Overview

overview

10

Static

static

5

82bbb881ba...18.exe

windows7-x64

10

82bbb881ba...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 02:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    82bbb881ba8bfbe390356d9f560322d5_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    82bbb881ba8bfbe390356d9f560322d5

  • SHA1

    98bde3459c917e4b20148d40f57c226de05ef64e

  • SHA256

    eca25bd5fe25c75b6a6ffcb997f68c327e8790956c3dd24e3464f75f441b8c67

  • SHA512

    9f277c779d6f10973b94e0fbaeefad7077ab348ba2b3e4934dabf2c81ff5426e8059e33e479b6ad4a0d1a0b3545b8a70313157590210de1298d1b1c93cbdcdd0

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82bbb881ba8bfbe390356d9f560322d5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\82bbb881ba8bfbe390356d9f560322d5_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\uyjyqjdeqx.exe
      uyjyqjdeqx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\SysWOW64\hgefbkuo.exe
        C:\Windows\system32\hgefbkuo.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4536
    • C:\Windows\SysWOW64\rmhkmgrfgvndovt.exe
      rmhkmgrfgvndovt.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3640
    • C:\Windows\SysWOW64\hgefbkuo.exe
      hgefbkuo.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3424
    • C:\Windows\SysWOW64\pvccuwmhoesqg.exe
      pvccuwmhoesqg.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3224
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3996

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          c5a0995c5151b2de2ce723f595bdca12

          SHA1

          8c1accd82955d074d1377e3ecb8cf673d767101e

          SHA256

          c7499969ba8427a0d8b0bf998cf62645441e68d98c541bf4723b7782aa6a37f3

          SHA512

          98b31edaf84df3ced627774f33ab6a3d7d969fb0faef63001fb0e8cd3e709c3637c08aa8817a9c73cd61be9fc3ab90475ce71ca244ba29de417bc3b4ca217682

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          f29652738876d0f3763eeec6b8006a7a

          SHA1

          70730f43a5816f867d0995be3a5ccfbb49ab4233

          SHA256

          cdcd8dc79074f027e4395ae19e63458c4f4e77af24531934c9064be80dae0585

          SHA512

          7a5c9cb09249b8a93b67202f11c6b9edfb3380bbaa6f96dd2b9283c108858b1b68564035d418affbc06cec1ef75311a6080d46b03bfda64756b67342f78fc43d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TCD7EE6.tmp\sist02.xsl
          Filesize

          245KB

          MD5

          f883b260a8d67082ea895c14bf56dd56

          SHA1

          7954565c1f243d46ad3b1e2f1baf3281451fc14b

          SHA256

          ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

          SHA512

          d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          Filesize

          239B

          MD5

          1459a67e7603529e2bd4067a2a106783

          SHA1

          50364cbc787a8be7195e9f7847e1087a8426f3d7

          SHA256

          c989778e2fd3711e7ec2d1578a84da327ba9ef65015084c9f4fcf3e4c9e1a9cc

          SHA512

          b21324f7d9bbb59a64f178c735dd70496629ad0a08b2b5a6eee2346664104b03c13805102347cf5263f8b2e797f08fadaec01e231bc2db1f7716e1f7b257c373

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          3KB

          MD5

          68aa7032c2113f5340c375e6e536aaae

          SHA1

          7e169412c95a9eeb3fc2c8eed038625d4d02d1bd

          SHA256

          d95b7aa78ab2ad1cb058b6f7891f136cd1ace70c5dd11b163f0d7be1815a8ec5

          SHA512

          184682e269735963f58955eb9c14a9d1b0c12035ed5e43a671da4945c7d1538b58a9356ef005a4456bb2e2c5afcc01b9f518884c2ad1ce9b0d9cef62fcc517bb

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          3KB

          MD5

          08c854c6ef1ec1f1f5bb224074868667

          SHA1

          0785083b296ed09e569d0e313e6cfdcd6bb1650e

          SHA256

          40d51bd539cad7ebb5f61aea4015a5d9258ca467e4870848934754d3d333c773

          SHA512

          4a5070370a855d2c91be5f25c9b99c93a411558efaee4c06c86b03c7b6b0a8bdcf20a5e73eb3166ad9901399735ee9ad8c652a6abbd7ea9ae6c6d5ead833612f

