Overview

overview

10

Static

static

5

7b880e537a...18.exe

windows7-x64

10

7b880e537a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 03:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7b880e537aac45cce5b55c5deb5e48b6_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    7b880e537aac45cce5b55c5deb5e48b6

  • SHA1

    bcd63a8498d850a32579e68ba83da89bf73c49e8

  • SHA256

    25002152bb73f31b491fb484fc08aa0b23349b4c2baa6934920b5ecab2255dbd

  • SHA512

    306e4546d03761664d64bb446daf4b585227b2de6ea00858e6e993198ba41c9529d54605c05a49aa0e2c07c9eb5e07bf06c3d29c66eac0d709fcd9983f699ed9

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b880e537aac45cce5b55c5deb5e48b6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7b880e537aac45cce5b55c5deb5e48b6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\SysWOW64\dwddkiwygs.exe
      dwddkiwygs.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\pnhwlfln.exe
        C:\Windows\system32\pnhwlfln.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2544
    • C:\Windows\SysWOW64\cammwsqotptoccf.exe
      cammwsqotptoccf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2632
    • C:\Windows\SysWOW64\pnhwlfln.exe
      pnhwlfln.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2732
    • C:\Windows\SysWOW64\outrarlrjydwi.exe
      outrarlrjydwi.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2876
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:600

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            e32b4a7fdf372329ecabaf863ec25102

            SHA1

            aed2e5efd4d9699f84724b7f45cc8321c7fdd6b7

            SHA256

            9de621ffe1884ca8c65d5c50ae386b3ddcf27147aa54a82f2a83fa103dacc43a

            SHA512

            2bb1474f943c6c27054af006ba7451b29f36df1ed2cdb7a2a6bd0a332335696f745a990118f399d92b50e3a3154f4d88e42dc2440aa377303c70f22fef76f9fd

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            145a736ff1c4a66294baf799e1ef6c23

            SHA1

            66b37b88a57bfedee059a16e967b15c92893f84a

            SHA256

            f4df9f272417e6e4108c9567615c2193afc4c1beda3839a54e9ce7d8d0d51fb4

            SHA512

            28fa6b52adbe260c2fa0aeb255925e4d2bc446ac98ea01aa250b2123dd25bef4240a3b529b643d19c6c6b3bc74e4e8ece55890c2f9f1eedc3066e5e1877be2d2

            Download Submit

          • C:\Users\Admin\Desktop\DismountEnter.doc.exe
            Filesize

            512KB

            MD5

            2d61c1d8de8690e6a446e7aa40ce8652

            SHA1

            9b0b1d9e37663ca0461ac1cda45643ed888fa21b

            SHA256

            0407cf9adb695a6c945b9a9b32f39851067a24667b776c2810b7e1ded676aec0

            SHA512

            b426175e7c40d54a81a1eab77a3b58d9ab2ee9bd50eb0b681ab3a5c0d27234048095c2165a2863de07335431bc0a6cb0b9dedb479076e2abffa7cd1ae5d7eab1

            Download Submit

          • C:\Windows\SysWOW64\cammwsqotptoccf.exe
            Filesize

            512KB

            MD5

            e878a1b643cf377324ef9db14daa0cc3

            SHA1

            5d38c1a2c6d142ab63adb460be8be766cf1a46fe

            SHA256

            aa156ae5d94e1e8753b1439722755e1d4cd65130f70bb41912eddbb3b02d03bb

            SHA512

            5118b857792a80ec181f38330a11f0540286866bebaa2a8cec3cafae14afa200e93b577da2ccca036d96076cb8bdc8b9937b6b858a2eb53bcc70e94625903105

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\dwddkiwygs.exe
            Filesize

            512KB

            MD5

            afbd3a81dd65237ae16c13fbbb64c29a

            SHA1

            ecceac5faf3444e1a18451e469d0d519d4048daa

            SHA256

            f359c3e0b8bf8e9cfa69f5d499fec842f91263de2896a720174fed7c994f3566

            SHA512

            25487a548ca62cbbc2e350943042b31629bb25fdce36939bb6e9b2cfc9a0693199c67d31b2428dd119287513efc30b2b59fcdd9df132b1f4dab62c39b31885c8

            Download Submit

          • \Windows\SysWOW64\outrarlrjydwi.exe
            Filesize

            512KB

            MD5

            45eef909c026e6e1f35b62ad3515aa02

            SHA1

            bba27f445131b1ecbfc61752ac50fe7ee759d759

            SHA256

            cc5576a8f5b719016854aa2c336eba11c455c625d4d297a2e216d636c628456e

            SHA512

            1d237aaa2f84bb738860bf434a1bb17fdc272edf09574af598aaaba60ad38542062dba7e78e1282ec0a275e4ff92f6a4c0f71423853372704b24914aad7949f0

            Download Submit

          • \Windows\SysWOW64\pnhwlfln.exe
            Filesize

            512KB

            MD5

            9a04630d07272ada1cd151e8c8085fdb

            SHA1

            ff7eed1a8d3ca7be857847d29744939f9b65e2fc

            SHA256

            de80545d70aee033293a7d55df8db6f989327e345cfe58ff8ed0c06c4d0ad14a

            SHA512

            87d83bff6b270b0214f9185c15f0127a5bf2a5553d905886c135bc6dd5854d9d103b35025d9d10b3f6ab91ff83571e6122a1c5fedc6d67df36c6609781ebae76

            Download Submit

          • memory/1688-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2688-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2688-108-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download