0b19c0dcbbe2373a8b6b3b830c01f7a4753c5b7e16f625a5565cfb1bc4e3a388

Analysis

max time kernel
150s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
Size 1.3MB
Sample240627-shdlsaxaje
SHA256 0b19c0dcbbe2373a8b6b3b830c01f7a4753c5b7e16f625a5565cfb1bc4e3a388
MD5 1674eddb9c8f866b645da885f6cd3105
SHA1 7f5b5fed89195ca1cf53b77d3bb0b069de64e878
SHA512 f33f7aaea9b77b0158f87eda7b5d22a655584a2ae03cde0432caca5b8b41fdca5665ed2ebab072f03d45c6f41f9f5accf33254a60a664ca9090b6b6e607e5b25
SSDEEP 24576:Ct93K0zZsAAOsDkBaUXjv4Pk8hrmBQ/n5Gq52Kxu2:q93PVODkBaUMuBIn5y
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4940	pav.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAV = "C:\\Program Files (x86)\\PAV\\pav.exe"	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAV = "C:\\Program Files (x86)\\PAV\\pav.exe"	pav.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	pav.exe
File opened (read-only)	\??\H:	pav.exe
File opened (read-only)	\??\M:	pav.exe
File opened (read-only)	\??\Q:	pav.exe
File opened (read-only)	\??\W:	pav.exe
File opened (read-only)	\??\G:	pav.exe
File opened (read-only)	\??\X:	pav.exe
File opened (read-only)	\??\P:	pav.exe
File opened (read-only)	\??\R:	pav.exe
File opened (read-only)	\??\V:	pav.exe
File opened (read-only)	\??\Y:	pav.exe
File opened (read-only)	\??\E:	pav.exe
File opened (read-only)	\??\I:	pav.exe
File opened (read-only)	\??\K:	pav.exe
File opened (read-only)	\??\N:	pav.exe
File opened (read-only)	\??\T:	pav.exe
File opened (read-only)	\??\U:	pav.exe
File opened (read-only)	\??\J:	pav.exe
File opened (read-only)	\??\L:	pav.exe
File opened (read-only)	\??\O:	pav.exe
File opened (read-only)	\??\S:	pav.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winexplorer.dll.tmp	pav.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PAV\pav.exe	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\PAV\pav.exe	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Uninstall\PAV\Uninstall.lnk	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Uninstall\PAV\Uninstall.lnk	pav.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4940	pav.exe
4940	pav.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4940	pav.exe
4940	pav.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4940	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	80
PID 644 wrote to memory of 4940	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	80
PID 644 wrote to memory of 4940	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	80
PID 644 wrote to memory of 4992	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	81
PID 644 wrote to memory of 4992	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	81
PID 644 wrote to memory of 4992	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\PAV\pav.exe
  "C:\Program Files (x86)\PAV\pav.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1674ED~1.EXE > nul
  2⤵
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.lnk

Path C:\Program Files (x86)\Common Files\Uninstall\PAV\Uninstall.lnk
Size 1KB
SHA256 71bbacabc1b1588598f21b139adaceff219ca67438abb53251ecc0f592de722c
MD5 a867544e6e43ce141bba7811d948ce9f
SHA1 8f98f01c3149d182d7ac6a9d6c704bb4c48ef3c0
SHA512 5f1255e04459b4d56a0a7027f2075209eab8110858e8af4e4fa1b3bce32523235f3a8072ed5ad577ffd0ed45bbf7742ac80c6e0f35cb17252ce9b0bec7ad78cb
MD5 SHA1 SHA512

