Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:20

General

  • Target

    742d588d22ea42abbd53193a222b8dd0_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    742d588d22ea42abbd53193a222b8dd0

  • SHA1

    9b815abbb75384a2852cf5190a6138eec7db53f8

  • SHA256

    3da141fdf33f54ef540f20ee3597c0381ec572f0e61140e5441244b124a0422c

  • SHA512

    6a48ba800860512c2d906fae4ee9fd801508c1ba2a9934e8dab8e44babb8ea217c9d922260c905e8375de103aebb1e2ec98c946ad3eb28bf9a25e796132a2556

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\742d588d22ea42abbd53193a222b8dd0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\742d588d22ea42abbd53193a222b8dd0_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3684
    • C:\Windows\SysWOW64\abfuynxees.exe
      abfuynxees.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Windows\SysWOW64\yjkgyvkn.exe
        C:\Windows\system32\yjkgyvkn.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4476
    • C:\Windows\SysWOW64\zlhfrvicyamkfcf.exe
      zlhfrvicyamkfcf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3388
    • C:\Windows\SysWOW64\yjkgyvkn.exe
      yjkgyvkn.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:464
    • C:\Windows\SysWOW64\rfwsouyjkgevd.exe
      rfwsouyjkgevd.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3616
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1992

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\TCD7DBE.tmp\gb.xsl

          Filesize

          262KB

          MD5

          51d32ee5bc7ab811041f799652d26e04

          SHA1

          412193006aa3ef19e0a57e16acf86b830993024a

          SHA256

          6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

          SHA512

          5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

          Filesize

          239B

          MD5

          12b138a5a40ffb88d1850866bf2959cd

          SHA1

          57001ba2de61329118440de3e9f8a81074cb28a2

          SHA256

          9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

          SHA512

          9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          2220ed0713866c031d0310e43ce93aa5

          SHA1

          70d255f05152b96099d19dd89698d2551464e535

          SHA256

          ef226820b36bd81701c09d9e18085309a98a00f77e4e34b0276c5fdf20e25c0c

          SHA512

          f232a601c7e0d120b6f5b12ad62f9face55c949fdd555231c1caadaaaa099e284262d05b34f2b323f49643f316560643689e1aa6c0737b37c2978847ee87d133

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          020662c1d55f9c7180936b820160376e

          SHA1

          63106ca0f9dceb1f25d76d8b2bdd54b2b1ddc227

          SHA256

          8b40eaecbfe7998ab99111b56d0bf4c21c66453707d4a567baa99c3ba5cdd5fa

          SHA512

          1b6615b5457d63ff51062922473f016cd3fc95eb9f50f3d7f557a779fe4a1c2672c49d71bfc7d28717fa29db16ec17f729e0d2cfb750915b67fb65e152e7b320

        • C:\Users\Admin\Desktop\MountRestart.doc.exe

          Filesize

          512KB

          MD5

          9d0009ba5f39e51f02ca5a4ad2ce8fa7

          SHA1

          59382f466177dedac3a72ba8334ec751609f801a

          SHA256

          8288bae9193e36cdeac475b0bd0d7e3c9878a068c8708f43051c55653e140f90

          SHA512

          91aadbf814eb5d4afdfe2963ec54d0452d55d9c00e97ab9e659e0c33a5f7c2fa6a41deb38bd25f753a2f9ff1e1229a96d52d8d789c43f3727493c6f8b08b2b8b

        • C:\Users\Admin\Downloads\SelectConvertFrom.doc.exe

          Filesize

          512KB

          MD5

          ec4daa4943ec204addf121eb524f3b1d

          SHA1

          b8b450c43c1d8abedac42ca0f83686f53020f5c5

          SHA256

          def455048277b055c599d7d34628373de1a1f0ef4a89ac3bfd948e733d74b2df

          SHA512

          85f991dc0f04cf24665841f63bcb11d9383b7034d42799574ff6d31267e0b8696d7a0bf27905be9ab92eb0829d3af97dd3dcabfb4ca1a5db53578191844ce354

