Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 22:34

General

  • Target

    73773564e15d14746d32982a0e40e6f8_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    73773564e15d14746d32982a0e40e6f8

  • SHA1

    cf12fc5a9c66cdc6b029916cfdddb4a887a9a2b6

  • SHA256

    fbe945a6e9351304c72e81afa79d3c27080c8cdb316f3bdef903c3daa1ecfc3c

  • SHA512

    01a89ac432f66152e48566cb236d4a6c92d968c91a2f8dad673ca31822d711b7985eb7f18b309bb7253c10ae550832c0f804617fe5feee5f540b33229aaac998

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj63:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73773564e15d14746d32982a0e40e6f8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\73773564e15d14746d32982a0e40e6f8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\SysWOW64\bpbsfqldlu.exe
      bpbsfqldlu.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\SysWOW64\rtybnyhk.exe
        C:\Windows\system32\rtybnyhk.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2560
    • C:\Windows\SysWOW64\kmxtnjcxgxbfwye.exe
      kmxtnjcxgxbfwye.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2676
    • C:\Windows\SysWOW64\rtybnyhk.exe
      rtybnyhk.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2736
    • C:\Windows\SysWOW64\rtfwsxuhquogm.exe
      rtfwsxuhquogm.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2692
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:344

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

            Filesize

            512KB

            MD5

            7bca00fa7edf98c490b6c73564411be7

            SHA1

            e1d25440faeba3cc6bfeec4ecfa84f49e2dbe5e5

            SHA256

            e18010947ac3ed29e7b5b88ecc501f59bd977a4df231abca1702a0dcdd522d99

            SHA512

            8470f42d2689654034bd1634452fbe48a17ed86fd8cd559c4c6d4545b50a2241bcfe66a4d6b9b7be385287fd659566d1cbfce11b3de6ed69a7f0a27d5b0f6eff

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            20KB

            MD5

            f3feb161c6fbf10f9f8cba0b14fe0bc0

            SHA1

            1b95fe5cb3363f315dcc2ded700d6195e73e9333

            SHA256

            ecf4154e5426bd0ee1129a2ded0bf6d27e4f17ac2cbee435c176c212e6ab913c

            SHA512

            06cb67892b9ecaa5296ac999ce43000e91765803c24374e31378dff403d4a77d7c6f3a49c9cd93d591aad156132612fd6fd268bfe9d05fe2aece216db5daadae

          • C:\Users\Admin\Downloads\StopRedo.doc.exe

            Filesize

            512KB

            MD5

            d99c017fdc874c528cd0e62f929374ea

            SHA1

            3d5970ffdea948d14c2f2c02ae19f7c2d6934ed9

            SHA256

            a0c7d011f3e16652e95c9b5812a38a77d24feba93056d293f9182b5bb56e9975

            SHA512

            5ac428b9bb038ce890f147e0157f3b54cc214a29f1acc567505d404aac232c314fdf43d27d781c58eb672abf71ebb23b012baba60fe26ccce13f2c50792c1879

          • C:\Windows\SysWOW64\kmxtnjcxgxbfwye.exe

            Filesize

            512KB

            MD5

            0c2865cd13bc7ecfc540c246424e11f0

            SHA1

            13631d5e1643600b20f3009ec3295786c0a2f131

            SHA256

            6c80375bb49e110c459f6f7d0f82a076004088c3b62bcf231b7b7fd144778813

            SHA512

            e0ef33130f87a4ecb21b911265edf51bb46653ba460a9e7ca01838b3283e690e2d1b200f70c1b18a45a36cd46da2ba117ad15522022c99fbc4776d5070f8aac5

          • C:\Windows\mydoc.rtf

            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          • \Windows\SysWOW64\bpbsfqldlu.exe

            Filesize

            512KB

            MD5

            4e1b3b9994f7585f1e7af240ce3f52fd

            SHA1

            c191397356f024d971c698a6b00d1a351d21f947

            SHA256

            33b163d98a679df5ef358345f7927cd32f17143110788785595021f698436d0f

            SHA512

            2322a7b9791d589761d036731562836dbc5a37d1b261da62a2da3baa3612c98d1a8cb1b9a9867709e953adec82bfa3d572c93f872df2a75863a1dc5d47fef4bc

          • \Windows\SysWOW64\rtfwsxuhquogm.exe

            Filesize

            512KB

            MD5

            de091042cd33feb3c64731e74dca0b1a

            SHA1

            988f5e363413e58b2a5a8f1fa065e622544532bc

            SHA256

            7d1c809e3450c830db0777549b5cad683d6d777d63f8c64fa3c04d593ed491ee

            SHA512

            b0d768d7e7c85a6928a1f8d2a66af018260d23d28eb2a37638ba192a1a92447e54cf3967511168625951a2f5849f614382fa4d34812d7e66eeec0987c5379d43

          • \Windows\SysWOW64\rtybnyhk.exe

            Filesize

            512KB

            MD5

            ab9704121b883891aa0be15ceff70cde

            SHA1

            75d4265e4b8d5cc1ca41d8249f785cbc8f915783

            SHA256

            4c67bf281994f3e7105891995078fd0e17e738cd8a40ecbc056b9b7995eea87e

            SHA512

            35eb804bedb42d99fd8133b1fb194c0c8468c25bbc75436598a5812852e592cd8307fc2e76db0681b86b8b708fa4db8299865237e383d613971e039e475aee19

          • memory/2288-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

          • memory/2820-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2820-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB