Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 13:56

General

  • Target

    a0e805726f42e9e3cce0fc006f91ef4a_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    a0e805726f42e9e3cce0fc006f91ef4a

  • SHA1

    a8393f2417dc6399a022456a9a7ca2046f38f6f9

  • SHA256

    027f582e70cd76f128f563b272488aab93e7af086601502f8cde75dc0f97aa91

  • SHA512

    949c3dbac0d0903f7af98475dfb28f4144f5ece246f8d36f97baff907f240c905ff3840c21d7932c1cf5917865fa306ac95b020e623521f2756ced868a74a161

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0e805726f42e9e3cce0fc006f91ef4a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a0e805726f42e9e3cce0fc006f91ef4a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\SysWOW64\sndycsbkbw.exe
      sndycsbkbw.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4256
      • C:\Windows\SysWOW64\qssjtoxa.exe
        C:\Windows\system32\qssjtoxa.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2156
    • C:\Windows\SysWOW64\onzefmflltqiwwy.exe
      onzefmflltqiwwy.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4828
    • C:\Windows\SysWOW64\qssjtoxa.exe
      qssjtoxa.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2364
    • C:\Windows\SysWOW64\zqlnbmjvkfvkq.exe
      zqlnbmjvkfvkq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4740
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3988
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3948,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
    1⤵
      PID:2552

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

      Filesize

      512KB

      MD5

      d95fd49f65c14da70dd53dd6323f56c7

      SHA1

      c88360f4384ef00ff14a9481f50c7875e8bacdeb

      SHA256

      896169ba2ca53579445930e4821a5a3ab572a0d13f2ce1a5d63609976f1ddbbe

      SHA512

      b6b4e7df931a6eb764b7cd510e3021023c761ba05b6ea502abbe043a258be513d93cc8c7d81299882a4c4d2625288494011b90bb131ee7c2e6620ef05fd3c23a

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

      Filesize

      512KB

      MD5

      0e58eb94c93a1d13412fb6c77c150ee8

      SHA1

      ea964a3970146dfa68aeba3bafb05efdae90d391

      SHA256

      b7ed14ed4139824dda3fe3caf3299dc595734146c56a5e1327a14846c66f1643

      SHA512

      2f5dae225494113d57bcda573a1d73d5ef82534ee486ae1e2d92c1fc7ac08bd5ba33db9324ee9cc1c031ab32981a87250610aae3fe8e6824e4ca1ff16f786b08

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      239B

      MD5

      12b138a5a40ffb88d1850866bf2959cd

      SHA1

      57001ba2de61329118440de3e9f8a81074cb28a2

      SHA256

      9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

      SHA512

      9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

      Filesize

      3KB

      MD5

      29e3436051f3dec69f9d02a62294b4b3

      SHA1

      e72403ee8bb4a56ff448ccd00581964642149742

      SHA256

      188fffdb9233337f0a80605cf65d18dca5bf98f5e0e2fa39e6efaf90d9dfb2ca

      SHA512

      bb60ba66ed38a1b2da044bb25998a3a01de738047ac8d000650a24bb97d6a020448444223f9f9fea34dc89eb7181cef9775c6b59da24b653815d90c59f866f5c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

      Filesize

      3KB

      MD5

      57fe427f00452441bd45867d12014444

      SHA1

      090f61eb2d38f08db590a3751303458212298fdb

      SHA256

      d1372607e21196fdf20bc9ae4d82d561e2338171730b9aa43a224618cf916d22

      SHA512

      a2186deab94090d5fde6807098396a2bf097c78e7f8a6d5255511f6c39f2f124007abb9cfd4532ad0e039acba569f357e6c2e134036e1ea027f0bfb6121114a9

    • C:\Users\Admin\Documents\SelectPush.doc.exe

      Filesize

      512KB

      MD5

      2cdf166816143d501b17552966ee46fc

      SHA1

      50142c45c2a5778671c804f9b9201d1515e601f1

      SHA256

      a80a6afb4bdf4a7e8af510f2c5b057fedbd707dce5f6ec570419ed3c93fb468c

      SHA512

      26497335abf309faa61d1631fe3bcb32a2bd81471db36e4cd7d666f99abdc5cd14e61efb5c0ef1eee592f2cf8835bebe16f60d34f3d671e4a3bbe4ac28801113

