Overview

overview

10

Static

static

5

6f1a2acfee...18.exe

windows7-x64

10

6f1a2acfee...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 16:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f1a2acfee122ee9d7192abe758ab193_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6f1a2acfee122ee9d7192abe758ab193

  • SHA1

    74ecfa4a93cdf9a34d57c6fcaa8f062311e3f93e

  • SHA256

    94969e46f59c8a97e3e09a836aec0718aaff91d39d495e7d0f34e88eb02ab88f

  • SHA512

    a800411e7842aa3496c330a6df66362d6749fc550092fe150b2e294d53038fca878384bce6d7f8c1129b1c1ca4d6ea1e21152dabb433fa53f8e0ea2d9e2aeaed

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f1a2acfee122ee9d7192abe758ab193_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6f1a2acfee122ee9d7192abe758ab193_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Windows\SysWOW64\eyqzgoncnq.exe
      eyqzgoncnq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Windows\SysWOW64\rbrqmrdg.exe
        C:\Windows\system32\rbrqmrdg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3672
    • C:\Windows\SysWOW64\pxzftfkuafplqef.exe
      pxzftfkuafplqef.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2404
    • C:\Windows\SysWOW64\rbrqmrdg.exe
      rbrqmrdg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2396
    • C:\Windows\SysWOW64\okdbwtdzarxwu.exe
      okdbwtdzarxwu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3928
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4260

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    0ad967946f080aedf0be0100693d4bc5

    SHA1

    0adb49d0ae850c332224aaa03c1af419d36159d3

    SHA256

    d811fc644b266a829313f5a742d017e60f33e2e592731cfad6fff111ada9eb0e

    SHA512

    b7d1e5540ed2a0e3091f002a80573ca0c995a08af2f69c1f154cde9741b754ab443517975a9de8e2e681a5d35882f12ed0e338e2485f9e932b2c8d829ac7633b

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    b19d45f1f4a90bebfea136a6441d850c

    SHA1

    0dad55aed7cf6f8dd0628d594996132e6e243fc3

    SHA256

    5cb626e4328f3c02b0549feca2cd9d735b4d9d585cdeca9bc44e159d5dfe1a97

    SHA512

    11ac278e2d1e9d0a3a78aa6fddad15835394aaf116fd1cd030ffc3e522c64fe88957aff174c9b9e627d856b9e4e44ea00b79d8eecc56b578d9d9ce0e495074da

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\TCD9958.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    cd76822f5287c7c867150d59f1264624

    SHA1

    bd1749bcfe3c0c1296d82b4c491be7e5ab7bc0f5

    SHA256

    12a24b26b881a888b917735b62fb4377efdf37b1d2460495175afd57cdb206cd

    SHA512

    65fbdd80b96b47a9aedab3fadb1f8d58cc47dfb5f112af7264ee43bdc38749353bfdb7ffd85d341f19a2617d3d81d8e4a47eeee4f899720c16b250885af50e29

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    150ff15647ac6a9dea0a955c2210f35d

    SHA1

    b45499b8b415d277654f04153854f89b0318cb0a

    SHA256

    af9f7c2ec23c8c13043e4dd9a1317c829241e292c0dd3fe33240f6ff8d23b88f

    SHA512

    0287357d707d9dfcb811b950930c2320cff68c98cc2ca1e4fc1deacb9363288f9dfb87ba2ca14acb3ec0ce6e0834cb7b72af7d287c72498c9e93b48131edd189

    Download Submit
  • C:\Windows\SysWOW64\eyqzgoncnq.exe
    Filesize

    512KB

    MD5

    adcef817fac7be8ee228da08a6a29e75

    SHA1

    5cc6f80ef1b576f38be2077df112c47c82e18944

    SHA256

    178488024e1aebf52e5a05580289b845443fe9a235140fbdd8af68cf4cdcfe70

    SHA512

    50686df7103e5593bc4846f60ad215aa3c6c47f512bd1f479f01c3ba419290de530358f2d46222901efa0b46c0466547bc7c3416637436919e039444ede59903

    Download Submit
  • C:\Windows\SysWOW64\okdbwtdzarxwu.exe
    Filesize

    512KB

    MD5

    e2e0bd271ce99a132a384383ba6de44d

    SHA1

    0afdbb15ead36095e12b52825bb2793abff68773

    SHA256

    ae10bdc685b58fba464eec2832fd9c91f4af55b43ed5f1bb1902ba2a8fe1712f

    SHA512

    9fbd69003a3c31ca8805f10786cd28dfee3330d1feaf554a6749e58e0d0edd71e224ce59ded13b289acfcedd574cdcd97771bb499d8228352a57f2818cc150b8

    Download Submit
  • C:\Windows\SysWOW64\pxzftfkuafplqef.exe
    Filesize

    512KB

    MD5

    e00208847d6c44e75a87782c4e672777

    SHA1

    061e263eb34cdaacc141e64fba6caa25c45d1e22

    SHA256

    e3fd8ae53a6a84f62abd7fb1a4080eb152b1ceef540f27222ed80b8159c7bce3

    SHA512

    b21004d91985c877cd1631143a14b62ac9ed4114f284717825e03f0e974b9b1a286406a8522cb1ff248eca5bc9867509b22dfeac3fce6be55f6b6e87551b096b

    Download Submit
  • C:\Windows\SysWOW64\rbrqmrdg.exe
    Filesize

    512KB

    MD5

    d09efdb8fc12b2eceaabab9561bb6406

    SHA1

    2bda86833d942893f7fba16294ed7959d5f4911a

    SHA256

    b6c50b357d6f1dab282f81e1281ec801ffa8bfc423d0fd025d0139b14244a7bb

    SHA512

    c41a535515a1fcd46034d9479a0bb84d75950b3133e16624ccdd32c4258944c5aae041e61347c32bf63b0b226fedfc2e7a14fa9ed4ef8b152bd5dd64e2990b7e

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    483cb8fe2456f593e26c8ed9a2ebfef6

    SHA1

    2356ea2bdd78ebe4c3e7e8e3f6627602c09c3467

    SHA256

    413d92df1d02f2ec6ff3dfb6933c9ba7133cc14eddca3373d337eebc01d572f6

    SHA512

    fc3dafcc58ed8a852899f26a6d15771210e44e5a6ce1d1913ce3b25949cf9afc7eafaa072d4dd216145e6d5d377b3f40dad9b4302a2e44b8f3cc0a6ed9e5da89

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    e1f7037edab01ea0b3cfecbaa3f9b034

    SHA1

    04c5bdeabe4e083972e741e9b5608857087ebd1a

    SHA256

    2f2b12212f901d1e96dac48cbafb34340ed09fe505c6845410bb56ae8e14b820

    SHA512

    7628940b3ef8e7de9f5a9bda13b16ddb0e30de9734b0ca7fcdcbe342f5bd195544b9497ca6aeb7186e9004525831bdfae985492c56a3019efc36538876a993a1

    Download Submit
  • memory/4260-41-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-43-0x00007FFB30E60000-0x00007FFB30E70000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-37-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-40-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-38-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-36-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-42-0x00007FFB30E60000-0x00007FFB30E70000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-596-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-597-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-595-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4260-598-0x00007FFB33550000-0x00007FFB33560000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4892-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download