Overview

overview

10

Static

static

5

a722f0777d...18.exe

windows7-x64

10

a722f0777d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 23:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    a722f0777d032da6d8cb194a5fa8c241

  • SHA1

    69b4b0ea0b10988c8f2f692b101f856a7cafd960

  • SHA256

    7ffa13e05eeaf1773743b875187ba4633809f68653953e321eaee0c6d14728d5

  • SHA512

    68e17332565d747546b8b821caa4c6816367847c8279afa7af26b3a7625851df10f92a7db9541040824ba3cc363ae61101b4d1d746a31ce9efa6e648c45e4b44

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\SysWOW64\llpjstmfgz.exe
      llpjstmfgz.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Windows\SysWOW64\qgveeavc.exe
        C:\Windows\system32\qgveeavc.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3768
    • C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe
      zpcynwjmbqyeocn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:116
    • C:\Windows\SysWOW64\qgveeavc.exe
      qgveeavc.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:228
    • C:\Windows\SysWOW64\jezvxnqvpeqge.exe
      jezvxnqvpeqge.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1092
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4912
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:408

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Modify Registry

    6
    T1112

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    4
    T1012

    System Information Discovery

    5
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      cef055fcae2e7c722084dc34da958485

      SHA1

      3fdf3494eb2da51e48b6e72ca34b4b0bc00f9b92

      SHA256

      fae1a11d59ad7a68fc5c9ceb0570be48228b11fa5293f4aeeb95247119b2629a

      SHA512

      23a105491ea36a8ef820676ba397a1db94f00fcbe85666615bcd1296a9b0e6d3ca575e09a6d4b05e8e96dffeda395db082b59b15914fe9f30dea835671319fea

      Download Submit
    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      a5f879d93ed8620a39d688d2168b1190

      SHA1

      7eb86997d1477528dfa592a5c771d911fa7a6146

      SHA256

      75f94654168d3636128e50c62a167f0efcb48bb208c36f06f677b18ace080483

      SHA512

      b21ac6cc130f34ff9eb397a60067750afef5f42fc138213dfaa18c058ff91c8acff64b75e4924733353fb47fc4235535a7ef74008e1ceb35232a3da62acafb14

      Download Submit
    • C:\Users\Admin\AppData\Roaming\DenyReceive.doc.exe
      Filesize

      512KB

      MD5

      958966a9d1875286e9217995c8558f14

      SHA1

      e9a967eba82dcf578ee106e1c479bcfa4601cbdb

      SHA256

      a44fd933ed3d39672969d931495152678792dff1b7cda7b617201f872f4ce3a1

      SHA512

      dc6afb8ea73b2c4dd9d5adf13dd9a7451e7c4998d6bfc439a03102b8cf090bb3ece81c073c2b6bab28db039def9c47a0389cd4f25a14ff37e1ccd2bccf1d1cb4

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      239B

      MD5

      12b138a5a40ffb88d1850866bf2959cd

      SHA1

      57001ba2de61329118440de3e9f8a81074cb28a2

      SHA256

      9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

      SHA512

      9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      3KB

      MD5

      f4ed5c8149b73fb9c22aa8786475e375

      SHA1

      49a4b2f57a21017ff6f0eaa04669a34906ff4318

      SHA256

      ec191ecc2e71f3f7e27328d47c27541c499a0e9722db1931a88aac9b39cbcb26

      SHA512

      69969bf646730ff9364c45d1bad782a2eaa07e23c8349d33e1f026710a2fa458fa74c466322676886b4bc0cc68692313985a5f6e4b610c5f3dea39ff1433de8e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      3KB

      MD5

      5cf715a0f90ec57af93085ad61d45aa1

      SHA1

      d14f5d9a28fb3d9f213e10718610073083207ca0

      SHA256

      dda6c427383e2097ce8c722b0fe08d203571d4c6e7aee3ca6aa06e106a3f8927

      SHA512

      394257ff3e365b8249cdfc6adc11daba7b6bbf368cbb3690314284140b594a54bf5a93e40dfef8df588a91ac0d314abc4c62a3a879ce0d3d39ee56d96b502bf1