    • C:\Windows\SysWOW64\onzefmflltqiwwy.exe

      Filesize

      512KB

      MD5

      66f5b74257064fab380d48bca1e2bc29

      SHA1

      2eb618503f9e5e2ce5afd85d409ca908a7445d8c

      SHA256

      a5adc363941c6d916fb2331c17a3afe2f179097c5fa19aedf4fbdc1694527796

      SHA512

      31d84f6ece696b3ca04a12f6e7edf02c4c3606039898ddc36565b754734aa4c2b612123038000a1955128fe9bfe80dd82b925b17d5414b837b3a1cba2eedaa10

    • C:\Windows\SysWOW64\qssjtoxa.exe

      Filesize

      512KB

      MD5

      59e0142a2630af4f3b802facc24e8eb6

      SHA1

      0e370692ab0f7267d979750a59e03e3dc1fff5f1

      SHA256

      47c639b84fc8b586345f1e29232724c445fd49a493f54dcfa185b0c320220182

      SHA512

      09e8146a3fc2b16111ecc74b0aa528f14e3fae14cac0afa0ccc92f70a16c898df23621b5f32b4724de1b5f00cf2dc6dc884fc970240bafb707f0076830c1628e

    • C:\Windows\SysWOW64\sndycsbkbw.exe

      Filesize

      512KB

      MD5

      f57e977ebfaea5824cc84437a12f74ee

      SHA1

      77b3de059b1191419dc5cb4bb0d9fe1576a5966d

      SHA256

      45901bbdf2b5500453022761e4d84f1d46df03102c28641a8352557e0aa0f07e

      SHA512

      2ff3d564c980e346fbcaee0ec89f0fa74715000ce5b13bdf42e7df389b88ff26e87b8b78cdec63c32725e71d6e98442817f13bf5533fef6432eec0c9b9eae901

    • C:\Windows\SysWOW64\zqlnbmjvkfvkq.exe

      Filesize

      512KB

      MD5

      fc05b0258cc81689ac2060cbac7fd53b

      SHA1

      ac6c0387b53ffed8e4206277b97766f94ef1c22b

      SHA256

      2891625cc846967181543ea93092a69850c75a7efa1538e3ebf0f737452067bb

      SHA512

      39c0924b6f6e298a1772c4e97807969cfab5c27bee04cbd52807e9b226a072f180add6f13bb7b54e9f44131e21fbd8b6c5ba00582ec729419211b1060d7d1bc6

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

      Filesize

      512KB

      MD5

      cb51e2f9504afee9cac4a931156f1516

      SHA1

      92d4223cfc4182cb00ef0910ae63929d46b8cdd7

      SHA256

      41b3bcb157255f2d7210a7548fa2a2086125167bbe1b20e75d6a20d9b4ad3bf7

      SHA512

      b25211dffd98cf0ecee8abb9ee397cda30ee0b405f744fda9d4553c9c6f98242d5472f431c26c2bc7a34d45d72428c9d0bec750b565f170ed20f24b76fc88496

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

      Filesize

      512KB

      MD5

      b3f8679bac456f690b4391711d3b660f

      SHA1

      feeb0c0887821080ea4eb91f26fc7acd9a29fb69

      SHA256

      f3b378afd125c3c3caf3fb773bdb24a91acd0b7683a9c3f8fe8119f93adb5dec

      SHA512

      37d2fd75fe58121939b72b4eb9431897f4556d1b15320c676538f5be37e631ca108e6abb88e0b14e86c0a37b89024b0d9974c27f44f725fb5dfb776e104d59d6

    • memory/3080-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

    • memory/3988-39-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-38-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-36-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-37-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-35-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-41-0x00007FFE78B20000-0x00007FFE78B30000-memory.dmp

      Filesize

      64KB

    • memory/3988-40-0x00007FFE78B20000-0x00007FFE78B30000-memory.dmp

      Filesize

      64KB

    • memory/3988-119-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-120-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-118-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB

    • memory/3988-121-0x00007FFE7B330000-0x00007FFE7B340000-memory.dmp

      Filesize

      64KB