Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 23:55

General

  • Target

    a306ebcea41dcb77700c72aafdb992c4_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    a306ebcea41dcb77700c72aafdb992c4

  • SHA1

    e41b256f2a196aa6ce43309b07925eb6072d993a

  • SHA256

    3b6df89f59c1adcef354652073d26161b41c47df8af04d3e71a82e7c2dd35253

  • SHA512

    aa380355b6598831253a3634b3fdaeb47b0be05621e488d715f60cf754c3c411ba5964f9b0ef5b47b5ee41a97b4de318731e5b0e2fd8b6766c364c4f8a8a630c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a306ebcea41dcb77700c72aafdb992c4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a306ebcea41dcb77700c72aafdb992c4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Windows\SysWOW64\hvayyrehdq.exe
      hvayyrehdq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3092
      • C:\Windows\SysWOW64\buwcqimh.exe
        C:\Windows\system32\buwcqimh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3472
    • C:\Windows\SysWOW64\yravpdglyvuyyni.exe
      yravpdglyvuyyni.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1868
    • C:\Windows\SysWOW64\buwcqimh.exe
      buwcqimh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2204
    • C:\Windows\SysWOW64\wanzzvdiprxwc.exe
      wanzzvdiprxwc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5068
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4272
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1300,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
    1⤵
      PID:1736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

      Filesize

      512KB

      MD5

      a134bb0bcbc3d8bae3d898a5a823db03

      SHA1

      c17601d4f51c5d8df4a32cfd1693f72d7bbedd93

      SHA256

      b7f4c383291751e93a025cd54665d7a000345a596ed606a667f9cb05b5fd9c76

      SHA512

      fb3996c70e0ceea04be86f65a835a42546720678f7caa05f614d6ea82816f1b0adc5a6da6748d91c07f7ffc88ebcb08c423df8bf52eb1a916052626f27c757ec

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

      Filesize

      512KB

      MD5

      465c08f3d5b5b98fcf1f1cd1afd6287d

      SHA1

      190bce071d1b55a22388bcb35a456b25942b2b02

      SHA256

      2ccb999df71d583bb2793f0f5e7f18d415882e82f99dc5f8336c91ebf0c87d39

      SHA512

      4b934f23021f47e0fd2245f3fe549aa94e3f3c4bfb4400398f3daf7bbcbfae4b81d274a545e6686fb40e5d0e40653d70383e93874d332655a4ee83b2645cea76

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      239B

      MD5

      602dad6ee0e60cde6698692534ef100b

      SHA1

      c3e20be4cf62746964ff865964f4f354d412bfac

      SHA256

      596069f7c5d4c9cea8266af60fcc730fbaec42eb5dd0c6f4203e463b742fb598

      SHA512

      bc1fdcc479d9d46977847557985ca1744f1d4f135da27d82dd2f131419c16fbc70968eb27458a1769e59a9a166847be39aa81b82936e39e753d578ee13df8669

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

      Filesize

      3KB

      MD5

      e957a4fa795eaa6989e728e0ab090052

      SHA1

      b7b85a7bd5edb5d3387d45425b577b2aec5f5fc8

      SHA256

      9df45dd8118b41e1f1f01e6a907313f8a3c4986840adf7c28c953f9c6c29032f

      SHA512

      d8591d077932ebc158de9895e08ac5a4356aa2813563b4e6e316ba91e0c4bb90e523ea985976be5ae7ad96db6715ffea758290dd22238c16de277341637cdbb4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

      Filesize

      3KB

      MD5

      78403f8a3a3a94ccfe98a25bd6019910

      SHA1

      e041153b97d11546f525e07153e58ac948c8adac

      SHA256

      6683f7d4ff68c3f492e4f9d75932485969342d0abec3a7f87300424a2d8751cf

      SHA512

      9a0dae40dfc220dcbe5b9b52ac0edbc6dc03d81ab3d13f715b62526c3d3650f201bbc49a3573216749f4252b6cf8ff11c17b60046bc1400769e6093c8be42bee

