Overview

overview

10

Static

static

5

6fd9a7f9ea...18.exe

windows7-x64

10

6fd9a7f9ea...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 21:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6fd9a7f9ea4230b01d37da830d9fc2d0_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6fd9a7f9ea4230b01d37da830d9fc2d0

  • SHA1

    7cb56b8b19c98b78857b9ff7a3ec91cf4d358970

  • SHA256

    f18826b5d3d6f6f9fdde8c8a9639a47228ec8a276a1601bccf8aafe300b50948

  • SHA512

    47d16ac61e43e42790dbb3f26d8b2cb669233f76e8fab1f3c0647163d9adfdbdffce9b06148f37530ec5fac40bd160e2c21933488f23f2372a3dc1708304a675

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fd9a7f9ea4230b01d37da830d9fc2d0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6fd9a7f9ea4230b01d37da830d9fc2d0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\SysWOW64\rejymzcpew.exe
      rejymzcpew.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\SysWOW64\zntesjtg.exe
        C:\Windows\system32\zntesjtg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2524
    • C:\Windows\SysWOW64\mtbsqdazxszlplg.exe
      mtbsqdazxszlplg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3060
    • C:\Windows\SysWOW64\zntesjtg.exe
      zntesjtg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2648
    • C:\Windows\SysWOW64\jqhksfrdmxvnh.exe
      jqhksfrdmxvnh.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2548
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      1b6135bb098ec0ec5a126dee93e88f84

      SHA1

      b6d9c2f2c521ffef3200737dda1d583dc433a9ff

      SHA256

      3aa2b1329094f00f9edfe7b4a1f314f9ea60c855d64fe2d1ea20919233c778ea

      SHA512

      297b1fe8cc7adfa64b614dd9c26ae5646da4a304861f8ca51253309d344173160ac9b36391e2b561d206d27f4024ff279093324e75b0eab798463ac7c26691c1

      Download Submit
    • C:\Windows\SysWOW64\jqhksfrdmxvnh.exe
      Filesize

      512KB

      MD5

      4b1f48d94812c095d00ac54464818e74

      SHA1

      31d19ba4ed061ce943548c13f707c5ee0aa39335

      SHA256

      3ac1452f7b105ab10de7c9595a1efadaa4f981e76b584e3b973a0075c0436cd6

      SHA512

      3e8643b1f6bf858cb822bead4928a9f28f6b9b24a59518d4ffa2c998691b952a795eedae8673b066f85af3398292c21b17232c5ce87930c9d777834a8c1ddf88

      Download Submit
    • C:\Windows\SysWOW64\mtbsqdazxszlplg.exe
      Filesize

      512KB

      MD5

      8aaaf71c8ccb0cf67710176ed1524af6

      SHA1

      72e70da4f481ad4ec506ed30e3186a0b656951f4

      SHA256

      138b9bac6eabfbd9a26c99937a8ba3db8750a2d0e11cff9699c219300efc6e24

      SHA512

      c168f8fbc26514e6404132ce851383d088a4e692061b52c635369e312ff408868a5c2e09c25685c5ac9055f076dfcf6e641e364c93a843750d14a5ee5d6f3a3a

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • \Windows\SysWOW64\rejymzcpew.exe
      Filesize

      512KB

      MD5

      326ce18197a823d83b99a1b8ee248726

      SHA1

      32ff6bbb89eb069126603341e61c7cd7a7e5712d

      SHA256

      599bbccda6311ee9d7369a5a88a0b6a6f518183dcff56c1afc73b3be0f562a2f

      SHA512

      c164afe2c436bff80236a02fba677940739139f387af20a529facc973922c3ccc12ca60d485bb7ea25184048b654717eff7c5fa25dfb48cf23df1cc5864349bc

      Download Submit
    • \Windows\SysWOW64\zntesjtg.exe
      Filesize

      512KB

      MD5

      c7db8f7aaec0b2482cc260b19e326a24

      SHA1

      ed3c8fc509fdcd2bad9f5e5b30488a7747fdf90a

      SHA256

      ed958aaca56f39b0b82123381fd314f5d713fa180b47c47852f162fb52e04a72

      SHA512

      61534c6967f632ba039c83d055a95618c15382a95057ac70005dbed145f5d10f919aeac704c7b3982a9b27efb9e7d544adb77eb7c47492ba3cf59a8a3992178d

      Download Submit
    • memory/1504-0-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download
    • memory/2596-45-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2596-92-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download