Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
24-05-2024 13:17
General
-
Target
6ea2cb6255c610ff284557eca68ac19f_JaffaCakes118.exe
-
Size
512KB
-
MD5
6ea2cb6255c610ff284557eca68ac19f
-
SHA1
3884d1dfb2d5741a3c23345147bbda72fab20e3e
-
SHA256
b3ab1c838e175177b88372a57884343cdc2242e069da6a2db392ae2a48509d6e
-
SHA512
63f293037a8d2da95a535e764c435fe23780477e508cfcb4f72e319671f25533fb7b4a0d1ea85837e5db5aaa80ebbe088125470f9c7b22642a7db8531b265068
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ea2cb6255c610ff284557eca68ac19f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ea2cb6255c610ff284557eca68ac19f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qitefxwdtt.exeqitefxwdtt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ikcfzzur.exeC:\Windows\system32\ikcfzzur.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\rzhfuzlmofdzqjr.exerzhfuzlmofdzqjr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ikcfzzur.exeikcfzzur.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\jmsoehsfwqrrb.exejmsoehsfwqrrb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD582dcef3df35901dcaec957f4ad5f49fe
SHA1d7b9cdcb4808b468db69bbbe9dbcc330d621ba95
SHA256e9de557c8c3e94223e588f7cbaf396ee3380e83d471b9159dc3dfa0a212b5402
SHA51235c37f4fb57192d258300e743e66f618c081f42ea62bf262f3581959bedc00f59b8f491e91eea9adc304d43e20830b2b3520e1a3ecf5ab414fdfeae3a40db749
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD56c0ec53d6b24985b7ec9dfa86bb09fa7
SHA1abfb55884317b5eb1929c8b92a079ef1ceb0037f
SHA256fd18a03e11a819805d3fab5147a7699419a17c7a3b6c5752ccd67b898328b688
SHA512be04bcded0e00b0d062e0a136b067de34bb44109c54d90324b8b19df97747b7396b1aa72fbf484940270283df969a0fa72396f4def59757faad6fb7ee376e31c
-
Filesize
3KB
MD5f8387522735787ff2f325d6651a1f796
SHA1e797f3b015fff0975693b26714f5989a6901fd56
SHA25662ce3dc29bad475c581dd0be09a1a0f4436fa183b2def4811db3d97efc360350
SHA512b5a9b3447cdfdf652b5e8e410db127f088ecddeb93d158bd3f8024d6e4c3fb7724bd51cfd0729c52992fad1c1016699365dce988939db25b8f6a07c2a9dd8609
-
Filesize
512KB
MD519a0cee23791b2a03b18227d1c2eadbe
SHA1ce46fd9e4332579ea5da0721ebb4e5ffafb0d7f2
SHA256cf1f7e114073d8b758dc95777f126b1c7c57713b8943793d938dff70c2c05d9b
SHA5126e4dc87a4f4d1aa49655b5c71ba9254292541f3654dd45d311f1f7dde7a878688efe4db96b49a6d5734555c42e63fbfcf2cd74ae26b353ffc1d4345f5018d364
-
Filesize
512KB
MD5b4b9ff692ac7a56f957f9d0ec47ca692
SHA1168b9e1f62424d7df5fe2b891d4cbf8cadb968ad
SHA25698c0693c0f34c1f0f86939622febb00a39530381a46b1b3d1abba2a81cf80d0b
SHA51228f0b3101b0ac1f7a12d577b74eaba9f258a5f2e5ae3abda481e2a6acf9ee02a3af25a22a349e0b66a19278a846ee7f9f7f0904391796421a24e6b8873f98555
-
Filesize
512KB
MD5fcb2ebbaf6d3f090c60e3ea4f359c554
SHA1bc51796781c760ae35f188fcc72901f7993d6341
SHA256468869d63c695c261fe27d4b5979620f953c9e560d15519e155247b883c7bdaa
SHA512f015607e15d11e3b2e40b28d6f21da7f968eea4670ac058aa53a68c845cce9de5af8915dd765b1ddfd876db638aa92a86748388cfa5ebb35d81adfc41c357223
-
Filesize
512KB
MD5a05c227b035e51d164287acf447f3b2f
SHA1eb3e217cfe51e9129094658c36af87f02fb3cdd8
SHA2567e525208f38810b37b06228b74a67a3d8a4858157bccf7e91d0806ed7deb5ecd
SHA5128796e449cfbf9d556108656e862e713ae7412ad46177af6b428358dbf01a22d0700364837cdd18d3112f7e6e05fee075c124b2bb4a0f2fc8d06869f9233bc4ad
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD57e0d05f576e0085b2d616079cf1d1638
SHA12a5c7bf86a62c06e06b9c3d947a0bc1b83085348
SHA256224001247665af611dfc7f6ff24457be6ed54ba3bbe38a675af2657bbe9374da
SHA51283533d24f930f56510b45fbd8c04544713de198df7a2b82d4a9771f4cb35923c37645267f87882644aab64713706964270698808d4832e8ba0d7b9b803b6237f
-
Filesize
512KB
MD5b08da7d901bc86cbb6ba28e98533f95e
SHA14d8bf30f01967a056785b85f973e10c35b69078c
SHA256d8f8e2d36c0b9008db00af3ec28252ec7ab4353983fe04f2198ba3395ec9ca17
SHA512c77cdfa450af951fa07480fbb464f0e8e96cc54dc1eaca5763376cfba931c722956053468779a23b8ef20d00fcaa51064b7caedcdf3c909dc6f4869073853607
-
Filesize
512KB
MD56045755e51b98cd3deb326a78d5317e2
SHA145c62d02e38dace27e8501f5210bcb89fa8c1711
SHA256c0caca73572d4fe253ddadaecd4f7654f72b1efc43b5e8babafdbb4339262570
SHA512f2fd71dd4445bb69b3febf99918aa57b6a7e0416ad648a82249ad7ebd7a2091a1dcec24ba6e1a265b457da63f5fbe2c998a796f91762e142fa21f238af17fe94
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
600KB