Overview

overview

10

Static

static

7

09117f8a05...18.exe

windows7-x64

10

09117f8a05...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    09117f8a0579f0360e04899d6608a375_JaffaCakes118.exe

  • Size

    2.6MB

  • MD5

    09117f8a0579f0360e04899d6608a375

  • SHA1

    8a3a9ab7a0ef4f4529dfb58c459dd9d8da343dc9

  • SHA256

    dc17d7238cf0cca2c3e237d675a71ef5fe413ec0e5d915d90f3df00abaa0ec00

  • SHA512

    f78b4fd5849de680a2f40f217dff006ae7c4b05c6472d193283f1297627f03c24e63758b930ce81999cc789707253c27736962399f5921e2b70bf3f3733267bd

  • SSDEEP

    1536:0DK8Fef+IvWruJx46wshHY62pB1oAl718qn+oEywcDn6TNLsLEnouy8:0Dy+IvWylpIB7lxjn7wq6xwL0out

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 42 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\09117f8a0579f0360e04899d6608a375_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\09117f8a0579f0360e04899d6608a375_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Users\Admin\E696D64614\winlogon.exe
        Error 448
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:4784
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:4964
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4488 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3480

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Impair Defenses

          4
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Disable or Modify Tools

          3
          T1562.001

          Modify Registry

          11
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          3
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\NewErrorPageTemplate[1]
            Filesize

            1KB

            MD5

            dfeabde84792228093a5a270352395b6

            SHA1

            e41258c9576721025926326f76063c2305586f76

            SHA256

            77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

            SHA512

            e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\errorPageStrings[1]
            Filesize

            4KB

            MD5

            d65ec06f21c379c87040b83cc1abac6b

            SHA1

            208d0a0bb775661758394be7e4afb18357e46c8b

            SHA256

            a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

            SHA512

            8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\down[1]
            Filesize

            748B

            MD5

            c4f558c4c8b56858f15c09037cd6625a

            SHA1

            ee497cc061d6a7a59bb66defea65f9a8145ba240

            SHA256

            39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781

            SHA512

            d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\httpErrorPagesScripts[1]
            Filesize

            11KB

            MD5

            9234071287e637f85d721463c488704c

            SHA1

            cca09b1e0fba38ba29d3972ed8dcecefdef8c152

            SHA256

            65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

            SHA512

            87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\dnserror[1]
            Filesize

            2KB

            MD5

            2dc61eb461da1436f5d22bce51425660

            SHA1

            e1b79bcab0f073868079d807faec669596dc46c1

            SHA256

            acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993

            SHA512

            a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            2.6MB

            MD5

            09117f8a0579f0360e04899d6608a375

            SHA1

            8a3a9ab7a0ef4f4529dfb58c459dd9d8da343dc9

            SHA256

            dc17d7238cf0cca2c3e237d675a71ef5fe413ec0e5d915d90f3df00abaa0ec00

            SHA512

            f78b4fd5849de680a2f40f217dff006ae7c4b05c6472d193283f1297627f03c24e63758b930ce81999cc789707253c27736962399f5921e2b70bf3f3733267bd

            Download Submit

          • memory/224-12-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

            Download

          • memory/224-0-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

            Download

          • memory/3808-15-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

            Download

          • memory/3808-16-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

            Download

          • memory/3808-24-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

            Download

          • memory/4784-17-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-50-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-52-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-61-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-43-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-36-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-70-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-25-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-20-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-21-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4784-79-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download