Overview

overview

10

Static

static

5

7800a1bda1...18.exe

windows7-x64

10

7800a1bda1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-05-2024 05:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7800a1bda107b1aed0fc59d3b13da650_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    7800a1bda107b1aed0fc59d3b13da650

  • SHA1

    f7b349a94811c5baf83d6aa3fa52ebac65d7b193

  • SHA256

    1aa8b7af73650b36af91531936ca3b9270144f7433b8f74329bf8cdc6a4e3c3f

  • SHA512

    40aed307d0efe3cb57bcf8927002de30438a131a6b1cfa50c306a59e65a1bd04b4121be022d9cf8c6e4d9606eb1dc0f4f6100f187f936aa9f4c9aaa357d67a39

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7800a1bda107b1aed0fc59d3b13da650_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7800a1bda107b1aed0fc59d3b13da650_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Windows\SysWOW64\pabbodbpkv.exe
      pabbodbpkv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\SysWOW64\flpvatnq.exe
        C:\Windows\system32\flpvatnq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2628
    • C:\Windows\SysWOW64\xlbefrwsipdwzem.exe
      xlbefrwsipdwzem.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2640
    • C:\Windows\SysWOW64\flpvatnq.exe
      flpvatnq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740
    • C:\Windows\SysWOW64\pfwdyujdpinrl.exe
      pfwdyujdpinrl.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2696
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2588
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      52aacc7b3593fa7e3f1191df4bc28b0f

      SHA1

      b17ca7ce092820a7216ed7b0f046443fc00a27cf

      SHA256

      a29aee926d161bafcfc0372f34c4dfa7ab25822663f576f31319ff0c1a5c2545

      SHA512

      5ae69a7ae1437cfb579826efa837ccecf971f6e075f3314f6084259b6f0b4e2d9cda48172bc9391b1761ff8e036f087f7eb4e0fc4c61bedff862b26813bd17d9

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      0b0ff165ff049e1ab3de2bd2f6de6e32

      SHA1

      31520036220579ee32013ff1dc4a94f8e9f5dda7

      SHA256

      8c8239af5d1cb06158c211ca39e5cc4ce62be0abab45510d2c18ee5e9aacf47e

      SHA512

      e189169eca53af6392b89addc3267881b944f1186bbaa91540f0871c14269b03c6244cf794454cd6a574821e99ca7d3795499911c71108a88d1b3d3794774b89

      Download Submit

    • C:\Windows\SysWOW64\pfwdyujdpinrl.exe
      Filesize

      512KB

      MD5

      a0c759d1c9ac1dfc10b49df140b3016a

      SHA1

      ea48dccb8728acc2ab354ddb6d9a9ee14302336b

      SHA256

      31a6bc2afb60abd979e61b2433fd2046f4ad77322ea91f4870906b9616ebba79

      SHA512

      eeaf46c706d8da5aee50b8c00a18eff50d648c32cdb5fd44b8daf7d054114f96fcb10a6dfac555baeb05943f74fa71dc2aaa366edd1c1ad87a19c1ce57df46de

      Download Submit

    • C:\Windows\SysWOW64\xlbefrwsipdwzem.exe
      Filesize

      512KB

      MD5

      d2ed7de281aabef7999ee73f20945854

      SHA1

      20de424dff204d03c182070910e3629647ea3b5b

      SHA256

      fedafecb9b8563949ea4ab083ae16e4a16afc5fc9434e38f56504d5036851782

      SHA512

      540221cba5e72ab1bb5eb363b0ed2ea39c7decf27237aebc5daf14edd91e7e1b26111f6f46d8dec1b94f3daed4354f1ea016ce9d9c8752627d1a5a7c0c3f551c

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\flpvatnq.exe
      Filesize

      512KB

      MD5

      d98b09297df67d9fc061dbf1b01005bc

      SHA1

      c6a3336edfbd4979010fcc1ce30156e3652d156c

      SHA256

      6868dd310e2dd52d3a9ce8ed41e92baab869fa3226baed941cee3a10533f8bd5

      SHA512

      83c181057374844a99775e5f9c9e12b9b41807d278501ba426e5a5db44ec6187df9ce651b88f20c6ca59d87c0d2b29a63482b1624243023ea70075431612819e

      Download Submit

    • \Windows\SysWOW64\pabbodbpkv.exe
      Filesize

      512KB

      MD5

      49c0253abcce997bfdffa02127cad17e

      SHA1

      51f50e272ba16e6ed4943f3c4ad0868d0710f4d0

      SHA256

      8dd74d3ff64758157282eea87eb9fe221a8013df9d252b6f2ae2991487bcf857

      SHA512

      b231b2dbaa66b625b7ee44a330e322aa57908ed044f1a2fbd7a86102c660a4e7c5dc2a859c31b07566ff878da69cd22e40c6e805206b096f7c7ff34a80e8882a

      Download Submit

    • memory/376-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2780-85-0x0000000003CC0000-0x0000000003CD0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2956-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download