      Download Submit
    • C:\Windows\SysWOW64\jezvxnqvpeqge.exe
      Filesize

      512KB

      MD5

      fbb58d53550b3ff36d2fa94570b216d2

      SHA1

      2882bf298f4ad9eada45542dec46660aa3a919dc

      SHA256

      336e5c6a979f1fa5be0e519456e0405ad875f6bfd1a4f5bbedb3d06d4e5b5dd2

      SHA512

      78f1f625f07a08035a85f7e2c6832494ccbea2a2cf88149319527a0a09927772611e6f01cd51b47f34c532c54374cdbc18e4777698f96b18a21ed3403175753a

      Download Submit
    • C:\Windows\SysWOW64\llpjstmfgz.exe
      Filesize

      512KB

      MD5

      1bf48aa8702164b79f3d689d412640c1

      SHA1

      e3d23b51715044000f37651e937e82a7b4ac7999

      SHA256

      452d0395d742e1c39899c4e72b6b7ee80875e40116436043aacd878e86a8df15

      SHA512

      96cc2da372060e3e589e95bd2b0c41ed757a0977c82455339cbec8ea64567541b2d31422968c166a35710aa4064ab6c37561ea3d89ff37ada8e6b058850e82e7

      Download Submit
    • C:\Windows\SysWOW64\qgveeavc.exe
      Filesize

      512KB

      MD5

      71d6694e5f31d66e17009e09d8bc42d8

      SHA1

      5cd912c6beca1d728f4bb23729575a7ae4d17014

      SHA256

      d6f6a7cd945f6940777b66d3541ce7dccbdde145b83e8800c9ba5d303032d2e7

      SHA512

      9751e754c5210d19d3dc5d905762d0e7d8b2bdc5ac414bd3ace5b81e9d774cd5568ff2aded2f36eae12af73e600ffc00fcb5e780e27284569ba40dfec110ca84

      Download Submit
    • C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe
      Filesize

      512KB

      MD5

      5b61bdec205298724545ffbc08a78a55

      SHA1

      e26e5d11a5d29e847ddc3b05f0369c1f500ab4ce

      SHA256

      1175cdfc1201b90589c1b4b59e4afb8b69a279641380c19c0998ba98af5205aa

      SHA512

      a8c5a0b963bb93ba7d737dd089d45ac0c20f9e89c5faa11969fef01cb1a3b992ddcdabbe21731937f1804d0d4a91473f889a2b5ece7d14a57db3013d658a96bd

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      585744343b73263d0f072991247b2d3c

      SHA1

      fc7469c7ff2f81e542f96201655ceaae8b1ae877

      SHA256

      c18a00c6136375580076106091f3a843d74ce85a84a617e27fb13eb7b79d3b90

      SHA512

      1052c55bb36e9fa869a160a16160e970cc9082fff24c7a7f683e42329283215b8c70cfceb55718509c932dcea17b786ce2b7582708497903e99e789b07490465

      Download Submit
    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      6ced8f8421f0e759f7c978913e1bb6df

      SHA1

      13a3f998079bedbb9692d55a8bdb9478462efe3e

      SHA256

      765da6e22c0296f52aa2508f715b6db5b438006f558cd495d2a1293b89040253

      SHA512

      3ffb7e2282e5916b031a8c06a11a936cc72badc9c6ad82c8484a59a678b90cb529931503fabcd1bf51dc8fe82ef543a99e7f35ac34ee831688f3008138c1ae5d

      Download Submit
    • memory/1964-0-0x0000000000400000-0x0000000000496000-memory.dmp
      Filesize

      600KB

      Download
    • memory/4912-40-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-125-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-42-0x00007FF964470000-0x00007FF964480000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-41-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-38-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-39-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-37-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-124-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-127-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-126-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4912-53-0x00007FF964470000-0x00007FF964480000-memory.dmp
      Filesize

      64KB

      Download