Overview

overview

10

Static

static

5

ac980b2d99...18.exe

windows7-x64

10

ac980b2d99...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 02:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ac980b2d9943e383abf53c7bef7e6eba_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    ac980b2d9943e383abf53c7bef7e6eba

  • SHA1

    fff7782aa5f0e3ef2a3d70c10ae5cc32e2cdb1f3

  • SHA256

    4f8663950ea322abf6873f962abf201a2240d9c300d92a4a55a8e59825798ce1

  • SHA512

    9f5229d974479e4d69fceee3967e7a3cf837f5af20060dabc2d21fcb12979404c4cbed35e31e5f56ab42c2f95b1d069f6e67050355a6d4b096666c0b7f0b36b0

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac980b2d9943e383abf53c7bef7e6eba_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ac980b2d9943e383abf53c7bef7e6eba_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Windows\SysWOW64\mswmtqblnx.exe
      mswmtqblnx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\SysWOW64\qmjjkqki.exe
        C:\Windows\system32\qmjjkqki.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4704
    • C:\Windows\SysWOW64\kwtghsiefdhorpt.exe
      kwtghsiefdhorpt.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4760
    • C:\Windows\SysWOW64\qmjjkqki.exe
      qmjjkqki.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2884
    • C:\Windows\SysWOW64\pfnmrmofsoiys.exe
      pfnmrmofsoiys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2808
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4268

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          dc0a314b1377ed5c6a556e3b804080b4

          SHA1

          d387847cbff2cc31e602f1d89a59818546f9b1fc

          SHA256

          c0eedc2fc9be8e3c188856f47f5256883318a56d893a76fa72dd781fabeb149d

          SHA512

          afedcbd5ac6efb827488a0eba838668a6e851c8d9b42f121f0640c276e54f40450259d2d69b88a17cd9bb2aadcd54a95e89729b1faeb8cd0aa9be3b78b760423

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          52c68363088a5abfb0cffdca82b76ed5

          SHA1

          d33785760d717601d80a39ad12ef60673349c722

          SHA256

          91889a102231259bbf52e6a64324f84df60e7f8dd578f256eacb388d5baacaf3

          SHA512

          71173e8633c54e80b1e44fd6a88ff07a07432a84f26df24fddb71179c01a1885104b6f254a2db5a3351900fb1deb1d5fb88b22eab8f09f5a6ead633b58136b4f

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          Filesize

          239B

          MD5

          361ba5cdfe246f4303b0a1638e0daf43

          SHA1

          eced7199b1af3c8e92209a68cb9a925ff3f369a3

          SHA256

          507143acb38e64408d03a0dd98e16bd34ca557294c466ae8ec9c7c763eb3a2a5

          SHA512

          81b9d124396d138717aea4dc71cec59426a3b65b47eaa0d13523adf030c5e3df9fa670ed48f7634d0301812d4b546dd43bc5bf863b58112570a2ab049bc7ab54

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          3KB

          MD5

          718b342bb45b390bf3002234c6a678a1

          SHA1

          0e8c30cb2edc730d9452f3b7659578840fc61722

          SHA256

          4b59d4b28360a9164187ad9d4f8b7359ad891aa37f0deff6484526b34b8b968f

          SHA512

          0b76fa3c7f87b9791fbc691f35a476951531e8dd3447fc1dff16a4fa31e2d7be355b6b5b2da322456e8a10fb6a2c4d0bcbb26004c521610b4feeff68b140eada

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          3KB

          MD5

          a0828dcd63d6ec6cc479595f5dcfa6a6

          SHA1

          c52d03c6ccf318bab5bc35072140235bdb23de93

          SHA256

          bf720a77ce828b06562c2e5872463119d7552a6cb02ea62a9355b25f49663c72

          SHA512

          7a7139bfb5865561482cdb392f0f700c36f8e66c8d117f12cc363cb2361d1213d05671165ef4609c5a09bb8f0e66c1db640f639a6477cf7b4477cfbaeb2ea775

