Overview

overview

10

Static

static

5

b1c930f3d3...18.exe

windows7-x64

10

b1c930f3d3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 04:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b1c930f3d3de829aa3fc6722b3958be4_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    b1c930f3d3de829aa3fc6722b3958be4

  • SHA1

    f4586ac7c27a218897c456adb2655bcfd03bee10

  • SHA256

    8a9993db363a7821833bc7019fca650cf89e0be75190713d39b114afc3a3c3aa

  • SHA512

    fa95a8f92c78ff0caee06b39058388245141bcb3021c051cf312df02b370ca87a8a122cb174d4d98d73e3b3512410234654cc8d35a6f82f5874d42ce11745a98

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1c930f3d3de829aa3fc6722b3958be4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b1c930f3d3de829aa3fc6722b3958be4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3784
    • C:\Windows\SysWOW64\cleranqzdy.exe
      cleranqzdy.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\SysWOW64\uufrqrhp.exe
        C:\Windows\system32\uufrqrhp.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3944
    • C:\Windows\SysWOW64\psqdwcfzgjgqclg.exe
      psqdwcfzgjgqclg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2436
    • C:\Windows\SysWOW64\uufrqrhp.exe
      uufrqrhp.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4404
    • C:\Windows\SysWOW64\szauayakbrcox.exe
      szauayakbrcox.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2120
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    5f94ccf8ea120c5e233ac4464c59a5cd

    SHA1

    747aa780c864691cf23321e73bbfa407b320688e

    SHA256

    faa5338045b17b81e2698d740ad7dc8c88d707ae3ebf33bf5d1cb7fe45ef38ea

    SHA512

    b5fbfffa7976261b5456dc875cdca9bf0a7e5e750e9c48b6e81404b54907dcaea8b99f0e848ad11104dab646ccb64a180ce7e4e0189d9eed303e192ca0ca19f5

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    271cbb02194c569259316317de44b363

    SHA1

    366ca527f6c9282e65cebdcf067ba3fdadf5d12a

    SHA256

    d200d0d5404494658e8f32646a623aea540f5da20207fd2b8c5304be25a9737e

    SHA512

    4e51ebb7467b518a44caf082efa21a666c7c62d63c7a50221ce036bee4f89f38e32827fc8731b47b165823ade459fe6d8705d8aee82abad9a37f0af10530e3b6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    d030e817e78f11e6538b9a51812f01ec

    SHA1

    1806d2f4a51961ff1528d7318982a7ad3c3a44cf

    SHA256

    88774fdd11b11f0bb7f3ddb3c3de97587f8bbc8411ee4f46fbadcf51863d1414

    SHA512

    cab5602dcd3a006525634b4f2cd6fbd805b6d24dbbd9550666eac8f28199068fd1146c6dc271f7c60c4df02bacc105cddfbd009cecc7b7cad98955107fa441a9

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    b009a0bdaee876b42418b45f2f45b712

    SHA1

    34107127b2d96a1ce923cb4df126ec47c74ce8d6

    SHA256

    d165d15d514dce84c62ccd35e9d9a7d546c5247c47ab4149fa1596b64e80b5c5

    SHA512

    fd0ba2978bca2bc168555fd56842bc9dba9c8223256f6b2c506403692e8d354a8b0904dc84855a9c11241d4f319e5cfcdb6c9ba3d69e82ac38cc82a3b8c94141

    Download Submit

  • C:\Users\Admin\Desktop\MoveInitialize.doc.exe
    Filesize

    512KB

    MD5

    c31e31930a118b38d68a7f49062f52a9

    SHA1

    20563f284ceadff89222958eecc81a28fca89484

    SHA256

    2cf2a674974b8de6540891f5b9887e37564a2e862b7a9e331a1ec1430ed110f2

    SHA512

    26e852a0d8c251761e36dd770770ae1aa06304016f6915831915d120bef693923c7f91667d74425fdf9c313eaba4a9b91c0253bcb2919e9d5f518d3e40a7ddaa

