Overview

overview

10

Static

static

5

b2e1db0136...18.exe

windows7-x64

10

b2e1db0136...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 09:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2e1db013678c51310ed9b586acb8699_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    b2e1db013678c51310ed9b586acb8699

  • SHA1

    b83b1c31034f829474b073bec1818a5d4afb18cd

  • SHA256

    2067e8ef3a46dd711c231372b35bc2775b870012777c37544e62d6fc6ef8d115

  • SHA512

    f79c3c2c2994638011e71cd55a80f85ef4570d5dccb1b6321779cb0e6f4ad662bae498c85ccdb8136b6aaf8a9ca445cfb9482df6f13f839bf1ee86b94d3968b3

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2e1db013678c51310ed9b586acb8699_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b2e1db013678c51310ed9b586acb8699_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\SysWOW64\mvjrjwaemo.exe
      mvjrjwaemo.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Windows\SysWOW64\yhcsjwko.exe
        C:\Windows\system32\yhcsjwko.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1908
    • C:\Windows\SysWOW64\jyoorjhqcecimsw.exe
      jyoorjhqcecimsw.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2384
    • C:\Windows\SysWOW64\yhcsjwko.exe
      yhcsjwko.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3976
    • C:\Windows\SysWOW64\zzziuahrtbfcb.exe
      zzziuahrtbfcb.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:440
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2452
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1304,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
    1⤵
      PID:632

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\LockRequest.doc.exe
      Filesize

      512KB

      MD5

      272e69424de2bc9a0f46553297c49f65

      SHA1

      c945f07a791ffad5ac39bc3301c0ce594d4eba52

      SHA256

      d389fa448c29f8fbaf63db8d9e60f6f8a4de3a33ec666a13bbf9427a443f344d

      SHA512

      068609dd35593aaaa6b9505cd21ecd41112c7bc5024c626d15c5961bac1c9bf848e6a3b68ec43e37f37b71c3d499348e0cc5d63a58d3439bac58d59214af7152

      Download Submit

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      5b2e7638dbcf4aa6f68057b155c2fd0e

      SHA1

      d49fd3bf60168eeff058ee9e1981bfbe995f2201

      SHA256

      8f5f77453688bb3fa19b62288ac3a97ed47cf97a03909046596e5311d882d162

      SHA512

      87c0823b8cd570fde0da4cb640831d1c71cd303de16ada39cd7a84aff3ddfdbd2357aa2b93bb9158d073af47ee72147e15397cc40544484ff8be3e6a5ce24052

      Download Submit

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      b3ba17efe44add3ab180da2a44f89300

      SHA1

      895a79febd8d137ea0d63e77071ce60d6dcbe6ae

      SHA256

      2943e01eb529b81c8f1bdf8ac9c32595aaff7d50a97794426a1f6a3ab5b7581b

      SHA512

      0db5435ccc5e019554d341f62fbe53c347ca5b55d40a9dc20b856955884f6caa381269a81ef33dad6a5a708c4a16c6265be32f5e3378de767c066e563881c577

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      239B

      MD5

      602dad6ee0e60cde6698692534ef100b

      SHA1

      c3e20be4cf62746964ff865964f4f354d412bfac

      SHA256

      596069f7c5d4c9cea8266af60fcc730fbaec42eb5dd0c6f4203e463b742fb598

      SHA512

      bc1fdcc479d9d46977847557985ca1744f1d4f135da27d82dd2f131419c16fbc70968eb27458a1769e59a9a166847be39aa81b82936e39e753d578ee13df8669

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      3KB

      MD5

      fd1d88c9adab446ddde462c01a6e9b88

      SHA1

      2a2f971dc2bf5c18ca9ac6035bd3930887395801

      SHA256

      fefe4d1b2855ed31cb89fbe338efca0b867e319e9c8e4fd859aced3cfb0f8908

      SHA512

      9794605559c698b7b755d02896e1c121fa9217b4c1c6e256faad8a5c18297046b19d5e734c9ef5fd843c942dd4713608d79bb5025f892f52d2d137cc2e8d9532

