Overview

overview

10

Static

static

5

96ca33f41c...18.exe

windows7-x64

10

96ca33f41c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2024, 00:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    96ca33f41cf09ab3d2e5b52919aa99e3_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    96ca33f41cf09ab3d2e5b52919aa99e3

  • SHA1

    e3c4838b1e749449a17f201ecd08420215d0db3e

  • SHA256

    3340480e26165e6e76e34e95d6c690861bbd725ca0148ff0d38b411ca17accea

  • SHA512

    af455ad2afcdd33070282c5b9f1e4c0f9cda6a25bb257daecdc75463864ef28ec149bf6fb7c96adbe375ce0cd493b4d93a90f6c1134001bbd61c4406bc4f9620

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\96ca33f41cf09ab3d2e5b52919aa99e3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\96ca33f41cf09ab3d2e5b52919aa99e3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\SysWOW64\voqllgtkki.exe
      voqllgtkki.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\xjrxccch.exe
        C:\Windows\system32\xjrxccch.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2456
    • C:\Windows\SysWOW64\osmkeyllbewhoxq.exe
      osmkeyllbewhoxq.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2640
    • C:\Windows\SysWOW64\xjrxccch.exe
      xjrxccch.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2588
    • C:\Windows\SysWOW64\jaecmnupfcuri.exe
      jaecmnupfcuri.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2712
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1208
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1220
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2720
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1204

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      a6a269b4fafc8b271024370a52302b12

      SHA1

      76de215fa92ffb63aa2f54e24a27444ffb8bc519

      SHA256

      3d787751e9527473a3fb7b440000f082261844222e6a5e4a406830e927955764

      SHA512

      d02d4572f68a0f0ba8cbf6be1d2799673a9781d64e4ac5011e38b3a134538650cd0dfa91ecadb84e167d06db1c751fcb2bcf5c33875b81772c1dfb53301799d0

      Download Submit

    • C:\Users\Admin\AppData\Roaming\ExpandUse.doc.exe
      Filesize

      512KB

      MD5

      62f7568c9afb82bd771d94b9763806a1

      SHA1

      543ed7d5bd42c66c5dcf0fe98469db7f6b237e08

      SHA256

      8328f39fef47972b7290b7a46c74acebd5d397d37125e6fd3c62bfb733a973a6

      SHA512

      ff7563e4769c2155b2b11f1be1880cc0d08cf489402f6b330d3f1ad139cacdac80bf76cd8fbf3019a51c7f65417c87aadea50cb9bf05fea005a3b7497cd002d8

      Download Submit

    • C:\Users\Admin\Documents\RestoreRevoke.doc.exe
      Filesize

      512KB

      MD5

      3bab3bb281a14dfe43486cc07fcf3a11

      SHA1

      bb6fd017bf829bbcdf4f8f2c9b5a852b4e504dee

      SHA256

      12a1dbeec61c2a3f69bba80e42a4065fec3b8b808085d3f6072be504dcff4126

      SHA512

      696dc3491c113909c1121121213df896e8ec43ac561a0a9e68a9126ed90e2598352c2a1a1d2b6df1388023eac791dc969e443360bfa890cf04586467d15d9c59

      Download Submit

    • C:\Windows\SysWOW64\osmkeyllbewhoxq.exe
      Filesize

      512KB

      MD5

      fba9b315f088c76a0e2e8d8dd116660c

      SHA1

      19a566199c5212242a8610687d0f3cc77bd38335

      SHA256

      c93a5813a593f0118544490c4e25f3c35a4faac9622eb8abc8022892d2efd2f7

      SHA512

      e2a61fb467d4c02d2e0e72f18d6497b53297d8f098248cc304f4f22bf885fd9ff38f3b061d7322583d69daf811b15de6213e702b4863b4baed44f25e809fd0aa

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\jaecmnupfcuri.exe
      Filesize

      512KB

      MD5

      2f2b009d1b2a756cfea8b1bdb8887516

      SHA1

      3bf73ff5d0040255975b854f3c1a129f710d7ea7

      SHA256

      90907f55351dcbdd50128fdaba806b446057e68c2685467f739d952f6468ab35

      SHA512

      c4465756d07dfcf83dceb63a5128f66b1d9f185f6b60162c7c1c115a053997a0b7ed45409988776abbd29fa65cbfb8733e6761da6255f30c56f3e4eabb387334

      Download Submit

    • \Windows\SysWOW64\voqllgtkki.exe
      Filesize

      512KB

      MD5

      3d12a18bf3f8d216f6d76a51598c4944

      SHA1

      89e07d365166e42c90a6dcdc48cd3d85e1548f7a

      SHA256

      6619ed0373072ccf58035f77d11f7845e14ee8d6f4cac4e53b1d17e31a67ad25

      SHA512

      982c75c13065519d01eb3b981e3b96866f8c7a65459895cf891bab2ba2130dd0fe70d64714c17e7945584298429f7e2af5facc870ed25cae7c614b668c2b7305

      Download Submit

    • \Windows\SysWOW64\xjrxccch.exe
      Filesize

      512KB

      MD5

      2f69c83b80df1406493955c84892805f

      SHA1

      d0231432ff3eec2054d96eadab758a79faa0cb69

      SHA256

      719d9e67a93694558bf5e442beb2dd98a9a6500e54ed55daedd1333c253bcae1

      SHA512

      817f9479bba81074a0175efcc3bd431dc10171f4d93b5a15c0eef4ce2ea3e997622a78f5c05f4789d94dd6c1b46e7422920dc58ec2e98ce01dfe43a2a264aa62

      Download Submit

    • memory/1036-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/1204-90-0x00000000029F0000-0x0000000002A00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2428-49-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download