        • C:\Windows\SysWOW64\abfuynxees.exe

          Filesize

          512KB

          MD5

          0ea7104d9bdb769573bfb75766339742

          SHA1

          4de4c4c7f0db14c6a2999271c376601799bb63cb

          SHA256

          cd1bfac26134a21f363128cc1e95515f81c01b23eb815d434c89b7dc9d07d9dc

          SHA512

          671db94c8c86b8d378582d960754ade4a8a70af340ea84561afca35bc97e43bb272d606e1dd16c2ffa917be3caf9d92d52a95028400a8aa2ffffb27bc068f8d9

        • C:\Windows\SysWOW64\rfwsouyjkgevd.exe

          Filesize

          512KB

          MD5

          dc861194a975f2a4e564efcf6ee97f6f

          SHA1

          d5b417e8d8e018f8dea7864de038aab594b5aa5a

          SHA256

          19c8dfeb1c58501a5e8cd61a8af441b3751ae7f8f2a3bb66378babf14e912b5e

          SHA512

          61bbfe7d3f61d619bf41355e317bc3c2da1afc4202a65b66d39db2d4ac8506a8c3f565dc870375fe15808350b6a52020cd5745db3f1112c13a57a3ab6eee36e7

        • C:\Windows\SysWOW64\yjkgyvkn.exe

          Filesize

          512KB

          MD5

          c170c0c80ea3d7777c46a20315866421

          SHA1

          f34c0efcda6ea0026e9fff5f634afaa977f6e2fc

          SHA256

          1a55fd3ab993779c4adc422880668b9772b5a877c7bbad434e762bd3591ac4d5

          SHA512

          afa97a11118cfc113d643a8f602f5bbb869ae4105fa2f00e0bc48309bd4288b4121ab04365af86f80908dac163353d9bfb7d3e2741204f0fccf7d98856d115f6

        • C:\Windows\SysWOW64\zlhfrvicyamkfcf.exe

          Filesize

          512KB

          MD5

          ed3254a891874cae2054468f6875e917

          SHA1

          5630c70ce8ecef317aca154cfdce1f5e591033a1

          SHA256

          8bd5d914448c37dd3025708ddd51cc677bdd5518074fe7ce94143a64e0ced6a2

          SHA512

          857c45ee60104ccb62b6bb88a30942ab7e1c80ed03f07b60ce41b7e5564fee83627b70547a83f8dc73267f280e1b144eb3e1589776ab9d64ff9496fedcc4715c

        • C:\Windows\mydoc.rtf

          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

          Filesize

          512KB

          MD5

          60db0b7578af3356e2c1599b31d4a7b9

          SHA1

          57f79cf1b50c3657f1f7d7a8ffccb92dc7e448cb

          SHA256

          82c6db443ab29df4e1df7f72100e033130c292fe607a8a689016663878f6dcd7

          SHA512

          33ef06a098e9e97890711b47ef2a41053f08d138c79ffe1735651e259286207b344d6c8d7f33092d83739f7b4802dc640a0029885fbdd1f441663ec2c594607c

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

          Filesize

          512KB

          MD5

          c0fc71978e69bf1dff770255f1f80b76

          SHA1

          52e6ede2f0246eec634705aa6de8f8563bdf5a19

          SHA256

          00105dfff3bf39abdd7a714aad32bbcd5cacdea33e2418003417e73c43b14009

          SHA512

          8d6e97ceede30de86777be19777cb4ed91f1e065abdd0a65d45d03533289cb707401393175018d63795e600eae3d6738986679b0825c499eee26dbb4010214d7

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

          Filesize

          512KB

          MD5

          4710b693bcc1ba768744b36d83c04cc0

          SHA1

          d602aa2463c47049ac771fc9b1141982a0e5e1be

          SHA256

          69809ac311207d1bc4b6b2b8e46cb237cede68a5d8b66ac90439688ed263c07a

          SHA512

          ddc12d1fea0359fae9783d31b8bb986c16d18084ad21865fee6508570bc5002b03218b27983d0c075e530366357caf32bff684a8b85389b639b744f851fee4b1

        • memory/1992-35-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-39-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-38-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-36-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-37-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-40-0x00007FFE15A60000-0x00007FFE15A70000-memory.dmp

          Filesize

          64KB

        • memory/1992-41-0x00007FFE15A60000-0x00007FFE15A70000-memory.dmp

          Filesize

          64KB

        • memory/1992-609-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-610-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-612-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/1992-611-0x00007FFE17C30000-0x00007FFE17C40000-memory.dmp

          Filesize

          64KB

        • memory/3684-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB