Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 00:13

General

  • Target

    a316ee6c5b7ee445db9eebf286dcce12_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    a316ee6c5b7ee445db9eebf286dcce12

  • SHA1

    943296eacac5edab76e4cc05174d5c6a07356d5f

  • SHA256

    b07a2af3717c3e3f1b48ccd756fb359f0be8d87b442fe8fb959fb3a7c8b0eafb

  • SHA512

    8a23918d615f25c504bbeca5d0697a1bb440f8dec1aac8f9f99351ad691c497f200130833953e68afad21ab802c8ee4ace25061b4f13d76c8cb5d47b3c3468a7

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a316ee6c5b7ee445db9eebf286dcce12_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a316ee6c5b7ee445db9eebf286dcce12_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Windows\SysWOW64\dqhgqrtigt.exe
      dqhgqrtigt.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Windows\SysWOW64\ttgjiqtx.exe
        C:\Windows\system32\ttgjiqtx.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3724
    • C:\Windows\SysWOW64\mscypqqcbfudgjr.exe
      mscypqqcbfudgjr.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4628
    • C:\Windows\SysWOW64\ttgjiqtx.exe
      ttgjiqtx.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4136
    • C:\Windows\SysWOW64\jxhjjeukpluuk.exe
      jxhjjeukpluuk.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    a014406ba60abf244008388890b82b14

    SHA1

    ffcd3c4dd1e48309d7442b89a9e031061e23d4e0

    SHA256

    bfa7835153419df2d4b9a352b06321402919dea7607bd1ac6e9f08d9afce85af

    SHA512

    86075ce55d861e33fa365db436ea6383ae34ef73ce86bb046e87ae95af7ef16c9b9bd467c5761cdfeab108f6a85c4fa07ea88844369c2057ea47eecea5b36d49

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    cfd6e8bd36033b1981aae1ba3908d980

    SHA1

    b50b1b272bbd367deae5a6c81ee9d04e1fc0e0c0

    SHA256

    88d7b29398d48e256df6ac99f5977e170c699347e662e564f9b8deb897051273

    SHA512

    e5b8129e2c85cdab4bee9588f1912d63d6bdc870950d4aa383638deafe6000565a3566d51b4589de902cdcb7407770689956b89fb7d3c8a44cc2ff61df122302

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    07b5bbb35fc9a59f4010ddcd22d62b25

    SHA1

    1e6731b9fd5b658c76a0965fac36cbbc3d7fea6e

    SHA256

    eb78c53a400cebf2a25575cad31553aa120cb615fe5b149ec6858128693fc2ff

    SHA512

    b1c28209bcfaec2e9e300138e286cde1fa38410cf96647129c01ac963004f9121ba0d3667e640f27056cc7253b1e04c937f7c9b6cfa9707341cbe10578db03d7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    a8bcc0c2262122625ac519ff7794d757

    SHA1

    d73a69a517afb47b184c8477de84c18f03a05943

    SHA256

    b66bc44f8a6ef0ec0e5185a0025253e26e8429e9d3aab8c4353e7afac2a7193f

    SHA512

    f7340c3550ed903c269461aec06508ab41f1c599c54af8216500847be9d4dd2f953afea7da93e210a572c74d5aa6e92a402bc21e1189953bafdca80ff2186f65

  • C:\Users\Admin\Documents\PushSend.doc.exe

    Filesize

    512KB

    MD5

    ad9195ff9a1abace0c1397999840e27f

    SHA1

    f7547af19c7e890aab66231c90ab6ee6bf9dcce4

    SHA256

    ac2e2a3fa12bdaacfbbdba4aacef990d316a42f00f699a67c785245d2ae7735a

    SHA512

    a3e2d6f7ecdb11a12e9ebb0db5d426f1320cd703b980b32a78ba288d20d5b04b6cf6b76674cfbbd897874ef76eacddae6371f3a5dfcdbab36e28a77d4467cc11

  • C:\Users\Admin\Downloads\ExitUnblock.doc.exe

    Filesize

    512KB

    MD5

    67c99bc2a50b4d3a0f675f5cf6079e3e

    SHA1

    62ba0290a919e944dceb84572af9996794664b1c

    SHA256

    23e8e6809a68cbaf7e6552ac0ffd332d258d0d790afe7b5605d4ec9ae21c0025

    SHA512

    338b146728ecf8e410715561588d159da8ea5723bacdeb634244de86b3ff219b3b3e1a510cba62e0687441bb1e9acb726f4093ecc3f3078281372db99deabe1b

