Overview

overview

10

Static

static

5

b2e1db0136...18.exe

windows7-x64

10

b2e1db0136...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 09:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2e1db013678c51310ed9b586acb8699_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    b2e1db013678c51310ed9b586acb8699

  • SHA1

    b83b1c31034f829474b073bec1818a5d4afb18cd

  • SHA256

    2067e8ef3a46dd711c231372b35bc2775b870012777c37544e62d6fc6ef8d115

  • SHA512

    f79c3c2c2994638011e71cd55a80f85ef4570d5dccb1b6321779cb0e6f4ad662bae498c85ccdb8136b6aaf8a9ca445cfb9482df6f13f839bf1ee86b94d3968b3

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2e1db013678c51310ed9b586acb8699_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b2e1db013678c51310ed9b586acb8699_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\ksekaagibg.exe
      ksekaagibg.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\SysWOW64\zcantemt.exe
        C:\Windows\system32\zcantemt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2484
    • C:\Windows\SysWOW64\wewajirzxdaraya.exe
      wewajirzxdaraya.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2676
    • C:\Windows\SysWOW64\zcantemt.exe
      zcantemt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2568
    • C:\Windows\SysWOW64\qhytpolixjywi.exe
      qhytpolixjywi.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2468
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2464
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    8a8d5c14d579599aab21f1df1fcd571b

    SHA1

    9678ff64aba7fb39d0968656ff369f8df6b17032

    SHA256

    f6b8f2b56828e2fa1318c65b069ffd5eed27be193dec43c6e61999604e2d5497

    SHA512

    75c1d919e4bda8560e4b24a683ad040e8791eef207a511fe987d891860aa1e463c6c5e60a89d4d4f88a83eb7cf86f6c01ff4bafefac1476bd1cf6dbc5bae2dfc

    Download Submit

  • C:\Windows\SysWOW64\wewajirzxdaraya.exe
    Filesize

    512KB

    MD5

    4632d5ba9d6600a18984986835017c18

    SHA1

    8a4b453d9501fed6aab25186c18af0520f5000fd

    SHA256

    b277dec853f6e5ebbb0658eb8d4692b5995cc603d5533435e121a2f6345335d1

    SHA512

    74f67f0393466cb0a5b1e844badcdd0cb5c4e3a956f0aea30764bbbe95678556b6d077a27a77d1cb179966e0f4ac61294542f51bb3dcd33e47b4c57b746a1b28

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    9ac4d8d413b3c5d83093beb029570320

    SHA1

    7685c5e24b2822e997e163f45f89d8e2d8c4e424

    SHA256

    7e1adad319e13a87f8c148512ceb1755b5643a7a5ab56974695537d7dc5749f2

    SHA512

    231f55d68839177f0dc7270c4e65bf4b6b93d6f2f08eab01965a962535f6ace721d5181ac97f1667acc393373b7a744aa44b54c60e827976918085c85de613ba

    Download Submit

  • \Windows\SysWOW64\ksekaagibg.exe
    Filesize

    512KB

    MD5

    88f9b24a1417034bc16bd279afb4dbc4

    SHA1

    7335aa7c420984054f6173d6493fad52832df3cb

    SHA256

    759f44251d8fe15124a00d3c324710c3ccadce6607a2f3078783334d9e06b701

    SHA512

    8509af5e86a45caabc0ac91cc0e9188295fdefb949c96a3afe82c7b8723fae581cbdc77f3b7edd9df2ccec64afe5f63bc3a2352a7f461477287d6db7ed08b34b

    Download Submit

  • \Windows\SysWOW64\qhytpolixjywi.exe
    Filesize

    512KB

    MD5

    86b5693e61a2222fd7fb1f558fcd83e1

    SHA1

    e4a53706e49718b01e4bd74ff1771e9cea060242

    SHA256

    934737334895613a0518b6d13711cb1e60d852027c5e3036b262604bdf02376e

    SHA512

    6088aa21c364f731df647704b5a53629e172a7b9b369b9d0c9e239f241a587adbf8b3a9bed12bc945993778921b3240b3fc534929f7648024f10c26c5127a2ee

    Download Submit

  • \Windows\SysWOW64\zcantemt.exe
    Filesize

    512KB

    MD5

    ffee545536932ba6159441a53fe5d72c

    SHA1

    d47d4bbb310143bccc8a1a5957a5acedae43870e

    SHA256

    fa39f80ed8c08776d57b88e0d00ffefbb987dfa638ca0f5296c82f2a9113d47c

    SHA512

    736c13abd7f67b984d4f81b08dcb7963227fb06ce8c2bf2eab30c242a28bd98085f303262e82ffad62834699e33c72672813c9a3d4b6736aa9757ea832231ef8

    Download Submit

  • memory/2412-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2424-81-0x0000000003C70000-0x0000000003C80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2464-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download