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
      Filesize

      3KB

      MD5

      1dc9acb08748edd9ff98b13154e8bcaa

      SHA1

      2958c34b6666b86d06b5001a3e0c90ee584bc370

      SHA256

      dbce7a0386e6fbf3f7757fa8bb1b32a808c793f40465713e49b51762ef8c74c8

      SHA512

      478bdf453a786e4f152c51812bafc2bb4f1f732241a46414c78755133daf7305cd8a45bd9d7cf6bb7bdf7c48a9609735661037d508acf4edd1dac358e585822d

      Download Submit

    • C:\Windows\SysWOW64\jyoorjhqcecimsw.exe
      Filesize

      512KB

      MD5

      70ff9c4fede90312dbff000937738ad5

      SHA1

      c3e0412184079e7c3512042e467f1fbd484c58ef

      SHA256

      f86808c20570ca4ece6b44880b00e45db874e9c8519c1fd5c0b7cbaf42238fcb

      SHA512

      870d46ca93f22d5edc709e598b04baa906c64992721a196c8abeb16ba3a857af0ce84da2195f3dab6cca0ad2d5cf31cca73997903da1ab3466662126fce94ba2

      Download Submit

    • C:\Windows\SysWOW64\mvjrjwaemo.exe
      Filesize

      512KB

      MD5

      db2a06320788b8c2117efd773ff1f87a

      SHA1

      f0ac55bc7cbc879b0ba4cf418535c75ae88198fe

      SHA256

      b8463e7a81fd4badcd224cce6927ab8c4dec570d3fe283ca9116b864c2b9cc3a

      SHA512

      48d293c776b1ce220bd04acd2731c3f04028042c2c3dac5b910566e4712b82a4d14578adff83f9e9f74e317a92c1dd92406c099d1230de1c5806c5012aded073

      Download Submit

    • C:\Windows\SysWOW64\yhcsjwko.exe
      Filesize

      512KB

      MD5

      e4ab9ef88ebedd5350407e984bb4f21c

      SHA1

      f6b7feaa4c2579ed8d0de1d8ef7d081ebafa352a

      SHA256

      c33fe33c7040564a81ff4093260405f7ad1875062afd4f31229e84b544b1ded9

      SHA512

      203e703d392d2fa5d80016c5727f1722473a0350d5a0661bf43e43c01fb1765268a5cec9fd37993ac42900fd1a7634f6f161537db6d950b53cbe13cd4b701cdf

      Download Submit

    • C:\Windows\SysWOW64\zzziuahrtbfcb.exe
      Filesize

      512KB

      MD5

      4c2471f16ce3acd5dad859eb241c6819

      SHA1

      8bf840518fab49e0f535600148de1a36a306b29e

      SHA256

      b2e3da00535d846a31be0415338ddae592956d9a5670e15b3e53a0d9893f2f1f

      SHA512

      1bef63eabba7da6aa528b74f58cfa80b16110192e1104de7dc188c0b932ff1546b03fdde77fb1156cfd1cded6d13ddc9063ecb7f92ba1e01ab0a4420de634134

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      ede67b744e2ca7ddf6c5a121fb664cdb

      SHA1

      614b827d18d443a35678b5b5ef369af3f6b8d9f2

      SHA256

      b1b74c65d03d3c85800da8f99cd2ac67c711e81ba3fb7c111b04f29f289d4305

      SHA512

      e1f6f62c8f399cc89a2297ed045df27cb191c8b22f21ac3c455f551dec200f1f2a6d15dec97f57658f85121f4ec1bef3b5f556d50fae6de4abcdcd299866faa5

      Download Submit

    • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
      Filesize

      512KB

      MD5

      05b8508b642f8109b28df0209a6ff095

      SHA1

      9166e79b5273f64b8bcf12baab4b9d59a18d554e

      SHA256

      d40ba4e73b713a16146f282da8bcf162da19dee853b5dcffc399198ff461215a

      SHA512

      ad173d319d8c15dbfd34488ae11d1cbfc6459713fb8ae829df78c089114a7af372a1c2083f307b8cc8c538c1261762215a99dd60ac9dd8d09a7e8545da6cad0e

      Download Submit

    • memory/2452-41-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-43-0x00007FFEDCBE0000-0x00007FFEDCBF0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-40-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-39-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-38-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-37-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-42-0x00007FFEDCBE0000-0x00007FFEDCBF0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-113-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-114-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-112-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2452-115-0x00007FFEDEEB0000-0x00007FFEDEEC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3096-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download