    Download Submit

  • C:\Windows\SysWOW64\cleranqzdy.exe
    Filesize

    512KB

    MD5

    06a2495a3720aeb1243e80f7d09ba4db

    SHA1

    a2bc31461ab425495fa753cf0f56650725f279a7

    SHA256

    b3f2e5c403c6d745ecc9d8cfa967cbb39ee0aa4ee981421a8ead067fb2b8ef21

    SHA512

    d9b40fd6970c40616e8dc1735770bab7ae902e237c3f2175420db8c94d4a56765578b98f4cbb7a6e4b53e99e58491d7eb2be5c2d5fedbb7d87cbd33faa2ab4de

    Download Submit

  • C:\Windows\SysWOW64\psqdwcfzgjgqclg.exe
    Filesize

    512KB

    MD5

    36bd88ce6ffa7a41e0a0962bd8aa247f

    SHA1

    3a168e03f7fe0fe548b0c44348d52cb05ebb7d77

    SHA256

    0c8fcead779825ca03b627f9cc62a4e9dad2e4d35fbbcd3b042b2010343ff1ed

    SHA512

    adaf2a796c4a473c6bd0132183bae20d15ee7f799ffbfddb42b256dcb84ac0754066263a2f24acb3f83086efb2916265aa51395099f7b455bd248299159d7170

    Download Submit

  • C:\Windows\SysWOW64\szauayakbrcox.exe
    Filesize

    512KB

    MD5

    dd817c04dc62a5ff24f08f472eeff1e0

    SHA1

    e50a3fcf510241402b192514bca8aa3f5de9bfdc

    SHA256

    4f15535e05dc131b9899ca3b4cb486dd515b5deaf17009b1db52368a7dcbfe3b

    SHA512

    e6023fc54474f706b088d69ff665af36ae2badcde318b00395e2b6a122ffffdcf917f183883d71eeb6ab72477a1b7cba814ccb141699b67f425eaaf93c632093

    Download Submit

  • C:\Windows\SysWOW64\uufrqrhp.exe
    Filesize

    512KB

    MD5

    cb3bfaacc50e1159bc345f5016ec8974

    SHA1

    c34d2920cac0c9acf074062752211f73254b8276

    SHA256

    bea6bcf25b6ee8b0272e14e162167edd9e763e593af404f818e27ca2b1a37d6c

    SHA512

    3ce16daa4599fbeca86f31044b1dc0c09fed4f9248c9ed260e65adecf3e37ea8ea0925487416fa1352245c346ee52ab8701e8f8bf9ea29a0394a35e9ed8f4f73

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    b0fb8cafb1cba474f0abdece4fe8f055

    SHA1

    199f5d16ad3db7aa29dbead32e0ed76348b137fe

    SHA256

    ce0621b771ea940e82e560ef811402ac36d6b124dba21273ad743f709c8cd9dd

    SHA512

    7fed6b1eee16cc3c17f668a4bcbe0c98a094b3e0746318259d3aa055f0269b246681ae988da0b498a613bf553edf04e97784bdaccadc232f993cb38b0c6056e4

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    18a84f098f1030bee3041ec4a01e61d4

    SHA1

    8903b85c4ae05d51e7dd49148d828d8e5ba8046a

    SHA256

    7cd7b5be453f95fdd6653972d1f6e34059593f51881858fa16bc8ab54fd8ef9d

    SHA512

    0cf4b97d2706f550c999da582c22eca34db4f7e772c02ad8dd558ec527242f49c4d45bc31c5920d502af8cb6315aac9f3f3fb85621870310563a58500a6b15e7

    Download Submit

  • memory/2376-36-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-35-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-39-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-38-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-37-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-43-0x00007FFAD83C0000-0x00007FFAD83D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-42-0x00007FFAD83C0000-0x00007FFAD83D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-118-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-119-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-120-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-117-0x00007FFADAC10000-0x00007FFADAC20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3784-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download