Overview

overview

10

Static

static

5

8db0850082...18.exe

windows7-x64

10

8db0850082...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 10:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8db08500823058cbae6be1d4200441ec_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    8db08500823058cbae6be1d4200441ec

  • SHA1

    ad0659082226a089dcbebe21662fbb58544d3701

  • SHA256

    ba2d01ed297d5018e916f6f2f2f49d9c01c1129ba422debdb81eddaefe0f6474

  • SHA512

    2ff8ca9db2dec1d3ee3511eb429b67b1ac29b0ad91200062fd1363ae1d1baec2bbdfab1a65588f146d98f08b819fea8154855450cce2634e717df6f5511b8349

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\8db08500823058cbae6be1d4200441ec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8db08500823058cbae6be1d4200441ec_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\rjlqgaxdip.exe
      rjlqgaxdip.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\xwdxilwt.exe
        C:\Windows\system32\xwdxilwt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2856
    • C:\Windows\SysWOW64\tkqlvfspkkyktbo.exe
      tkqlvfspkkyktbo.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2700
    • C:\Windows\SysWOW64\xwdxilwt.exe
      xwdxilwt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2620
    • C:\Windows\SysWOW64\jufwrfsltraoa.exe
      jufwrfsltraoa.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2076
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1528
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      ade219d2fb11c7bd06d0fc1c0f5dfeaa

      SHA1

      ec5232de5087dad209c9da619081561b2cfc31c0

      SHA256

      56a1e674f58d3aa8ac35c3093b88fda29eadc38b721ce9b7b51ec372b2f51f1e

      SHA512

      747d24bdb7e6219d21b4a97230fc29103fdc1a76cecdf368c2a777c791ff3be79f2ec42215d394e12f4aefb455da6b15ea7a24cb46227a0152a47ff1f58dab08

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      68B

      MD5

      0421897e901be4f640a9b512aa2d5dd3

      SHA1

      6e50d28519b276f9cd0e84ff923e35562e20393d

      SHA256

      9116e4d52941f20f4099d99b1b1b70f623edb5665093b54cac04db25ac4935a6

      SHA512

      ef7dfa36a990abee8a0d22c8737f30cd74c61f260bf799d194f78cbe3dc3a5215fe88c7db6eeb330f54d5396d13475f4af680cd5b9b34ab2402f49bc1db11c94

      Download Submit

    • C:\Windows\SysWOW64\tkqlvfspkkyktbo.exe
      Filesize

      512KB

      MD5

      ecc060029e4874912005dc03aea0afde

      SHA1

      7117c2e727e4b06c5eec2e074311488ec930e22e

      SHA256

      704dc1777b4636a68d8ebcd05f24fd7823e8caa43b816782f895c3119b22e64f

      SHA512

      830a14b346b1b75d41fc803cc47278e876f14aede76d1c13e840d93ef19b97ffb2cbd4268e9ca6ead720a001413563cf4038c9315c7f8d0c9bb4ffca3269c8d8

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\jufwrfsltraoa.exe
      Filesize

      512KB

      MD5

      ed530f59194f5ecbbafa0edce46814ac

      SHA1

      32ecdf3a34ae52cecb6dd9063af67ef9bc0666a2

      SHA256

      0a8e8fbc70de1b49d8ad61fe545fcf61acc314c4a50b96aac792baa664da9ce9

      SHA512

      648b3b9b69f2d0868486e9df1f538a2f655427a2e41de049cbe3d353e00201b8005f64c0fce9e44b013bb62be33b281893af380117329ac7c1cde1a626edd72a

      Download Submit

    • \Windows\SysWOW64\rjlqgaxdip.exe
      Filesize

      512KB

      MD5

      fe03d0bc1671c5350f2b598c030f97ca

      SHA1

      2ff91ecd1afb9768c1bb2a4911ac45386478aecf

      SHA256

      648834fe8934378d72681747d59952d7e1b9503fbd7c637af95f6f8f1159ad31

      SHA512

      d395d73baae4833f088742b8dc921f386b3df56a8447969564dcdfbe0f491fdb1c8213637e376371fcf3126eaa38c5a08ddb8585b3a7b6e8d3dbfa14f1b495c1

      Download Submit

    • \Windows\SysWOW64\xwdxilwt.exe
      Filesize

      512KB

      MD5

      c3cca1a7a84099ae08d0b9b3c32394ed

      SHA1

      c39745a4b14c416443cf1b8446c5695d155db640

      SHA256

      29c8cc7ec140f915cfd666f9dab933f1091fd4b566758181546604747f3042df

      SHA512

      9e2dacd5301b9b1aa098edaada61ad927738ba1bad08d51ea8a6af3cf0a206a94be0c98c12b4d5a2cfaee7c35a359d38f3693d02420fb9c3baead21ccd1e3f98

      Download Submit

    • memory/1356-84-0x0000000003C60000-0x0000000003C70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2248-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2468-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download