Overview

overview

10

Static

static

5

84b89e99ec...18.exe

windows7-x64

10

84b89e99ec...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 15:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    84b89e99ec7c94ec19537c8ffc9792cd_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    84b89e99ec7c94ec19537c8ffc9792cd

  • SHA1

    3bceef768d3db52a9f82c76c551504dc2dee53b9

  • SHA256

    1231fa461e42fd8a6b9f6474fed95f0b44e05f7f2c277212bd73662a00d88a8e

  • SHA512

    6814dcf9cbaf19dbb2ce7b4e4f881821621566ead756a71952ff22d6f86e34fe47d169df95e86f708c6c5333c6b06668a394e86e2f9d915ba2192c0c9524897d

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6s:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\84b89e99ec7c94ec19537c8ffc9792cd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\84b89e99ec7c94ec19537c8ffc9792cd_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\SysWOW64\mozvyrjdqd.exe
      mozvyrjdqd.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\SysWOW64\ogwgqlkp.exe
        C:\Windows\system32\ogwgqlkp.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:1868
    • C:\Windows\SysWOW64\wpjcitvqmjonfoq.exe
      wpjcitvqmjonfoq.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2748
    • C:\Windows\SysWOW64\ogwgqlkp.exe
      ogwgqlkp.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2524
    • C:\Windows\SysWOW64\xcwwgdxwzgkyl.exe
      xcwwgdxwzgkyl.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2556
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2468
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    ed0b181300620e7f1daf080007fd3038

    SHA1

    71fd487450c358ea4ffbc183c51feeb7e4d94fc8

    SHA256

    a7e664dcb7b2cc3ac721158faf7488b901592447523e82924b8631ff20489b69

    SHA512

    5f16a5668cd1419d93cdbc9db05550efff9824d157a696d2344454df37123f93972e5f6c8ad03e850b62ec2368b64b6b7f37ee3ab95ff643ac6d40f0426ce484

    Download Submit

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    443e5f10b908f7ced00a26378be59fdc

    SHA1

    a8f46d48b22899ea83ba88a8f82bbdd94bc37cf0

    SHA256

    54373c64c1a4a3891f72ca45af95e7c1ae278f41cf28e4a1c1bf5810f83835d7

    SHA512

    92bd9de9efde938089645dffff8c85b6efe7692871da044516988fa211265fc9a1ca62280c990fda5944f33026400c6f9f8ed513699e667ae395db22e80a1795

    Download Submit

  • C:\Windows\SysWOW64\ogwgqlkp.exe
    Filesize

    512KB

    MD5

    ea027a152fa3f31fe4449bc8a137de70

    SHA1

    3e957c639df11cab4afb45e0177ae7f2c2ac9407

    SHA256

    732bb390542c4dcc49ced0b0bedb232a81c0723bf0185acfb76667b13d9ea854

    SHA512

    f6ac7674828f5ae4f5b1fadfa3c3f1f3d1088fd0cf99f43244f2055780e36b7b4046173c918b27261b637d35961bdd677cf825a4f983373254a907857c2df425

    Download Submit

  • C:\Windows\SysWOW64\wpjcitvqmjonfoq.exe
    Filesize

    512KB

    MD5

    a80d2a291d6a4a5e0b77e2f74519b701

    SHA1

    a6c3dc38d1748a7a0db710183479d9bef6555f2d

    SHA256

    696ec3c4713bd9970feb0bc91458e68ba395207cd59fbcedc4d599f42e713d3b

    SHA512

    848d0b9a0242c6d4c0ea7c443703ed6ef5db12def94e39fce73b048ef01bcbe088e58dd6199962f0fd2a543c40c517b0009e9bbceece84b595110ab2098ab78c

    Download Submit

  • C:\Windows\SysWOW64\xcwwgdxwzgkyl.exe
    Filesize

    512KB

    MD5

    e5f049e1590507284213a988afb7e8ae

    SHA1

    2cdf647596f20864a6e8bad634721f2ef79b80f0

    SHA256

    08230b7c73d65257040524f3ea35af110c8feb3abb8c130f8134c1054c545b39

    SHA512

    ba98df47064a8ea81366c5224e0041294608658151c7369f1e3f20c4a8279b6bd174f54fa79a4f2d0ed0c9c31e29323470523386c8575b527d229fa58f6f039d

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \Windows\SysWOW64\mozvyrjdqd.exe
    Filesize

    512KB

    MD5

    312f2379f8b1352d0eb17cf9059de6d8

    SHA1

    21efbe1d7ab1ee8b84c7d1ffd25400e5524ff8d3

    SHA256

    7400b2dc3047c3cf8b5a65d44d47f2083326b29ca114e1dd947de51520b30b05

    SHA512

    5530951160a9183c474ce86f7e58adb5e70ae6f1a60a63b7c6f9b9f422646307291daa908ed3ba014122300a41152d60a831fbbe74aaa3ef4140671f89976982

    Download Submit

  • memory/1576-80-0x0000000002A80000-0x0000000002A90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2468-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2864-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download