Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 12:54

General

  • Target

    8437023424e0f53e8a652d88701e7240_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    8437023424e0f53e8a652d88701e7240

  • SHA1

    483e53ba37d5904e305a12200d7f0c5a720553bc

  • SHA256

    7f9e9988c9257e0df31fa171726cb48a574652ee52440d75496d7c3855da0cbe

  • SHA512

    4b2d9546854a34649da34dc32c6a32a072920c92538dae9fba4aa8c058829d59f03faf666ad217ea31cf2665102e3eac33fa6666c1a359bcd4c1e3f0d2a3261d

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8437023424e0f53e8a652d88701e7240_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8437023424e0f53e8a652d88701e7240_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\SysWOW64\vfurgbdlkj.exe
      vfurgbdlkj.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\SysWOW64\ogeydszo.exe
        C:\Windows\system32\ogeydszo.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1952
    • C:\Windows\SysWOW64\epoefcpdhjcfrqp.exe
      epoefcpdhjcfrqp.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2580
    • C:\Windows\SysWOW64\ogeydszo.exe
      ogeydszo.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2492
    • C:\Windows\SysWOW64\mvdxaxqzujwqq.exe
      mvdxaxqzujwqq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2160
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2308

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      801f56b846521f2f24380a79fb65d1e6

      SHA1

      77b74e0ddb28abc6f19f8bcbc19397808713b845

      SHA256

      bf124fc88d7a49ef72e45f4c6842e978f729a87f8b5e0456401c8ce2682c8660

      SHA512

      712b9fbcfdf9630e712e842c95c0bc2c043c76236002d577453fc3bad3e7afeea202a15706a24fc5dc371401210def98f66e77bc8e2c3ba5079460cc0a1521ef

    • C:\Windows\SysWOW64\epoefcpdhjcfrqp.exe

      Filesize

      512KB

      MD5

      5e05e87f597983580cb81358c019daf3

      SHA1

      054554378064aa64cf330a2e3619537652884e9a

      SHA256

      141d8e44894c415ba62ddeb809b91fe83c0757ace8a9ac7ced91367c46074d04

      SHA512

      dda92dba6731f62edea78ed54385b259e491c42a814b71e2a57e6b34817f5639bb7af3c260ecd2ef60e787501a0433db2b14c03920f1c624d8de89b31936d373

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\mvdxaxqzujwqq.exe

      Filesize

      512KB

      MD5

      dec17bb5e554db29cc94c0897be360b1

      SHA1

      6c4a8bcb5e67b1436b8c13a91f399a053a2e87e5

      SHA256

      074aa3a5c2dd16225baf0e4f72b3c1dc26e403307520b85c1a68d13f7105dfd9

      SHA512

      a82a8bd6ab9256061f0d45898b8c87458c99bdfa4df14e6bdb5461b016181be0a39bc0ac342b4ecf68a4dcc41bff94bb9624b19a7ef7b7894a41e9a58443c35e

    • \Windows\SysWOW64\ogeydszo.exe

      Filesize

      512KB

      MD5

      a22f28e3c0561fff1233866a91485b70

      SHA1

      88f1d41133b998abfda8f685aeb563c6eb2a23ad

      SHA256

      0cc0cf0441d789d6ac62c1e862f7016d38154bdad761524ef2c3833ec12c2632

      SHA512

      b1a6d8999008ca56ad0173d2b959685ddd31f436f5130b6910b2a8dea0f55d9749d9eddfb9d0337637e39e5e8c88601dd496bb75cf49d097bb1d87f032966170

    • \Windows\SysWOW64\vfurgbdlkj.exe

      Filesize

      512KB

      MD5

      5995ec9abf6d4448c02deb1b846cbc72

      SHA1

      21ebaa9ff3af9de517fe6c104ee6273ac9a6308c

      SHA256

      4b6fb30a6185630cf96eb665b7c55a7db8c9b3fc8236682742c7116fed888302

      SHA512

      55b521831fbaa48ef1e20123b139621f725a49e399d5d7b5d52dfb65127ed274b346bd7f4ab8559e3d20b456f2a3356e3592f01f70bd05c3cc0ddf53b7a72f52

    • memory/2212-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

    • memory/2364-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2364-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB