Overview

overview

10

Static

static

5

96e6033ab0...18.exe

windows7-x64

10

96e6033ab0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-06-2024 01:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    96e6033ab03cd47e93d0a13c39b47167_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    96e6033ab03cd47e93d0a13c39b47167

  • SHA1

    b9378d919e611183d71903621d683f676c203094

  • SHA256

    77bb1dd9075470de905be846ce33513152c3fc94506f0e89c9ec3c82cc294bb9

  • SHA512

    be5599889bb38bc83a8655f8315f38920e96e49542fc80412ed04361f188f6212fb05304fc02558966030734686c06da1a2efd0c41da23abef5f8e622117ccd1

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96e6033ab03cd47e93d0a13c39b47167_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\96e6033ab03cd47e93d0a13c39b47167_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Windows\SysWOW64\tgzuqhydnt.exe
      tgzuqhydnt.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\SysWOW64\oqwpaoaj.exe
        C:\Windows\system32\oqwpaoaj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:396
    • C:\Windows\SysWOW64\lmuzpsdrlrrucjz.exe
      lmuzpsdrlrrucjz.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4264
    • C:\Windows\SysWOW64\oqwpaoaj.exe
      oqwpaoaj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3192
    • C:\Windows\SysWOW64\qusmddmbxcqbs.exe
      qusmddmbxcqbs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3568
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    e9e04759c39aefe6e036507988e86b6e

    SHA1

    0fface97ce94e0a9af6b77bc95a35411979f10a1

    SHA256

    7560f4243eb425e1a10943b38ada3a2318fb23a4a1edfd2117f59f737210bf75

    SHA512

    eccdc0f8b5bf2c4b2d6afe9b8ab932799843f901be3e18437699e060733d7aca8ef7d06f938c4e0d0302f5eb26f629ee91eb9e80cf064abd96fcde66c21caf91

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    1a35de6409e512d877d2729bdc33091c

    SHA1

    8fc374e4f73eff95a14d0ddb4b35bbc243371789

    SHA256

    b52c95bd5282b40b484623a68f93109fd7e5a25d35464eb36883e11d1fc0d92e

    SHA512

    0bea9bcf786c786018fab2ec348bbbd075b70c97bee6db07198749df36ea3633f18ee14e9c63917c1354ab748dc847b12aa1f0d4150345169b9626706d05cb13

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD77A7.tmp\sist02.xsl
    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    247B

    MD5

    1b529425a37b1334b8b33ebd890269a4

    SHA1

    84768e6475b45e3431d5dd62968dde9b92bcb799

    SHA256

    774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440

    SHA512

    8d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    5869556089234b7556435910636ac73d

    SHA1

    c8f0f7cbce109cb0055c697bdaa3156ed62594d1

    SHA256

    defc3e7c7a20e5094f1434e83e17672139cc5068e9e27422c42f4ac10811ae80

    SHA512

    1a41c303a8bb7c7ca05cdcf7d67850a967dda9cc10015977739b7ae1333e27469ebd25e094bdcf0cab337a3166627db5f85a713d0da61732f48739c6cb822d2d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    f06aa7f78ef7c516d6cf9492d1f2fe16

    SHA1

    a1b1aa2af77c39859eef9d349c0cfea083579dea

    SHA256

    71d60fe6336f442832137414a94196d24eee1abcbd3e96b0f0f36d1a9431dae8

    SHA512

    a456ea8993653b98cd7da4ffda9474fb8f18eb626a0fd5e244525ac701937b535c20cd044faebbe6754122ce0f611ec44505e545a3bbc524d1c42d079222f35c

    Download Submit

  • C:\Windows\SysWOW64\lmuzpsdrlrrucjz.exe
    Filesize

    512KB

    MD5

    f3d56692e1acdc3e2b2bc92abd02aa48

    SHA1

    ef705eb584e821c503fe81051bd1baed48e8002d

    SHA256

    2824092cca7d6a245a420378fb9e2e6f63abd281f64c8aeba9fcee96ccd308c2

    SHA512

    18521c47dad37aa801b86350e4e99b0cb9232a84a96beec5c549333b262c267778a3a639987bb32bdc11128fef4fe6c23dcbf20ef0ed43443713014d0f0313fb

    Download Submit

  • C:\Windows\SysWOW64\oqwpaoaj.exe
    Filesize

    512KB

    MD5

    906bb52242c528e3fc418f9da5e9c5b2

    SHA1

    45c3e7807592864409fcd6cf727a7e652a4934f5

    SHA256

    99b34e59dd0378e62b5e727cb971643680e3a2963dae1664ef07c918fc35cc48

    SHA512

    3c2136ff588c839b88f83e67e6ea33f88de1a4b236a9803deebe3a4d34e568dcd82f18c858b7543beb3988641d6f3413e823aa5df2d3f5da26c3515f27f4b370

    Download Submit

  • C:\Windows\SysWOW64\qusmddmbxcqbs.exe
    Filesize

    512KB

    MD5

    190804fc132ad049c27f65371caade1e

    SHA1

    7596203770e35ea08cd59e17c34042c8e46b60c7

    SHA256

    f4b806ca90a2dfcfbbe109cfead861c7d6c4275729109ca9ef7278245938b5fa

    SHA512

    09b0e1bec80b07eef0be4a919266ff6d8f68b283f44ea260e414ceefafc5a2d55db3e298e2c5e2114a6081db7515dd6c1a1ea8f31b40000aa4604698be18ebdb

    Download Submit

  • C:\Windows\SysWOW64\tgzuqhydnt.exe
    Filesize

    512KB

    MD5

    130aec8e185d65c9332db51135a79f7c

    SHA1

    b1389fb7511a248299f057e9bea263f0ca237e7c

    SHA256

    4d12374a1ec463316b26a29b5f4f08c9a7278755b901e198347f6ee2eb78178b

    SHA512

    38e0992426010e64f256c12b93e42e85e684077637b275bacc6c8d9e25123ab8f0c1f277e5ce184f0916786e22f0cb535fa3f886130d32cf7a9c7a2e16c71ef8

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    73126eb86baec16606aad9b29ac22c6e

    SHA1

    bb3b9dd50611f9a292ccb96c52377666c664005e

    SHA256

    eff627645ac11b979b0641c30b14a54eedd526b7f93eaed6b05d6c7cd14fbff7

    SHA512

    f8cd9b818227b6d83a516de475eb4b710e50d95ab8b99a9c20e88bba3ec20bd45d5e7ca858e41e5b141d7a0ae104f9f588fcf9908364add3d150abb4b6e58ee4

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    a8be98b3edbaa24454077f7b6dd6abae

    SHA1

    9a48f5580786273acbaa278bdf4e5644c33239ac

    SHA256

    7b8fb2fe813eb5e144eaf7e9fd5684ff3300aab6d9e13dec57901775e4bac82e

    SHA512

    06508378725d8091b27f9979b4a1ed000ebd10a4e9440f28329a23a746e50a0ca85fbbe21294eb26fdf0aa93d832ac5009317e785c6bd9216fde5fafeb175f80

    Download Submit

  • memory/996-598-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-36-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-39-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-38-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-37-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-40-0x00007FF96E3B0000-0x00007FF96E3C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-35-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-41-0x00007FF96E3B0000-0x00007FF96E3C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-597-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-596-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/996-595-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3552-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download