Overview

overview

10

Static

static

5

702a27e40a...18.exe

windows7-x64

10

702a27e40a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 23:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    702a27e40a259877b90c92cb15742892_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    702a27e40a259877b90c92cb15742892

  • SHA1

    474de8b01e95cdbb55e9aec9b2c0a8d6d3b228ff

  • SHA256

    ed54234f73fa20b99ec8da643be99d3350fed29e11532fb5cfcedfddec471804

  • SHA512

    c69b4cb8b9c135e930bd73678a09221ec162c2a00ae4e26f05cfbc4b89e5c733b333a4e5a7fa220cc3483ee04666d47ccb0d3fab3faa8210734fa8f2133f704f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\702a27e40a259877b90c92cb15742892_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\702a27e40a259877b90c92cb15742892_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\lxdvwpvflv.exe
      lxdvwpvflv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\rpguysnr.exe
        C:\Windows\system32\rpguysnr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2928
    • C:\Windows\SysWOW64\fozmdyzmurzyrjd.exe
      fozmdyzmurzyrjd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2608
    • C:\Windows\SysWOW64\rpguysnr.exe
      rpguysnr.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2556
    • C:\Windows\SysWOW64\jemqinizjwdan.exe
      jemqinizjwdan.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2404
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      c39b5a502f8cb04f775f81e37f31f1f9

      SHA1

      df7d4a5eccf3fe8e20f3e0d0909afbec74641de7

      SHA256

      baa33a8dbbc368a5e930d0872791eabdd2bed854864a73ac69c418f3555a8a49

      SHA512

      25af9de9d5eeb90776fbdbe03254c42ff48ad846bdc35c4f343d0ceaf129638174aaa700c621bbb0890a0d11c8d5d2a42bbb71996a2abd9a79ab3a0efec0c5bc

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      f93ffb46d22e53e87d0d72f75909459a

      SHA1

      101e2aed742d47a2040f6bc6931f2e30c0607dc4

      SHA256

      394968ba5d45b442c8146d4949e0f1662bfbbabfadea6b23d86f32bbf5124fdf

      SHA512

      632377343014669d5987f3085987570e32264c30a2769944d8b7415bf51083217c477a9f626ff9729430fdc02f4c1a04396b0ecdafe1b69e33b24566eb8fc79e

      Download Submit

    • C:\Windows\SysWOW64\fozmdyzmurzyrjd.exe
      Filesize

      512KB

      MD5

      fa78820637270d90ece0e2d5c19fe08e

      SHA1

      a6ba8561924d70f185815522f7e1d8f3e2e9eef0

      SHA256

      4ecc09ede67edc5495bc65205ca1035722f5b2ffd73dc1c2e890ebb1f231bca8

      SHA512

      9a49e6b24e452bd76c90216cc16797bb1a70d66531eef9eefbeb8d1064306c6562c3cf2b355fb9ed8af603c54dc3ff1c8f97c89d097d02875eff50f0c485c070

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\jemqinizjwdan.exe
      Filesize

      512KB

      MD5

      8706133132fdf8cdc8f798b25223bd78

      SHA1

      0d0a3c3e2142a4c9bd549743e3b688fa309f26d0

      SHA256

      dd0bf12b86d740a5aed9c374ed4ef2eee514c0c3241ff36b784aaa93340df186

      SHA512

      5c28cf46a251802d09237a56ff63f9c9af85763de1a9c7353eef329f74309cce6c11fc2559554e4e1f763aec86f144b9931d1ecb1767fc2c00e01c5ae9963f36

      Download Submit

    • \Windows\SysWOW64\lxdvwpvflv.exe
      Filesize

      512KB

      MD5

      6fcaccf4c28f9254ac84029c7431efa9

      SHA1

      70d8ddce44bb6dee38f442783bf1f40549384187

      SHA256

      68f2988cfaf0fe91679336cba90374693a6ecfae3976f3f92949843a4eb11d80

      SHA512

      ad80bc2f235a22cfaeb541b5df7dd549b46d42c8535d983d0d58a1b2e0fa6385bdbd0f1af5ff78712ee3f1a6ac2e15dcc2da70edf868551d7162f33bd2bbc76c

      Download Submit

    • \Windows\SysWOW64\rpguysnr.exe
      Filesize

      512KB

      MD5

      27f4d76f2f42c97974a2ca2afa3aa9dc

      SHA1

      91b01f1b68f407dd42a8bea53e624fd22f33a7ad

      SHA256

      e729fef6f779a9f08d0798e26d3dbab01a78174ec18d20ee78ae1e81581d9372

      SHA512

      d81103f28a705f7580d0560eafa6ef0d4082f36ec7e4cac7236db3c0cbe0325a6aefc126a6ecd6d3d939e40f7a54915ebe66c73b92283f03e4e22649cae1071d

      Download Submit

    • memory/2408-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2408-94-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2872-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download