Overview

overview

10

Static

static

5

930c33ff94...18.exe

windows7-x64

10

930c33ff94...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 23:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    930c33ff94fabe0b19a313d5c36b1243_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    930c33ff94fabe0b19a313d5c36b1243

  • SHA1

    bd5bcc8905ad2c876853bf434a90a860a69e0b8e

  • SHA256

    f4725b05284b9ad3b6e6be5007795dce59b504d4c6c962cfef2955fac97f952b

  • SHA512

    1aaf565607effb18fdf6bdd5f1548c81dda9f0e6d29a0499d466bba55cc6c4f2a86b24a63250bbf769144071397e3a2b169ce68c65252f8545ed00218b84ef72

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\930c33ff94fabe0b19a313d5c36b1243_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\930c33ff94fabe0b19a313d5c36b1243_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\tzygrsftxh.exe
      tzygrsftxh.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\SysWOW64\tjuqwohf.exe
        C:\Windows\system32\tjuqwohf.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2664
    • C:\Windows\SysWOW64\kcuugqdtriifhcv.exe
      kcuugqdtriifhcv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2704
    • C:\Windows\SysWOW64\tjuqwohf.exe
      tjuqwohf.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2884
    • C:\Windows\SysWOW64\rhkvnumskbnam.exe
      rhkvnumskbnam.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2632
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1012

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            1ad61dab747e7777ca7a6e4d865d92a7

            SHA1

            809709c52a6c7933b4c9556fc25a33c0a1d9c4bb

            SHA256

            72d0eff297e3a36e0c5f96de94edc745c75e5d1af2b819217aac32700f5545f9

            SHA512

            2cfa2a243a3ea3bf8d2bafbb14d1b3f69a42d6067d40e28eee6be19fed0c74e6e56fd948c3b962a5ad6594a3b068d01bafcf054925370d355ac24484bc8f0c58

            Download Submit

          • C:\Program Files\CompareHide.doc.exe
            Filesize

            512KB

            MD5

            033c5d256fbb7bde92c94fd089c37234

            SHA1

            8104fa27387bd678a57d018e9ddcabcdfbee8d21

            SHA256

            ab464f90c9bcafb17ba2fe72888adeefd606f49fca5d0ce7d4a5dad8863728c7

            SHA512

            16052838c63834597292c4850eddc3944a9b1fdee3a92c92717e609d7f764d5bef0212fdca191fcbc14de75485a383d63c193acbd94574b35c24d17fda82105d

            Download Submit

          • C:\Program Files\ExitRequest.doc.exe
            Filesize

            512KB

            MD5

            33fda74bcbb62bea26ba189f3c841383

            SHA1

            82725ad8b1bb25df37f5e5c691f72ccd19ff9de1

            SHA256

            a89440f99278d743b2b298219fe04cc66377966ea35b20104aa76110741bb37e

            SHA512

            5f3cf042d27e2c4a59b826b082a27b676a6323c745cb1922aff78371c55515d65def72dae54170c0ddd61d238d826c1c21c9810c53a3a90e7582f3382e93e8b4

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            5d271298edf9a23a6fb9e0771ecc59e5

            SHA1

            ae5d0e1636e8424533fec8d68148e0de6de55172

            SHA256

            46d01815bb94c3795ef043cdcaeb55e583cc70b09290234865633a2b1a0f24d2

            SHA512

            157d546e61f0316d4ed57814a28f2264ea92c082b5ddd4fecaa2d6089ab3369f21c19a7f130b59329ca234424067927cc09f92d17d794b70ca521a6e869c3afe

            Download Submit

          • C:\Windows\SysWOW64\kcuugqdtriifhcv.exe
            Filesize

            512KB

            MD5

            fdf9776a7c61a3e087abf2ca1a87c4de

            SHA1

            81a8f2d1bd4014b0873363842284fc8d91d72c59

            SHA256

            f30d5e01870f4dacbd16154ba3fc065357aa73569d080e0d371a5324252212c7

            SHA512

            7c2fa4820bd904c064d2d1fafc6c57e9602afa5dba5c46a7ce9f761554298f30a96aa6e17c2663e73d8e4ead5037efc86f75d4fb517434dba3cac76bfe458f22

            Download Submit

          • C:\Windows\SysWOW64\rhkvnumskbnam.exe
            Filesize

            512KB

            MD5

            f7a29dfbb1d21e83318ca691097bba38

            SHA1

            6a56a1047ccc467a1e725c269be9be688069af1e

            SHA256

            7d39486b59139ed74a551f604bf95d8a7aaf4e6a5dfc03c7860330b0c9d97028

            SHA512

            a09c839a216f9f91b9834d810f6f096bdcb8649866409b2be44a10fc41ac29d470e800c828690878add5f948d912409fcfc463108f8615a41830b24b809f35ce

            Download Submit

          • C:\Windows\SysWOW64\tjuqwohf.exe
            Filesize

            512KB

            MD5

            f797d3e0335f7c3210186782d5973d28

            SHA1

            95f2d516b159dd484bab53c2be6a48c7a7b09dcc

            SHA256

            e9e40fcbbf91f0cb927cba4bc62ea62cd6e3309da1ec261536559149fdc5a490

            SHA512

            937ebd0d13a317b45b51d634f284cc12e4cb24b8d1bb78929233fc730b53347f472cd6208789ab9cc5e465cc560e361621854b22432a8c88df31db5fc6dc0684

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\tzygrsftxh.exe
            Filesize

            512KB

            MD5

            5c06c8dfa0e1c4574fe33ff0bfc91480

            SHA1

            28ea4cf5295044abdc6f9d30330db256dc9d8453

            SHA256

            2253b1331a065f39f786768c3a9e15059b6fd8ed45fa001d1fa0f4cc46570054

            SHA512

            29bafeaa2c9757dca57e826db5d357c0998d71c81a81deb421d73205adfe8261ac65885a509a7edab0022076855953e9b1982a70ad005125babc72a9d11fac6c

            Download Submit

          • memory/1960-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2232-51-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2232-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download