Overview

overview

10

Static

static

5

95bc306768...18.exe

windows7-x64

10

95bc306768...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2024 17:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    95bc30676854e61d8c1ba2251543e1f4_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    95bc30676854e61d8c1ba2251543e1f4

  • SHA1

    7742b1c7e3887a2162dd5ca768063fb14743f0d8

  • SHA256

    5a9d919f86bf8ca4fea85c674b77539cafd6c2b3e77cbdb34507345cc0ce6baf

  • SHA512

    57d30a73d4caa955f86e5c612cda5931ffd954354fd3390efd64691eaef792d132514d928b5ab9ecbdaee23467244204029d14dc1306a42e949ea950bf1b99cb

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95bc30676854e61d8c1ba2251543e1f4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\95bc30676854e61d8c1ba2251543e1f4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Windows\SysWOW64\mvuvzazifd.exe
      mvuvzazifd.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\SysWOW64\lyuvanmf.exe
        C:\Windows\system32\lyuvanmf.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1420
    • C:\Windows\SysWOW64\acbqaavdqflzhdm.exe
      acbqaavdqflzhdm.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3908
    • C:\Windows\SysWOW64\lyuvanmf.exe
      lyuvanmf.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:852
    • C:\Windows\SysWOW64\ucjdalyuqsond.exe
      ucjdalyuqsond.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3188
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    f287ace8fccaeb085f2dd7d280bab41c

    SHA1

    a01143190678940979bb611cce4f507133c9c691

    SHA256

    5a4ca8320822a14cc8d7f4726c472bf32654e70e91c13a0302cbbcffda511001

    SHA512

    c81d5c6f65d00ccf6cf31a8db5dc5d7a75e09e8a4e04a69d691c7ca55c329f73880e47819b42c789d89c33df0e2417d6d98723f7bcfd82c0aeaa86a3aaa69dc6

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    099879ba1a3cf8477221ed7015cc92ba

    SHA1

    42cd6a660f60c92d9eca358b3af6643e7f3e597f

    SHA256

    51544b5b615d7e33476112b49b52f0f29eab40fb9162bc04aa3946954f2c707f

    SHA512

    e6740bca279cace934b0662eca28db51083b67e7e886d8ed39a375fa5f5e8e23967ffba7ba4b1a54c9c5a40455846b6cdfcd93ec51fde71903755bc6455ada9d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD7E20.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    483e486b210bf9292b8a9d2e2aa343d4

    SHA1

    987199a029470a96dba4e925dec7bc589cd2c72e

    SHA256

    1ab895bd83a248ff2134ed43ccaa60fb1f71fdd030a80b307a106d7cd6937b1c

    SHA512

    a84db342e8eda97dfc74e4d1681b2cb4eb1a796041a44b02f843854f2e951a3ce80cf2e76486205066a13446dd0199ff77d62a86736a3bdf4291a14e1667dae7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    2fac8c297c7b82f8ec6a933d62287a61

    SHA1

    53d5edd899d28774af60b013b886aa285fd87604

    SHA256

    c7c068cea49ec27c4dc089b725fee26aa16c4a8b451f00a344a22075c2852c2c

    SHA512

    e3cb3880efeb30e4df87e32a97fa018b7a24818a699a61ac7df9da6f66d6366ea2caccb71865270c37081f7e66e9c81dbbb8a6de4a54a8bd4c99a447668b5815

    Download Submit

  • C:\Windows\SysWOW64\acbqaavdqflzhdm.exe
    Filesize

    512KB

    MD5

    e13759cbe7608b8ef6a00a6044149149

    SHA1

    9fbbc278b7ef0a62896cbd8b8df4c6d30a461166

    SHA256

    41f5cb861adf78da7284ed4ed18af9e930cade5aec5e2803e9eced93fe887647

    SHA512

    40d72dc3124846eff256b76235bdaec0723e34bf75a3e1bc847fef01c7ebf454f26c0bbab2a3a570d3fb643caf0e8b3a1e26d342e831fc1b9a20104d94e640f2

    Download Submit

  • C:\Windows\SysWOW64\lyuvanmf.exe
    Filesize

    512KB

    MD5

    330e3807c27e3388c5ac4be230d2ca7f

    SHA1

    188dc7009f64de0f2787c45785eee4638fd88f8b

    SHA256

    6118d5295beaf4256c1cb7526f40972284fb36827d95457900fc5598748c2663

    SHA512

    0405db58ab962f5eddb65ba144d1e6c5b471aa0236bf31d809907f02bfce49c048253b9be56881e3c5462a41ea1198b5130d656061e3ccacfcbf345c721fa13b

    Download Submit

  • C:\Windows\SysWOW64\mvuvzazifd.exe
    Filesize

    512KB

    MD5

    03038358cbc309af2b8500bff8555786

    SHA1

    e7686b40cd8b244dd36cb3f0185571662d42a9f4

    SHA256

    66d8ef39695cee0b17e1651158c16c311835f6beb008a8c3e3804e386a43cd70

    SHA512

    0fbdfac517b381964d5f39a3a28eee3a30c81e04d2a0f0036085a2b877135ec1f7ffb93f602e5bd8e895b22929f8130ec7504cdbb64997b0045e799ef23de404

    Download Submit

  • C:\Windows\SysWOW64\ucjdalyuqsond.exe
    Filesize

    512KB

    MD5

    3090a93df56ab7f6b3afa4d9a40a1113

    SHA1

    4db3e299968518cd757fc2433e90f63062a340a4

    SHA256

    2048779d20b3c7e03c8b8aead64accca4c0cb9f502f6d142f42945ecfef54f9f

    SHA512

    1d2d1289d70c6adae87eee8344554605720b817b14b4c57d303ad902443239044e7f8d33b76bc182b9ad472aa87b98d98a57c323c088e80c87bee047321a2f6d

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    6a39adf4a96aff16cbd3d1350e2ec037

    SHA1

    f7a35bb5ce78cd78a56d97b3b243489b97786a51

    SHA256

    6b35f99f827cc26a77de18ae8ba5bf295a4547b489f810019e1b88f89f56d795

    SHA512

    cb052879fb6f5f8a2238f05c10861e77a93bf11e8bfa2091504b6d94034aa9f38897d7d94dd060a01772ba443d1703402dd0a957c02b6510b084d76e618a8ee8

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    6a73016d936ef63cd5be05c6b98ea434

    SHA1

    dab1b0a7f4ad3c5d663d4655fc5e4ee1ff7ce75d

    SHA256

    9c973434341469c5f749de6fe8021e6ee7f87fe8416942b7b28a6153019f334f

    SHA512

    214a4ced4097f48c42756358e793882043f0ac260e3d0a8d3082fe5a2837d3a414454bea728d07616882fed91346278614f78a9ad38b65bfd3a23a8b28d6c356

    Download Submit

  • memory/4060-41-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-40-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-39-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-38-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-36-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-35-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-37-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-604-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-603-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-605-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4060-606-0x00007FFDEE0F0000-0x00007FFDEE100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4644-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download