  • C:\Windows\SysWOW64\dqhgqrtigt.exe

    Filesize

    512KB

    MD5

    fae5dcfb5ffbfa3e0273a2fe77b1d974

    SHA1

    8426c0e63913c1bdd02601bd204836b7d15803cc

    SHA256

    76471766d8e8d06e2875dc8701a9871031ebba2c8ece68c4cafd0881fc4fdc9d

    SHA512

    bea32f5cdbe8cd4ec12b12d4377dcd0e9041bc077b61062f209b6276563915bd52549a085fb02d1b00217001cafb41d824bee0236e60e4b0221cb47f03592132

  • C:\Windows\SysWOW64\jxhjjeukpluuk.exe

    Filesize

    512KB

    MD5

    7f965c1858ceb428b6b3eb411801f930

    SHA1

    ce5246889f49592d4e68e15f21ae70ad1559ea9b

    SHA256

    73f575014a2bc595b25677e72a907730d062cedb542f666c1ca70fc75c60025a

    SHA512

    b8a555cfd38f29c53430810909170b8b76297c765ec1c02dd687942a329b0f1095639801663033649765b0b2211b8a15f58de7550a038e139af03e24d2ac4ab4

  • C:\Windows\SysWOW64\mscypqqcbfudgjr.exe

    Filesize

    512KB

    MD5

    4f6980ac02bb1f381806cd34ef9b84d9

    SHA1

    82e76a120c8ebc6aa55a55b4c87928f03a5bd15c

    SHA256

    f17eacd133187c42a806a7c8d8e430d8dec7082fb041de2dc2a5969cc5e3b67d

    SHA512

    73512ff691d39c3cf82b340e6c09285ccc4f2dcde791cfe478c1bb3cd0abc48bcdd3e1342969faa8f643cd7b06df0b1f939fb8246b0a612fef17e5b5c29cfa5e

  • C:\Windows\SysWOW64\ttgjiqtx.exe

    Filesize

    512KB

    MD5

    57642a5b6a10c51d3ed0635813397cb7

    SHA1

    c9fd2fc3657f2df1282b9b248fd883b462d1c49f

    SHA256

    712b15ba88b7205546b38adce3b1f8fc9e30a23ea97a55f26126b2fd57fb2c0e

    SHA512

    36b8b3ef4bbe623e5ee543835713001935514edd1a9a5318a30f86090e9245252f3ce366f8658a1416232503b479b8623bbdb484faca6d5f15f954ced794b0f1

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    b460fb95f89d072e6204d148a3bfafbf

    SHA1

    0281611dab2bd6a8178a94c899fa1270797c4ddd

    SHA256

    a41b8755056e9f72a6b88670789fdf16caefdfbd0736a38f8c8ad4c31472d1ac

    SHA512

    bb80b7cc783a21ce91ff1920e7c4960fb8853bf52c154a58bf6ef2b330af1f290198fe61a5d1b2ae64c4fc91b1252999c23096f39c3afe6c51cefb809b58fc87

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    d0237edd592ddfa472a474ab30ea9a79

    SHA1

    6493e2411c338f0a3f2733028a270a33b8e94bdf

    SHA256

    cf6d8b9e3c2754635dcfb18bce0d1acce699d7284ea2cb7af90e059cfc959322

    SHA512

    8e0783b43d9476aa6f80babf751bc0c509c8d26cc13d179b9d4414a330447c60e5c2fa604a10dd32bf927bf09fe47090bb7f9ee354fdd8bf85ca5dee6f3987a2

  • memory/1076-39-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-38-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-36-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-37-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-35-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-40-0x00007FFF587D0000-0x00007FFF587E0000-memory.dmp

    Filesize

    64KB

  • memory/1076-43-0x00007FFF587D0000-0x00007FFF587E0000-memory.dmp

    Filesize

    64KB

  • memory/1076-121-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-122-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-120-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/1076-123-0x00007FFF5ABF0000-0x00007FFF5AC00000-memory.dmp

    Filesize

    64KB

  • memory/3404-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB