Overview

overview

10

Static

static

5

6d0ee4af41...18.exe

windows7-x64

10

6d0ee4af41...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 02:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d0ee4af41a8ee2139a4e3bcfe862e27_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6d0ee4af41a8ee2139a4e3bcfe862e27

  • SHA1

    6d6b28a1da461971e9efb095625c7c12d6b99b24

  • SHA256

    91e9e889927ed93e95baf92d1d56570824c6c4a00998d43f02d193d04f06b91c

  • SHA512

    c4ca7f3c8907be0355b0a4c67b6078f9984685d6033a7c87f4307fac64f0b27320f12bae6b5fda8a9290d922703480444c83b07b010923886002568c32c34fa6

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d0ee4af41a8ee2139a4e3bcfe862e27_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6d0ee4af41a8ee2139a4e3bcfe862e27_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\dlsulngkio.exe
      dlsulngkio.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\SysWOW64\alajmlhv.exe
        C:\Windows\system32\alajmlhv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2540
    • C:\Windows\SysWOW64\uzqnukouhrmyntg.exe
      uzqnukouhrmyntg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2708
    • C:\Windows\SysWOW64\alajmlhv.exe
      alajmlhv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2972
    • C:\Windows\SysWOW64\acokjqjemuami.exe
      acokjqjemuami.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2820
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      95e6e18463957131e11e04a19ce2e889

      SHA1

      526b76aaef3e1227bdfa14f8b7c2e3d5b9e735d7

      SHA256

      d16ce4df6c1b24450bf9f90618cb7a486b3b84e9daa2de9c93d18df8bd90861c

      SHA512

      7d0ae98612d537f18959debc19d8503ace3ca09931c96408b26033ce659a091bbfa74dad1269ef75332b8409c057174ee82803074eba6f81e76b624de1a90baf

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      75b19e87614eb881f2d20762df3369b9

      SHA1

      c11920d713402ffaa61146c0da7318074621c23a

      SHA256

      e5b87eff5a87a0f7f96c6af2cd76b5f58ec422b3394c9482a90c3d5187b5f53a

      SHA512

      b84df98195c98f2c244e224f5f4e8b8f70cf0f77b767381e490caa23af2557d8a1f58820f3ae87b47ed0cebd8a03d5fc6781274124337c3ac47772ba271368b9

      Download Submit
    • C:\Users\Admin\Desktop\EnterWrite.doc.exe
      Filesize

      512KB

      MD5

      c0f3adf80ecd0055c0ddbf5743676b04

      SHA1

      8908db0eed7c8c3b226cfdc27c3252c5ea8e48b2

      SHA256

      2ad99d049fed1ba82caa9f87d93343b4bf17fdc8b5311ea21170a2a542ef0d54

      SHA512

      2feca2558f3b26faa8fea43dc0cc34b27de6742b337d261c6082c2a4aad09bb7c1b51409d2846973140803ce707e775fdddfbd4177c376463fa68063f4334603

      Download Submit
    • C:\Windows\SysWOW64\uzqnukouhrmyntg.exe
      Filesize

      512KB

      MD5

      f331e47c44baabd9fbce6a22d6df4c19

      SHA1

      5db16023fc5c9bae34bf66cc3dae24eeab6301fd

      SHA256

      eabf7bd5f7b2623a4a6a81425c0ca5a6cbbd9b1c3c0d3c79208a3f5d3ed6533e

      SHA512

      3083efa7fb7a1686e202401c6f96860dc5ea7ca53f242f99a2570e2cc3b0a7ead3c669c5aaceb9c64380c1ba3f46e012aaf284345a429fb4a3b7a1fb9a4b3fa6

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • \Windows\SysWOW64\acokjqjemuami.exe
      Filesize

      512KB

      MD5

      051aff36be46d3ebed2ae63c7dafd289

      SHA1

      30cf7afc4ebbc16ea37595ee97a2148aa8a5f168

      SHA256

      5fd356fb23f5f8124c8f4e876ba502612813d8fdc077bafb1cfc7f630740d37c

      SHA512

      db956d453d17c2b610cc803495a9329679129fcc50d5504d55b1370ad25d9673698e89bc408722d64c682306ecaefffbfca233b9a674faae02f2f1c68499e67c

      Download Submit
    • \Windows\SysWOW64\alajmlhv.exe
      Filesize

      512KB

      MD5

      0ecca09ece0ebe4d9a109e7ad4ff3a4a

      SHA1

      5c9bf0b4ffb9b64ece3ceb8549ffe5edfa9e4ddf

      SHA256

      5544b4b4235414cc2cb206cda8c3d1628ceed43f0de983f34f79d4da1d2be6c6

      SHA512

      1be8e87f3d56c99b8a4f450295ed95d625c844a99c73a73f3305b6d99ef25587b331eddacb4fb359acf88170ebdfc7e6c567ecb272c0ea0dab2fdaecfa50d236

      Download Submit
    • \Windows\SysWOW64\dlsulngkio.exe
      Filesize

      512KB

      MD5

      4ecff865a7a0ce40b01448a674f79791

      SHA1

      7611d39eb3403d3ad1c3d924839ef75eeb4559e9

      SHA256

      2651fbefe767c3e30c2b7e078d8cc8e5a867c2055654fce72fd4d87020bf295f

      SHA512

      6d015ad09cbab4ed5896d7e1d0a411c2a75ae2b6dbf6e9d34380d253aae465232dfbb3839b1fdba2be77a610efbb3842524fb3e31aec154f4363e2936ebc39d7

      Download Submit
    • memory/2244-0-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download
    • memory/2560-45-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2560-104-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download