadb31

            SHA512

            aea22fb000d964d5988fdf9ee9af6915886abcb185e558f493f591c4f4b5477b0d68b90d325254b07c50b95081526233efa813db1d7095ba0b7acb952ade884f

            Download Submit

          • \Windows\SysWOW64\lleeqqxiltrup.exe
            Filesize

            512KB

            MD5

            7ba2cd5be7a3b1713a7654093746b1d5

            SHA1

            2282713d6fc47d61c62710e3f741000a46af836a

            SHA256

            6517c8822ab15740c095042bb26576d8a01dc635ccfe87d0f830a8313528900f

            SHA512

            db0c8991a942908b6e85dee956219041ddb074f1caf6b439608a66f8918668538717e25b63b8e59aea40f9dd880cb49b4568df664167f1970373962cbc1bc38c

            Download Submit

          • \Windows\SysWOW64\vqgjloxz.exe
            Filesize

            512KB

            MD5

            4b0770f003f732a2f87f2073636fdf30

            SHA1

            d813d6eab05a7308c79e75f015e0f2f80c9917ac

            SHA256

            fee1e9f806db6524184da41ae791fdd6c6c1b1084bf8f4fbf059fb425d2a9dd2

            SHA512

            77cb3768705b023fea7cace843eebe572133eb15ed90e4bfa1c42235284ad4403d10d259491ada4e2b3e6a69a9493bf6f9e09de2a0757da51c20c98a76b1bab7

            Download Submit

          • memory/1684-85-0x0000000003D40000-0x0000000003D50000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1980-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2960-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download