Submit Download

pav.exe

Path C:\Program Files (x86)\PAV\pav.exe
Size 1.3MB
SHA256 0b19c0dcbbe2373a8b6b3b830c01f7a4753c5b7e16f625a5565cfb1bc4e3a388
MD5 1674eddb9c8f866b645da885f6cd3105
SHA1 7f5b5fed89195ca1cf53b77d3bb0b069de64e878
SHA512 f33f7aaea9b77b0158f87eda7b5d22a655584a2ae03cde0432caca5b8b41fdca5665ed2ebab072f03d45c6f41f9f5accf33254a60a664ca9090b6b6e607e5b25
SSDEEP 24576:Ct93K0zZsAAOsDkBaUXjv4Pk8hrmBQ/n5Gq52Kxu2:q93PVODkBaUMuBIn5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Personal Antivirus.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\PAV\Personal Antivirus.lnk
Size 1KB
SHA256 d5a1ed8c7f496c1986bf54eabfc186a9b07d0cffaa4566139f23e47cf56b5869
MD5 9e473b41fcf74229b80d2b3f0ef1c06e
SHA1 91ddb049da4e1317cd7d4493bdda35249ca6ed9e
SHA512 8a92f1c9c6d3bea0ef500c893cea9e0f59083e72c50923f81086e1a8b63b81983ccb81251ae8be8a8080e636d70cd24050a084634376eead62fce0962d0fe8d7
MD5 SHA1 SHA512

Submit Download

Uninstall.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\PAV\Uninstall.lnk
Size 1KB
SHA256 1ab3ccca3de97b902fe5ebf14d555319d727db84baf57910f431359d95bf3efc
MD5 b6a643901325088a12bb196cd1a238f0
SHA1 6a136f200e9e0e5f7b4674cbacd23832c0a12c40
SHA512 01efd78538b8270e88c4da8a87978468c79b8a66182132f9c4c4bbf2416f98a72f0d9477320c4a4c273180e1387ee3772b6b0ffbceca8df425077455a10fcf27
MD5 SHA1 SHA512

Submit Download

thanks[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\thanks[1].htm
Size 3KB
SHA256 dc2517a0bfbc68dff4ddb7d4f79c6595f74540ca52d50df7eedf40f695e22505
MD5 696c0a0d236283192a8b21b0f2832fea
SHA1 cfe7e970d479c9fc47fcddfa2893be261ba16807
SHA512 10a42dcf6940f63dd7bdbb86a9ff8522a3a966a699d15da8fb379a864f09cec23029c820ca286940c29b5b798626b9d107bf8c84dcc5bb74ea632bb631efd5e1
MD5 SHA1 SHA512

Submit Download

deprecated.cookie

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie
Size 91B
SHA256 d07311acf641866e7e84823d2962f593bb655792301dc61ad6f0c6869d9c5937
MD5 99bde3452748e34d6c50275110a6a8d4
SHA1 e79cb2a8db7d8490523529d3861f95ba73a20c23
SHA512 19fd529c6fe60bbbe3710fed93f14d723a13ad427431f855ed84f5e5e496b9f3eb8a6e8c31d740239eb225753d52a4f464b489fdbdeff4477480026263d0f691
MD5 SHA1 SHA512

Submit Download

Personal Antivirus.lnk

Path C:\Users\Admin\Desktop\Personal Antivirus.lnk
Size 1KB
SHA256 8d366400e13dabd164ead2ef9f763425b086a1874a11789557e784085055c02a
MD5 b2784f5404c2ee75dea9a097b2a0ac02
SHA1 7dfc6295af9daac8729d6d7c9f2931e8b3a3874d
SHA512 ba401e3a64d93cfdc2c9ce9b2a397d09d9fa99bf41016a572f05ce7dcc37df2a24abf23043007c0f6448da70c3e01410b8c4960a01c3feb574f07ff6fabb17f9
MD5 SHA1 SHA512

Submit Download

memory/644-1-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/644-0-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/644-21-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-46-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-87-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-18-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-59-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-60-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-67-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-74-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-20-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-94-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-114-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-121-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-134-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-147-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download

memory/4940-160-0x0000000000400000-0x0000000000AC1000-memory.dmp

Download