Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 00:18

General

  • Target

    a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    a31ae939fbb3885501f82d470b4b0af6

  • SHA1

    66ed8b4892099e6ecd74d1fe39d2f932416acbcf

  • SHA256

    568fefad3e99375d017c336a480cc00557e4d3755f89fcfb9c16beaf1b9646c1

  • SHA512

    0e3fac08170a29e415e895b4d63822edcfcd068d9b4b007cbd63e1b3f51431e0a3da18c1f43e6c43627af0100db0af69ff4bf85541cfbad6b58905c3f0171d0c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\SysWOW64\hurbgvbskn.exe
      hurbgvbskn.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\lzgefytm.exe
        C:\Windows\system32\lzgefytm.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2800
    • C:\Windows\SysWOW64\nkfiemipocjuoaz.exe
      nkfiemipocjuoaz.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2324
    • C:\Windows\SysWOW64\lzgefytm.exe
      lzgefytm.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2680
    • C:\Windows\SysWOW64\fpnlrwnflqarm.exe
      fpnlrwnflqarm.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1660
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:268
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1932

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      512KB

      MD5

      fea1759098942dd357c9bdb23f39f6b3

      SHA1

      e59f307ac11e588a4a9ce7d85772165d25b4d5a8

      SHA256

      db2c90cb33c4456e9e4712a31521b4c6543553eec7c7993fbfda3cdde183f2f5

      SHA512

      f7e22d737b5e3134b0fe67abbbe3778723191d78646ff8b3a782a8c7cc325be6debe3616f1255c7c08bc4df846b513df4d5f16a3396138353aa1990108c77a0d

    • C:\Program Files\HideApprove.doc.exe

      Filesize

      512KB

      MD5

      a523fa3485539b6c72e7d2581d70117c

      SHA1

      c3610558f4fb869eb48cc74635fbbe1169e4cf0d

      SHA256

      1a12a97d0356443302bcb7717a76c26752c1f0a2cdca164b29e279801b8e7c74

      SHA512

      5101051f427ef9965cee653e72af5f3f501b1d6aa739060d54181c79b4e736aac656369397aa18f5c42cdebed352064e752202c18a118b4d9fe79bfe6ebd2c94

    • C:\Windows\SysWOW64\fpnlrwnflqarm.exe

      Filesize

      512KB

      MD5

      0a9ef6de038ddccb847b7c3962fc8232

      SHA1

      bea03e3b0760c76134a7b59f1d2b4dc2cef6350f

      SHA256

      4a113d245956b3a329ce50ec269f3003d7dcf7d4752faea9430bb2f196bba1a3

      SHA512

      93652c9194edb897c0e9e832bcee8c347b5b4473736c0f2936021130d5c528cd1f9932060f48012fdf3cd526de594a3405f9e9d0308d9e03eb66152c53816ca7

    • C:\Windows\SysWOW64\lzgefytm.exe

      Filesize

      512KB

      MD5

      4ffb2f93f1ee413322931b514fd9b1ed

      SHA1

      136dfac17e4002d4cdd2c32027b6b93d40535532

      SHA256

      616491b8911036846786b1076fe3cd0285605f69cd437ffdf9fa539d5848757d

      SHA512

      9372fe102ffe7656403e993753b86dc9140fe0730c0e6741e082f883f11a895c323bada9f1beabb5722478886dec558ee25e4bf5c0dea239b9549f7ed207c906

    • C:\Windows\SysWOW64\nkfiemipocjuoaz.exe

      Filesize

      512KB

      MD5

      8f0e3e9c4dec649398272270789d0b37

      SHA1

      b1423247b67c412c8319c0db476e9ce62d46f359

      SHA256

      b15e442aa9d1b796b4059deea663d0b718eb7e3770a3d89116521209041a3cdd

      SHA512

      30f76345201a264279939041b3240953bec380a33bad664606c4ec37a8408c120dad3936c3ccb8335c89c93b056987ef84b2295993de7424c3737af6e3bc6384

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\hurbgvbskn.exe

      Filesize

      512KB

      MD5

      b13ba9a7052291bb75c0749733ffac78

      SHA1

      48893a60a5962f7d940f47159093e8344ad3d64e

      SHA256

      7b88fa9a83bfbd0950926138d9da23c29f5cb50cb98776830b700b862dc02e99

      SHA512

      e4c27b8f624c3c3cdc749a93340ce3a15a009c03a8f7ef0d2675b3907b1be13e6dce4af3202222077a3adfb3e38f2c7555253a115cc2aabea650b70971b613d9

    • memory/1932-85-0x0000000003BE0000-0x0000000003BF0000-memory.dmp

      Filesize

      64KB

    • memory/2552-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

    • memory/2640-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB