Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
27-05-2024 05:40
General
-
Target
781520476d4361be5ce19d1eeaeb3b5f_JaffaCakes118.exe
-
Size
512KB
-
MD5
781520476d4361be5ce19d1eeaeb3b5f
-
SHA1
9e974df0304e65d615a1a7be1c2fb691285350e0
-
SHA256
c20ea11f0588f74fd9116cdc7f8828130a8120d446f91d9a66fa7603af7f7d9c
-
SHA512
841c9f7503718ae09e0c9ea515c69b82e20bd023d01cadaba4ed5d89deb12195da7babae293f1f63ee7df622f6e5c04339cb54f5e38d656e3e3b692f64141897
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\781520476d4361be5ce19d1eeaeb3b5f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\781520476d4361be5ce19d1eeaeb3b5f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\quktmipgtn.exequktmipgtn.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vnrqfoom.exeC:\Windows\system32\vnrqfoom.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\qyfigxtvwlfowhk.exeqyfigxtvwlfowhk.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vnrqfoom.exevnrqfoom.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\airnqxfjjmevr.exeairnqxfjjmevr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD55a6fc8c71f09ca4b3f9375c94fc80bc4
SHA1b14d9d261829c0a9e1bfa7e1a728a86e0d3abfb9
SHA25602c920f189bd3e22921c709bf561a232e632306e7be41724a5e927b5f97f1d02
SHA512b5c8eb071560d751f87e8fc8405ae968e45977b4eba3b6838499e4bab05980ae750f413f7954d3cbf55a1027dcbc70efc3e526c987267c1d94b8785a9019c617
-
Filesize
512KB
MD56f338a620baa71589add7675f348c951
SHA10c1386ccdb7d68f392c43729794db66f18b8da25
SHA2564306bf0b933cbf535db6db254554643ae3cf54b367653693a0efb0bc05fade8d
SHA512d1845f55da801206e24e556c03001ccf2b85447522c563380fd66025289d7fac1e7912a5fda210b6026cdb463d6f9013f1356199695afef12d2e4e642b5ea44a
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD58555d8d550e6ffcf4ea7de39ddef9406
SHA13e91f59ae24ccd2519e8e17a659d5c0e583a6edf
SHA256a198c5465e81f3fbbf6dbbcabded5cc5d7b95cc768fd3877398047b7ad9295a6
SHA5123ad643a0e7eb68f463b087274d3e8bc8cf49668740bec8e195b18163c63128a80df7415437901e5f85142aec80bf256bfd3307805b3b5c02a471143ae7bffca6
-
Filesize
3KB
MD573f0bbbe93ac8eecdb72707a43c6361f
SHA143ca56fc0c423d2fc546620b87239d9f7653fec8
SHA2560d6e7d19924ff2fd5a6d19b9edd89664ec4907277dfb5d3dc1b30a7e6ba476ce
SHA512834f446c6d8644001416d87ea69fbbab60f66d565282f0eb8e96572d88e74f1818caab8fd8293a39119449ced12321a7d6ee24ce15b0b13b1655f305ba6e0d3a
-
Filesize
512KB
MD5f1f8cc8b4abcacb8803d48e708a5e797
SHA1c9f4f80ce1825e71ebee9534aaa3a9bf61a73fed
SHA2565716399f2b61f396a4f98a90c0172ebfe2bc54e6b5c00675f77638c4638278a3
SHA512cd2ff1dc0e9ae0ae220f819ecd715589352e006a3dd98a9e14ef418ec14ae05f679653c1ec2bf2f3f39597b080a9b953a7a98f66e4b76b65a929dd8d4dc9f609
-
Filesize
512KB
MD55c86fee21a702d670121d97e7429303b
SHA145b854123e76fadc2a1d12ff863944abc7c58b30
SHA256e236458155ce4cea1bcb5ce5edc6ecc4c8dbe40898d3bd6b32ac5d57d28ef6f7
SHA512267a725a00a48793336599606d78d1cc7694cce34d05dddf12d5afbfba6a645a94d10bf4e45349d85dcd411ebda9216548e14a968e12a935314ddd946f38befb
-
Filesize
512KB
MD562bdf888f6300ab1df6559b7cb7d5e85
SHA1a9623c6059300989c91ee247f41e865509a18975
SHA256a4b5848819847372dafe6516153287428176ca4a209b76542db20af31471471a
SHA5129e853fb68341d69ab5106e9382141d471edaabc01dc87f22c7c9f1479f0901438a68edba625cfe33e6496203c1736128171032ec5266aa3b92c8633ba64918c4
-
Filesize
512KB
MD5f208b9985a603bf594e4194f5dfe5560
SHA1d6099f8103eaf4e15a43ae55c3578c8d7ef90630
SHA256af7007bbd5c61f4ec686b0f831687c655a9796027b1bc64ae2578ad7fcc74bcd
SHA5121688407d8c819e55fb5a9b4416cf7328e3a3a133486cf15f5f103ac0930f59d5c95897f9d524731d1d4d802b3094d60174be61d248276b7295ee9b572120670e
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5f46f0327cc90a3619c6f34c80ac14ff5
SHA100089980f2ac31209ac9c0150ebf7cb27bb10af6
SHA25604da36088252a75987fc2fdfedd2246b9788598f6968b2ecb0520b5b4b19c996
SHA512598c8ba7e4383eb5b508a7c197066858cd486b077570b379215076bff685df37809f3992e0425b75026fa8c0d1f817a5dc9ac130ec0d00f50b4f4b4493046cc1
-
Filesize
512KB
MD53108756388da70eb2f0641071f07d903
SHA148a37063c0d0b933306b788a41f6074def40142d
SHA256912c1c62daf6ffecd826fc0db2416b30f0c692659e9192e3351d529c84414637
SHA512654a042a0f6fbaa54db5e74242146b3f08433bc754fbd4bab32d1559e1695126d6838ace14635d729031b9dc0ed2ef87fcc71d1601fc4c591e93011d947a3ea5
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB