Overview

overview

10

Static

static

5

b4393f6913...18.exe

windows7-x64

10

b4393f6913...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 15:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4393f6913e7f8028160a1c54a31d242_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    b4393f6913e7f8028160a1c54a31d242

  • SHA1

    07b1e01004fb8b24cf70364323d232eb7230bf77

  • SHA256

    58651cefd761a07c796c083f3d68163b9378aeeeff6598be32fa02dd981eed30

  • SHA512

    d4501c25744b26dd295c61bab84c262538f80d7591b20ca584253a2238411e14708011843f76fc286a94fea699d628f4b301b798fa704eb186e66a2e4b1a2bf4

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4393f6913e7f8028160a1c54a31d242_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b4393f6913e7f8028160a1c54a31d242_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Windows\SysWOW64\sajekjcxif.exe
      sajekjcxif.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\SysWOW64\pimaeblc.exe
        C:\Windows\system32\pimaeblc.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2836
    • C:\Windows\SysWOW64\jixnvfzpnmvrhhz.exe
      jixnvfzpnmvrhhz.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2712
    • C:\Windows\SysWOW64\pimaeblc.exe
      pimaeblc.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2656
    • C:\Windows\SysWOW64\iwczkgdyitaps.exe
      iwczkgdyitaps.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1268
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1168

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      8680cac462f1567a415c13980f7d6f33

      SHA1

      d1aaadd6fbd88002f64769fe5c939bcadb6c3b9a

      SHA256

      c26ac8f404f7a52a136d7b9333cc4b15b7adff6f4661c496e1263ef6250aa16f

      SHA512

      51b92aa18d432acdbc683f3b497da5dba7f0aa85ced35ee41217ff76503d0a6481f2185db90b11f2db4c7370dd11b8b449e1938ec36db21f8341a5168d740b44

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      7b36e3eec05ace7512ad780b0d76413a

      SHA1

      8aee5df3f3f0944c210af8a106618f8664fa5ced

      SHA256

      5f3620715393365cf2d4b4a2f130633f8c4a49cb411e860daf2b13d8f5be8627

      SHA512

      96571c1c473990aed4274521a5c5bb2c5c43961f25c6d7a86fde55e81eaada96e8517fd20a22d9f2448147c9c8a9b2b723dd00fade34bf77766286832137b14e

      Download Submit

    • C:\Users\Admin\Desktop\EnterWrite.doc.exe
      Filesize

      512KB

      MD5

      bb1e6fae3972488ab5c122d6214327bb

      SHA1

      aa7e0fdcb9bcc9692077bced1522a997d331ab6f

      SHA256

      be3f34bd51fd294f4d5118975acab7264012144d1093a2812a1e83b6409182ac

      SHA512

      ad4c6e6e490e0fb3d92d3423d4300f119b1969a431ed38dceeffe5e55b7b69de2177bc07ae854caeed46b882566c2ca6a747e21043e33bb6fe187d09d07126da

      Download Submit

    • C:\Users\Admin\Music\WaitDebug.doc.exe
      Filesize

      512KB

      MD5

      f8d1795a82cf5f7a5776a91ba9cb3541

      SHA1

      f3d46d8228403cc0440f170683957cac930a0975

      SHA256

      5c485c413498a23cf1e9f64453c35a631edc5dd5267138de07ba40f533870899

      SHA512

      7ab8155fdae25ee08f96116d217c29005fef1e70ddc1de61fa00749a85ff11e4707f4376eeb85d9c96886399110b87d2bc8cd1de0aa46baad1ca6afd87789f8c

      Download Submit

    • C:\Windows\SysWOW64\iwczkgdyitaps.exe
      Filesize

      512KB

      MD5

      0ebe341b2f4101c23a4f66ce01f4250f

      SHA1

      43f05e23144b944041db657371ae8ef44a8de8e8

      SHA256

      0285de83e4da02f423c1966d7a099b7ab494f08e709b0429061bea4854b80dce

      SHA512

      3e14a5dbffe11ac826979c0b8eccdb2fec2ef28fb13ca19f5ffbe819f92601299e21be161a603b5eee715337f76ec509bbe40f46f7f1cfb42854dd48d7c3f77b

      Download Submit

    • C:\Windows\SysWOW64\jixnvfzpnmvrhhz.exe
      Filesize

      512KB

      MD5

      315916c5a354736486e2ef384d30481d

      SHA1

      810ae8ff94e4af52274ddeccc44a0f3a190a7a41

      SHA256

      e7130ef2f3463723008e773cd3384e1ecce71404ada4a14c00839dc07a6e3f1f

      SHA512

      fae02ff3831bb66600eb2461e9e3f09691747438b37e311de17354904f3051bf57dfcadb035f308ddc79a89f7d9c2e2e21bf049c2196855601c8d5859061b9d1

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\pimaeblc.exe
      Filesize

      512KB

      MD5

      190fae6b8fb53d89e850bc2093718ff6

      SHA1

      ec9a779a66183754f44c1f02fde909b0bdf15c36

      SHA256

      e18f6151ebaf46e3904c27ee4c82c6ffe3cd7c91ff48922c08f9cbf2c85a22d8

      SHA512

      5c78fb6b93f816950a059dbdf44c134e001f0e3b4362d01c4eddba6385895cf9a2bd69daf0321e69d1fb945f52ac16d01d5d2e22d4d9acc2b208a8e53b23594d

      Download Submit

    • \Windows\SysWOW64\sajekjcxif.exe
      Filesize

      512KB

      MD5

      ede19bbd44f0263a7c8649f893c9b3c1

      SHA1

      83d6acf8c519520370245f234bb46f86d4aa6c14

      SHA256

      f240e16cd40c1b44438802874ddccf3cba649f7829662d3f9c8b6b74bbc5073d

      SHA512

      912d6c330b96bfb14415790dae6b54f61c3d84a187225b1b8c846ef9a0e08af4e00ef3c4616fc41a73bb4b9aec93579fd44faf893cd65dea77c74cc65c24ed64

      Download Submit

    • memory/1264-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2548-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2548-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download