    • C:\Users\Admin\Downloads\CompressRemove.doc.exe

      Filesize

      512KB

      MD5

      add2e4b3810bc4dfaf3d761985249257

      SHA1

      cee6e733af866be4adf2cb1a9fbe275313130577

      SHA256

      ed9f8606bd7f76f6ad76295aa04bf42149e1b887547fb38e1127f97a69de6370

      SHA512

      005d9dc0bcb2e59b76f88b3b21cb0120418721e2f1fd71459760942d4a4a9c160d93357c6eb1e6d42a7a9f9ecbd138fc378fd3be8a92ca91ba8f2c8b43d8ef88

    • C:\Windows\SysWOW64\buwcqimh.exe

      Filesize

      512KB

      MD5

      2a45bff7184990db944f63e021ec828b

      SHA1

      41312deaddc2e9d1d812c969f2c3b89d682dab0e

      SHA256

      a42aba81585bfffa3b5e56fc402a4223548f7b218b2c363e763a2db7154c7ef8

      SHA512

      c2189b2aa5eab99760389bed872e85ce904dec0cce5b71fa23476f6de72c11a73ac8eea7d117b818a961fbb50502106ce0fdc08ba74c2ac1f1220b0f1b9c8d1c

    • C:\Windows\SysWOW64\hvayyrehdq.exe

      Filesize

      512KB

      MD5

      315ca7914fa805fefee13a55bfece64b

      SHA1

      44e9fc347faf9f14d228d6cd9aa6018033e98099

      SHA256

      e7f6f6e7af2734802fe291cad61127690360d8340c046a6b394c6a2037425a6d

      SHA512

      4e328b00d65265ba1bb2d02766061fc751f6871d773b1dd9759f35b4e644cc4d07dc2e581a2c77d86ac7b4e110ab23fd5a1e3ed35dab08e7af52624edd748ace

    • C:\Windows\SysWOW64\wanzzvdiprxwc.exe

      Filesize

      512KB

      MD5

      9cce5fe68f25d810de1fead1f15796d5

      SHA1

      1b823d172df8aae5242abef8bffd72169cd83c42

      SHA256

      bf7b21a12f44dc630f789e4ea3c4f18a8c061526be569bb0b0239a5e5702f554

      SHA512

      336677eeb3c967e667be9a59de4adb7cad0bda90782a201a2ca60e85f6cb7d41b2333cd2e7e418e0a01c29c962902bc9716d965b61f94670561bb9148c27479f

    • C:\Windows\SysWOW64\yravpdglyvuyyni.exe

      Filesize

      512KB

      MD5

      c2d03b55063863c279d3e815c7abfe53

      SHA1

      47eb2b1e892a9c10b15b986a618978d6f8e9ee6e

      SHA256

      cc8748f8abd57c7f8431dc5fcf2c4f55db7cbcde04d1fad2713b0d990847e7d1

      SHA512

      5b340c18bc9c2465c2fef764e11ab34d7e12ef182dab430a3c8507cb9f8da861b3dcb675a258a2b5cd66182aae220336722eb9a9b50d7ef15471600064c70c6d

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

      Filesize

      512KB

      MD5

      ef26846fb04a813b4343718faba55c67

      SHA1

      2aed1dcbd95b0c84a27b8d90088c606cb2fea678

      SHA256

      43154c60e44b64cbb2f19e2874a702c19f1e090c1c91e9bb251bce594c24c2e7

      SHA512

      8b8c517175afca7e3b5b720f0a8caf86a178db4440c3cac72cbd07c03b5577e8592a341581e1c5d87a187030432a5e8d7e45ac94fb88d28ffaf8820e78ede6f2

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

      Filesize

      512KB

      MD5

      25f5fd9a41d53bd315c7ca41a38bf86a

      SHA1

      6d4dbeeaad53e1d2570a633188e1cf8db700f45c

      SHA256

      61593bd9f380358458eb8fc383b82582f61b2149d7ea377ba02380c0732c550a

      SHA512

      6f40c534c74d90607405cc3060bca15e2a7502b0b5154c77b79b63e6ef6c9716f0fcb7dd535ac683bf1401231399ae3b860fc0b9602bf439998cddb2c90394dd

    • memory/3940-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

    • memory/4272-38-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-39-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-41-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-40-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-37-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-43-0x00007FF96C450000-0x00007FF96C460000-memory.dmp

      Filesize

      64KB

    • memory/4272-42-0x00007FF96C450000-0x00007FF96C460000-memory.dmp

      Filesize

      64KB

    • memory/4272-122-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-123-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-121-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/4272-124-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB