Overview

overview

10

Static

static

5

6d434f757c...18.exe

windows7-x64

10

6d434f757c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 03:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d434f757c2657a924aaff4a7d2a0866_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6d434f757c2657a924aaff4a7d2a0866

  • SHA1

    93835a6d220122f32b5095397a1efc1aa937c5c8

  • SHA256

    bc893df201e14cf0bfac5c4f21a8815f4591dec24b599ca7e9448d7283be4e18

  • SHA512

    9e43a624152fcba776f111051348eac39de277e3501bc6233352dd09973a6e282b5fa2571fdb1aac7ac95a6839ef72aa04fd721233a7a328c408f3338ae80630

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d434f757c2657a924aaff4a7d2a0866_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6d434f757c2657a924aaff4a7d2a0866_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\zqyenngcfn.exe
      zqyenngcfn.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\SysWOW64\jbrmbppw.exe
        C:\Windows\system32\jbrmbppw.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2672
    • C:\Windows\SysWOW64\ajxsfieixkcfohi.exe
      ajxsfieixkcfohi.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2920
    • C:\Windows\SysWOW64\jbrmbppw.exe
      jbrmbppw.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2252
    • C:\Windows\SysWOW64\eofyddhzvownq.exe
      eofyddhzvownq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2572
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1880

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Modify Registry

    7
    T1112

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      d819e25aadb3872af35fb11b127addb3

      SHA1

      a706177213011a3585bfb832327a73e6ad26b4ab

      SHA256

      9a7e51abe77c482e1ccab3405e4dee32c77863ff0d2eedda39916c53cd0a6abe

      SHA512

      05ee3e149e57db2bfc0e8bc2cc5fbe8b6b99a6956ab297a0f7fd460c23c6398c674ea349f0529f073f7bf109c386339e502c8a7ac27068765f999ff86c813a7c

      Download Submit
    • C:\Windows\SysWOW64\ajxsfieixkcfohi.exe
      Filesize

      512KB

      MD5

      9291a2d8ad7986850a242846573c90e7

      SHA1

      88b7f05abc2ca2576ef581143033402734d93b3b

      SHA256

      73ceba95f180296bedd764cbadbc0f115e3b8a0373b78df616f32ea799e595cc

      SHA512

      5274152e9166e7739e1ea4bbed8b319a301753cefeb283e263bed81a4e97ab7aebeea71e2c2ad84d8701280ee14a4b616de8fba6ee9383ec1cda334ad9fef680

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • \Windows\SysWOW64\eofyddhzvownq.exe
      Filesize

      512KB

      MD5

      e6dba47ee157beed8c7dd60fdf8ead8d

      SHA1

      4ddc585c99edb20bec2603ffdfc03acbf623a3a9

      SHA256

      7cbe57be03eddfebafe0540a2c76248a75b4009032cdfda14d03b78af55416ca

      SHA512

      516a086caa50103c2dcd749257d97f93d847b205bca54c7311bb60f8c5e66b4ba6f1ddbf285582a42cd586093833e1b91be5ba8eefea2e737c7a044f4c22d1d6

      Download Submit
    • \Windows\SysWOW64\jbrmbppw.exe
      Filesize

      512KB

      MD5

      b9d54412ff6203ab224d0c527304a1bf

      SHA1

      ac09f713a1a17105179ef7d53535ee20335b9ad8

      SHA256

      3cbf1a447650b09ccef9adb8c42bb4fd1d1fda8caec623b219cde3b11ad73d72

      SHA512

      bdafa3e89d92485160c7065d857662177439e82a9f5eea0ebb8828a327cff7ff7ad20760046dc8ce80d1a31f55ab8abb755f7ba6b15d380f1c98cb1b10872922

      Download Submit
    • \Windows\SysWOW64\zqyenngcfn.exe
      Filesize

      512KB

      MD5

      862ec1da78f13792603743495812b049

      SHA1

      98f32f68b4ed4bdc6cb95b723657db92539592a0

      SHA256

      fa66c899e7cad5cff4fec55afbcb310036215456cd6e4ff4dfa8dec5026c9525

      SHA512

      6d3911044f9050110943913df4c74af196c48a3cf693ae21b4b08afcaa186bd7026d328c863777ca96263f21dbec7a4e7bd947dcf6ce72f6b461169dc8035f3c

      Download Submit
    • memory/2004-0-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download
    • memory/2520-45-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2520-96-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download