          Download Submit

        • C:\Windows\SysWOW64\kwtghsiefdhorpt.exe
          Filesize

          512KB

          MD5

          6389ff4af24cba064e87b1261bc39a3d

          SHA1

          0e9c1dccddf01b40dda0aa53601bef583625b4e8

          SHA256

          d6693a00872514c39689d954c2069e14048ad2d46073bec502809383725eb1c3

          SHA512

          5165fd48010185c90ad98b8de7e1a290e1ee0fa127d6fe9f7385b2f6edb63ab8972e93eeee1d35603de7a17a682cfe4ee61e4e58f028a1fbf0a417ec6eea3521

          Download Submit

        • C:\Windows\SysWOW64\mswmtqblnx.exe
          Filesize

          512KB

          MD5

          8611bc5dbf5ce2c9f87e3c05796b7ce4

          SHA1

          245fb1eea69b0e9eefd4eb677437e7a3c8374886

          SHA256

          d8aa703bce4b90b482684c84675437277bce37a1d14f1b51e0a06035e57ed796

          SHA512

          4aac112f4f96bd690c619192e68a501506e408711d30ece14a64a3397177990df7882a0ba7e24d068faa794fd2fdc6189cfbe730e89d758536d952bfc9495678

          Download Submit

        • C:\Windows\SysWOW64\pfnmrmofsoiys.exe
          Filesize

          512KB

          MD5

          5a30dcd7e7cdb4bc4c33e9ab47d58a25

          SHA1

          3e93f3a9f69d20f1e39d0129e0bb532493d07624

          SHA256

          3d11395782912fc70ad384d4d3aeec62ff5443195623c7467833c4a0c68c4450

          SHA512

          bdb98e365415f96dd2ca6482db146a5842c23088c7d9ee9e9a3a37fd2ae3b8b06e290486a0058bc11e1deb908935749d409b623a848e818c38e05145d11c79ea

          Download Submit

        • C:\Windows\SysWOW64\qmjjkqki.exe
          Filesize

          512KB

          MD5

          93b647ea23e6c8161aa1454a32c4f0ba

          SHA1

          bb0b71cf32a73b742fbb1f48c4e9d1c47ba53690

          SHA256

          7b06614bb12b2a3d6acd7ea040c4dd4d27f76c88bc834fb290a754b7f5b007bb

          SHA512

          4452ce0265b47cb7fc2270689a2712aad06bab3dc0fc58c6cfd7e46b2c098e89cb3957285caa7cf8003ef258e884ac42011fea97e8156193b967fff3ba0eb3a2

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          d4a368ade1d17c367d4efa4f97b1cbef

          SHA1

          bb732793f9dbccfc8997c627fe8608fcd486a4e9

          SHA256

          50d6f462989829d51eb187c6fb7d5bd6802d58612618588ff72f6d63c5f104d9

          SHA512

          e27cd604469ab4774f4277938338374401503590127d08c5d7c83d5ea8d779fb04946267328acafeb9541575065583ae503f5ebb37fe17ad2384f4694875afb5

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          c2406bc6b3d4ca12bedebeb19f19d92f

          SHA1

          2253176aa1c97e6862c7998ecf4f627528f1235d

          SHA256

          fc5d97168cc116febdadffb68dc3a53ab893407c93d31eea0bb93401bf81595d

          SHA512

          bf671fa111edf7046d4b4e72c6bbf7a357e5362bbf232b6e473a8d84a30b8cdc3382dfe00931ea116ce593cb2ab1fcee64b46e86813c3fdcc0aa2220ef648f99

          Download Submit

        • memory/4268-37-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-40-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-41-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-38-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-39-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-43-0x00007FFE5C8F0000-0x00007FFE5C900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-42-0x00007FFE5C8F0000-0x00007FFE5C900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-110-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-111-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-109-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4268-112-0x00007FFE5EED0000-0x00007FFE5EEE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/5084-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download