Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 22:34

General

  • Target

    73773564e15d14746d32982a0e40e6f8_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    73773564e15d14746d32982a0e40e6f8

  • SHA1

    cf12fc5a9c66cdc6b029916cfdddb4a887a9a2b6

  • SHA256

    fbe945a6e9351304c72e81afa79d3c27080c8cdb316f3bdef903c3daa1ecfc3c

  • SHA512

    01a89ac432f66152e48566cb236d4a6c92d968c91a2f8dad673ca31822d711b7985eb7f18b309bb7253c10ae550832c0f804617fe5feee5f540b33229aaac998

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj63:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73773564e15d14746d32982a0e40e6f8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\73773564e15d14746d32982a0e40e6f8_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Windows\SysWOW64\jcxwqskknr.exe
      jcxwqskknr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Windows\SysWOW64\awhkygvo.exe
        C:\Windows\system32\awhkygvo.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4356
    • C:\Windows\SysWOW64\qsceevrlnyjgjzq.exe
      qsceevrlnyjgjzq.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3772
    • C:\Windows\SysWOW64\awhkygvo.exe
      awhkygvo.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:832
    • C:\Windows\SysWOW64\gzmtxoedrzizs.exe
      gzmtxoedrzizs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3096
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1420

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

          Filesize

          512KB

          MD5

          1bbfe4a2f7653a41cff37480555de415

          SHA1

          f8ced8af823418c118bbb7a7eec9045e02f22584

          SHA256

          dcd949ab6884ac813021f0fbf098ed688b1673e2594ede1b3b78f31c88862a9d

          SHA512

          c7ced8cb51a01f01bd1843f5d12eaf992e46408a7cc320b9cdaf1bbed3e72c1c6f3f35a68cc02e7c4f9c7a6eef52587d9c1cc11ed5acdf205eab59fa2c512a57

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

          Filesize

          512KB

          MD5

          6f66a249ef63a69abd9ab76199f3789d

          SHA1

          1fdd600085820426d048d29fd3da558f40f9c767

          SHA256

          9bd59862afd23ed4053814170da7944dfdc2334eac9ddba7c2b7aef42a008deb

          SHA512

          37d2236ec19e08b71385ac9a1f46699ef825c77ca6ebfb014fe24765fa10eb451dee5d2d2af0d3b3ea90ce4777c4adc4c66d561013a80a0f7b5288dd67f0246e

        • C:\Users\Admin\AppData\Local\Temp\TCD8F18.tmp\sist02.xsl

          Filesize

          245KB

          MD5

          f883b260a8d67082ea895c14bf56dd56

          SHA1

          7954565c1f243d46ad3b1e2f1baf3281451fc14b

          SHA256

          ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

          SHA512

          d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

          Filesize

          239B

          MD5

          12b138a5a40ffb88d1850866bf2959cd

          SHA1

          57001ba2de61329118440de3e9f8a81074cb28a2

          SHA256

          9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

          SHA512

          9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          6fd50a07ebea4d75d9327c3482b37c52

          SHA1

          63246d5449786082129830fc344fc3f2c4124477

          SHA256

          ee8fab8a0cdfdb6a10976bd18651cd16848b615595b02d28c733d6edae88d3c0

          SHA512

          4474a91d93171d8c7f7b2beb269d73b3a7e682aa91918ec8578698889166bd6b8127f93e8e05c181b61912684e84beee0f3f61d33a6a36ff4485ac890baf5a56

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          bc95dcdc69974ed1e98d9d1cdb3899d7

          SHA1

          7dbc2cdea059c147f411835a6113fc3b41d1bcbd

          SHA256

          6d8943278594d0fd9c49928b41fb4848281c5faa934c5682ff634315a2aedae0

          SHA512

          fbf459ec87fa0f4a02437c6ca01e65096cb707701b3ab187d25d9cfca3d456a43fe3f17c2262d7609a16e6d2b78e277b5df407f1e78a5841705a5930bcdeb0a3

        • C:\Windows\SysWOW64\awhkygvo.exe

          Filesize

          512KB

          MD5

          241816a68f9bdab545ab9fb57ec9a855

          SHA1

          24029d092468ef66becd4144e71f24a772e39dd8

          SHA256

          ad5b72ed3c47a0934c250b986b09fe0306ff9db0bbb74d3f8f51894845869f02

          SHA512

          4bd97bdb7e845b7af621d07d6aa9d4c6f0f1e8cdd9b9e5eba113d862522b5af430a14f355b4efa76d6dcbde5a5b2b52998dad2bae43d79e4a81e9bc492c3fa57

        • C:\Windows\SysWOW64\gzmtxoedrzizs.exe

          Filesize

          512KB

          MD5

          2c35101fb2bc9e1a592108f0ddd70eaf

          SHA1

          ab437906bfa33fb8cf289497cc4d47daefffc047

          SHA256

          429f6108297adc9235f6211da0f18b19b5b731b08025e245ec78bc58f9a7dcaf

          SHA512

          da857a2c0221833b9bc59d9d5a5e307faf9a99ea0210ae4bd6830e70b1515033b4ec30c91fb71f48abdfed1e98fbd5d8703ef4fa7788615febcb0e707a90c3f8

        • C:\Windows\SysWOW64\jcxwqskknr.exe

          Filesize

          512KB

          MD5

          7acdd5a5dbe25b25683c8a649381a9d4

          SHA1

          4fb52eb63b57ceaedf44507a71d1a2e14eba9f04

          SHA256

          48237fb8b6e42b9d9269889ac675e5698082bc920e1256bdb7dd0750076391d4

          SHA512

          1d2869a26b927bbb3cc3cc2558daf912df158a8866b73625e57e161a0f99c086b72d8c64caeb20b7a3ae9dd85bdb24de4c2756dc21c085d7d3b6a2d4df61afa5

        • C:\Windows\SysWOW64\qsceevrlnyjgjzq.exe

          Filesize

          512KB

          MD5

          310126990929cf614da0fe740050a27d

          SHA1

          884fd674982574f5ad38852ba8575c73c5a600da

          SHA256

          40437c786fcd3396d0a597bccabbca8eb6b0c9c95a1673a9ed63c55c5f2bce11

          SHA512

          a3ad439f6ae431d29b1fcfc66cd3715f1f67bbacbfb2cf42e7810460f251bc1fa18dac00e12b2aa3d4cf9747ded742b60bdc1b633868f813eaa0b5ac4169b081

        • C:\Windows\mydoc.rtf

          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

          Filesize

          512KB

          MD5

          1628db0aa13658f48ded0d9b3b9f2b79

          SHA1

          8f2ccc43fe64e9d29a865dc50b3fd44575adc287

          SHA256

          615de3e0be3d2e792655b1b0058f415df352aa001d522a70ef6caf5fb09e829d

          SHA512

          3f1c4da40d41636d985f5d8b31709995dcdce52f426236ca223a3c245d952bab629b907f1ec089e2376c5916caa0bf7d94810be5cf4f0a45706718d620daa5d9

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

          Filesize

          512KB

          MD5

          52ac5300705b6546af2091643fc4f612

          SHA1

          28a4e528ed401f495c0c597810d941dd1d6a5e95

          SHA256

          473efd6db4fcfc40d1d91bf93b080ab5c156b0df5b40cf63f0460bc23f365f5d

          SHA512

          17bb9cd7a1e59f9ee328df92418116046c59a880357bc4ea0b9a94325d630ca0ca067f0c51eaea4f05ea9bbbbc481e069d39c7bdb1d7caf1efa65b4d56f4aecf

        • memory/1420-41-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-43-0x00007FFD7A570000-0x00007FFD7A580000-memory.dmp

          Filesize

          64KB

        • memory/1420-40-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-38-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-39-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-37-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-42-0x00007FFD7A570000-0x00007FFD7A580000-memory.dmp

          Filesize

          64KB

        • memory/1420-598-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-597-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-596-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1420-595-0x00007FFD7C790000-0x00007FFD7C7A0000-memory.dmp

          Filesize

          64KB

        • memory/1568-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB