Overview

overview

10

Static

static

5

6d0ee4af41...18.exe

windows7-x64

10

6d0ee4af41...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 02:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d0ee4af41a8ee2139a4e3bcfe862e27_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6d0ee4af41a8ee2139a4e3bcfe862e27

  • SHA1

    6d6b28a1da461971e9efb095625c7c12d6b99b24

  • SHA256

    91e9e889927ed93e95baf92d1d56570824c6c4a00998d43f02d193d04f06b91c

  • SHA512

    c4ca7f3c8907be0355b0a4c67b6078f9984685d6033a7c87f4307fac64f0b27320f12bae6b5fda8a9290d922703480444c83b07b010923886002568c32c34fa6

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d0ee4af41a8ee2139a4e3bcfe862e27_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6d0ee4af41a8ee2139a4e3bcfe862e27_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Windows\SysWOW64\dlsulngkio.exe
      dlsulngkio.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3560
      • C:\Windows\SysWOW64\alajmlhv.exe
        C:\Windows\system32\alajmlhv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4884
    • C:\Windows\SysWOW64\uzqnukouhrmyntg.exe
      uzqnukouhrmyntg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1972
    • C:\Windows\SysWOW64\alajmlhv.exe
      alajmlhv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:884
    • C:\Windows\SysWOW64\acokjqjemuami.exe
      acokjqjemuami.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1464
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    f5a37f17b641c6c4e3734040eaf7b31c

    SHA1

    32537e18f46a889919af4bf460eaa2ef7a31a780

    SHA256

    7172ab2e1bdcab22776e08366ee85865df3adcfbaa8b8e04326f7fc93d0959e0

    SHA512

    292e44516962e4a859e067ed4d6233df6acb484f37ea8d360859c6397b1150bb66c458e81c4b7334b45aef77291c768982da0e14c2949890194ab17eff9f8ffc

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    d841373c5e47c479f21ae7dde6903138

    SHA1

    976a7c34735fc861ad8d0dcd82fe192ffe0fb78e

    SHA256

    8fe16d4586525089caaf089be0789b6777587bb22bd19eff6fec6b1011e9efd5

    SHA512

    59eb3da0cf11361f1d71db5c43a1e1dc2026e7fc73b4c9ce48b86762554cc8a96202ba848326c33e231c051fc6b813ae1e818cf22ffe0bb7f44f8786b4274146

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\TCDA28E.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    69ab36f887c9aebc03cf2b9924e9af1a

    SHA1

    e89545bd4d84ee79b970724d81406111054e5ede

    SHA256

    7f418960bedd2f787ddffced8647021d08a07fd59577d0f2d012035779122e62

    SHA512

    dc8ae47740aa9109b9646d40500529aeda9c71421f5586f2d6c45a96cdf5a10dd7a4ae45193fbb58d6b3ef918d476af02f699111a1280ddd71cc1f65af38d653

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    97cc34a6853cb0619e5796c967ea186b

    SHA1

    38940391907df540099d8722c545e773bbe953fb

    SHA256

    f6beea756e2a52835eeafc9f260206cd25b2b3171271e16451a2ce6d7e0e9004

    SHA512

    5dc13ad63ba36fd112ad18f58211fed34f576bbbc5bd48deacd0c60377746fb6324fd5dcb2cb693c15ef02d4b772339ae848f7308019565bfc6e9da9a535e9e9

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RFe57829d.TMP
    Filesize

    3KB

    MD5

    118830ea6e278f59d9f2bd9c1872d70f

    SHA1

    702389cb37594b326e6c7da5aa033264f3b295c6

    SHA256

    c3db81e320fd1af8d79f2662d13471af03922a41c23da43622646b9a5e06e87b

    SHA512

    79d47ba7fe3309df925a312a0026be7e50e2f1f028ed1de1515c8f5f18b19568cb63207a1089a17a9c0d5a291fe682dec0207ef9aab497bcd50b52c2972027ab

    Download Submit
  • C:\Windows\SysWOW64\acokjqjemuami.exe
    Filesize

    512KB

    MD5

    b3ab4bc547cc446f27d8b6e59f7b38c7

    SHA1

    cc33d878bd96854e6fc19be6abeee2dcf15def09

    SHA256

    36b85ee33352ef8d9c2478912e181d6329b4f5f93264bd190ff9c505c2163d03

    SHA512

    1ec94d048a25623de4e41a22ef640078ffa72cf88ca774fe11bf7f4c3419dfe74bb93f3fb2683d9adcdb546339f58223eb4e9bc9745b03eeb336ba73c309a4a8

    Download Submit
  • C:\Windows\SysWOW64\alajmlhv.exe
    Filesize

    512KB

    MD5

    e63747e1b5b3c147e216367cca4d9705

    SHA1

    20e23bb8b2aec475faa5868478f37efe1face790

    SHA256

    e4eb954d6f4ec43b51d8f09624c5c1f4e8c8846c6cb9f652c814e69609dfba13

    SHA512

    c6bce6ce27581ffbae1d945f0dab491965305d8527c31b68a6618a8e5cd59b41f42b57d3ff0e95b15b8f2fe5185665b0c5acc8eae42049a189785d8194b1b243

    Download Submit
  • C:\Windows\SysWOW64\dlsulngkio.exe
    Filesize

    512KB

    MD5

    6e7e7804151a28e81b9fa4d106a2010e

    SHA1

    253557b7376b3bcc4fae2641cb118d2f6b8e187b

    SHA256

    96b8f24e902d589eecb3a3cd30e646e87fd558da636b0daec75b5cad881a5d58

    SHA512

    5502ce157a58daebb628d6c9164936fcc9562a0a1996bb052e317675b3228db8b54b8a83fe8ea47923b51713e1ad49f6996eedfd41f6c3e6b5694bc66ba6183d

    Download Submit
  • C:\Windows\SysWOW64\uzqnukouhrmyntg.exe
    Filesize

    512KB

    MD5

    157f8e3eb0664461947b1b1b3e0e94a6

    SHA1

    47bf497a85169f23f599e6a707c44cb8c1a88a99

    SHA256

    47259a528ba4fe603fc7f6b758265fca6f56e40692a71be80b1f72881df2fcf2

    SHA512

    7cf0cc4961038db72bd09cf5f47e5ab1368a55f3743bab47613e03bfa3190ecf5a22e1c1fd4acded1f5d6932969db06eaee47565408bb1ce043121272d576424

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    df6ca7866d20a5830f43f04c5222a460

    SHA1

    529213ac29603a3fa792fe9f86091e1855b36ae3

    SHA256

    cd8953f9085444f9f94cc65ecd7589fd6afd1a52867e5496faca33e5e96ef032

    SHA512

    2219b304ef376db1eb2e969b70ee1911917050f7d0a4b74f58a58eced71a2ed25992b2a120acff1b604f3b319f35efde568b5b3a66e95a8d8f40244754f45563

    Download Submit
  • memory/932-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download
  • memory/1984-36-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-39-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-38-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-37-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-41-0x00007FFF96100000-0x00007FFF96110000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-35-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-40-0x00007FFF96100000-0x00007FFF96110000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-595-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-597-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-596-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1984-594-0x00007FFF98550000-0x00007FFF98560000-memory.dmp
    Filesize

    64KB

    Download