          Download Submit

        • C:\Users\Admin\Downloads\CompleteJoin.doc.exe
          Filesize

          512KB

          MD5

          41e6f5b7b5b59b969e966fa11d156a3f

          SHA1

          9999f7f19cab2e88b2a22fda0292f2b6daccacfc

          SHA256

          1cf748e88797613166b964dfbdda579c28be1509ce106f34b38924fef2440f92

          SHA512

          f498e9b1c5c96394e749d68bb8bae9471432f8ed4135c4213cfeca845cdd259487f79cab593fe7e525d3f7a00af280806cdeae1149736b65eb8c9393b5c8bf1e

          Download Submit

        • C:\Windows\SysWOW64\hgefbkuo.exe
          Filesize

          512KB

          MD5

          e48500a6d4244ca5ae7f1b9a7b1441a1

          SHA1

          fbee5efa25c0f1d154672e9c55a5258c44ece407

          SHA256

          e4377f87072f1a530cac6d96cfa0182a696f6b671d335a6fd4b1c0fc13469014

          SHA512

          625a47f94b442bd413db869caf6d5f342ad8d79f5e659ef0d3ff1ccc4f301725d9c00fe6983d67a4f45c6b3600342be0df4b4aa864a17a0fb6260144149cf525

          Download Submit

        • C:\Windows\SysWOW64\pvccuwmhoesqg.exe
          Filesize

          512KB

          MD5

          c363cfe4a38bd914d59afb73d78bda34

          SHA1

          13303129d48d0dfbaaa0a6dffe3ef036f5fb7cff

          SHA256

          0f5157d7a3163506b0be9cf7d883c1d08fc2d96fb036da2b7f82a15af5e246b7

          SHA512

          6453451d4b2835c3967a06700959da3bb676b6c85295898ebd97af7e37836a4f0978fff46d2f8d7c4d4d6a5533a5b4628603c4005f9532cd48ca5660b0ae45d6

          Download Submit

        • C:\Windows\SysWOW64\rmhkmgrfgvndovt.exe
          Filesize

          512KB

          MD5

          ae0a643f62df3123b0da33d0c13139ae

          SHA1

          f2cd659702387bf5579164883daaa646ff43e9ce

          SHA256

          c42e8297a16f28b7fd43bb8d0cc3ed9858cae6873e47d8a258caec4a881f8db8

          SHA512

          302a3ff51630e14b89e796cbd8e25f7e5259bf625892c8e54c5521c47833d1c9e016fef2d9ba85f7965c516c2fe7c174e004746cac484908b6ddb97f3cbda6be

          Download Submit

        • C:\Windows\SysWOW64\uyjyqjdeqx.exe
          Filesize

          512KB

          MD5

          402fc5af15ba8d9d11ca6afd5a05dba4

          SHA1

          bb39d681b13ecfd3753965cde6406cc4dae011cd

          SHA256

          65a96345a859ea77ac15e3aee931900d2f79688c7bebb0638c36612d2ac83f0c

          SHA512

          cdd8e69cb75dd30ded18ebab94f9a770251bd6237550608ff94fd6a3df902e8b57bcfc7afaf53f6bcac85453e91061d37d5394b791580d390a0654870a7d4a65

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          68e692f075fa9d358dd642c17952450d

          SHA1

          9fcd38a9eb4afe8b17c40d02a0a4ef770dcfff60

          SHA256

          aa862c7b783758959f1bb4efe0f29efdf149674583fb91f8d41e19c857677d9d

          SHA512

          490b016744b646268340ee3103214dcacfa86bd17097d24e2da33de2d4a5297bbdd906927c92f6d61c7d3cc8df83077d736b050a65ffd0e61978353cece5f823

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          bf364d2246ba2cd745529926c63a6e72

          SHA1

          77143de9968e23e84c36bacca497ad37ee37b1c3

          SHA256

          2d41657b2b623afefcf85173fab473bcdf846220e5475e850d284550352cbdcb

          SHA512

          83b704146e5bb934dfdf8ce119bdb7e266501bb424fc6e6612add978baaef454d7489eff03a08423472b4bdf7a1f7e5973869e08423b94d025ffb60f021482ee

          Download Submit

        • memory/3012-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download

        • memory/3996-41-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-40-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-37-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-38-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-39-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-42-0x00007FF8AAB00000-0x00007FF8AAB10000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-43-0x00007FF8AAB00000-0x00007FF8AAB10000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-601-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-603-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-604-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3996-602-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

          Filesize

          64KB

          Download