Overview

overview

10

Static

static

5

bd9dec1c46...18.exe

windows7-x64

10

bd9dec1c46...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 00:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bd9dec1c46f04c6ad37da8de79902921_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    bd9dec1c46f04c6ad37da8de79902921

  • SHA1

    4b9a9630ce3e46b7e257e8215d352fefda30555d

  • SHA256

    6015b900eaa526a96eb1f394edd9e3ba9e76c1145331db3338fc5f6058af3215

  • SHA512

    eed60ddd907278861752b3ddf986428ffeb01771ab813ca663ec50dc7cbc062950e24bdd2184a1b40d9bd352f611f6d72b1cc1624dbe4d9652687d2464eba05c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd9dec1c46f04c6ad37da8de79902921_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd9dec1c46f04c6ad37da8de79902921_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\isvngjykvq.exe
      isvngjykvq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\SysWOW64\htwbcyqc.exe
        C:\Windows\system32\htwbcyqc.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2316
    • C:\Windows\SysWOW64\ozynbmcuflkjjjd.exe
      ozynbmcuflkjjjd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1932
    • C:\Windows\SysWOW64\htwbcyqc.exe
      htwbcyqc.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3548
    • C:\Windows\SysWOW64\dzxmmkahckhuj.exe
      dzxmmkahckhuj.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:408
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2848

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Modify Registry

        6
        T1112

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        4
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          69d318934b710d7b929cff5ff646cd62

          SHA1

          77ba164270da1d775c02d0580b4910ed84bef87e

          SHA256

          67040040b50802b78dbddee5956b804ca02761cf319e75b45ffc5bc79733ea9e

          SHA512

          fd40448350a1df12e0af1975f009cb2f4f7d8c354c3f19fda685e2df837459a98d11ad8c89930e9cfd131b47e46e29a3a850f0d4bdd542274645daa22cbe166d

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          c5346424b7cdcd430e7956b474eaf8cb

          SHA1

          c2f527e7e5df5013f6ee65b09240a368cecf15ce

          SHA256

          36c2a7487c884489bada85870086de3c80a72718e7097cbfe98c240bf523d341

          SHA512

          348b6e5d34ac4cffb85e8976fccbd053f086319a2220717407467204e591707bdbeabad136c146e66765595109e1568c50c7563283e8725d0d616c7bf3e9f472

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TCDC56C.tmp\iso690.xsl
          Filesize

          263KB

          MD5

          ff0e07eff1333cdf9fc2523d323dd654

          SHA1

          77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

          SHA256

          3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

          SHA512

          b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          Filesize

          327B

          MD5

          f6e9124567924c6efcb0042d87971722

          SHA1

          299f7f9820c613a5422d687686efefb0f329a444

          SHA256

          ba1ad5c1496d6178c12fff875b208b0b2c0ea68d3d3635304c29c4903e2d6c9d

          SHA512

          c2a375a5cab7c81c87607d1629c5ecea2b3e504d47ae6a22247b9f227f8bfc4760b615d2ce8b91a4fcc93b619106c9062c22407377b19faa8fc7a61872c6dd9f

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          1KB

          MD5

          7bb846660e4384f20514db61762cdecb

          SHA1

          7deac12d6eb473f0a32c429f8c5a3d1819e21f34

          SHA256

          ede5dd25a3ce9264df07bb42c10eb9ffeb2e54279a401acf04c6a12bb3689ff0

          SHA512

          d91b69b3f3b5301af2dc5a5b2670fe2c87a66629294be926bf12922af022ccad37feccd46914e8f45b9ad18153567381a96c5f6072dfe405a8c961b2a0e071d2

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          1KB

          MD5

          59862b97b6836124736b481978104df1

          SHA1

          918d5165a170b9de378cd07b8376bf86017c5867

          SHA256

          2ccf0f7f924bc92cd03775b6c691f3b1f1470046079fcd3f055f68aad43dc28e

          SHA512

          83464a52a114a2c09312db68514bffe712012aa4de8e853c370865225b7862ff25477cdffbc59237bc13a4c65dd27ca4f41e156b65a00d0a3b4d8ba7d7ad6d3e

          Download Submit

        • C:\Windows\SysWOW64\dzxmmkahckhuj.exe
          Filesize

          512KB

          MD5

          a4849b002c723f19593fe63db2b32d9c

          SHA1

          0295c90ee4970380c8dc38ca527558c0ce3aea2b

          SHA256

          8c9907389d07c1f34e467e4114663c0e321ef364f57871439534f7e9cf289f7e

          SHA512

          7b4314d5eda42eea08153c182714754f2d1de378105c030d611571ba8d1d111c507a76f2baa0004b729c107918115f42ebd24b51f37b3dfff13471a7b4ec3136

          Download Submit

        • C:\Windows\SysWOW64\htwbcyqc.exe
          Filesize

          512KB

          MD5

          30d6d4ea4eec5407806b4d36a6e690c2

          SHA1

          04ff5f5a1a1f2fc23628bf80e63cd4dbf0c1b356

          SHA256

          4aa3735f7d64f7b9c3490d85ea7db82ed07df71de46f06ef3663e6709d6f8f25

          SHA512

          bed2c9602b58c69ab7a6702dc33c5e39fa748456642dbcc34d73d143cd63cf01335561899043087fa402fc4bbac5c4a71671d16d56004f919b1b9568106f5e06

          Download Submit

        • C:\Windows\SysWOW64\isvngjykvq.exe
          Filesize

          512KB

          MD5

          127bc9e54d107c86b238f959a03b40f4

          SHA1

          23ec27c663dcc6d7e8e5e0815a3b3c4ab5c5e9f6

          SHA256

          032a068becd0564cef55558ec49604d90c6fa52861bfb28db3f1cd9a0ddb105b

          SHA512

          1d9ab443fd310ff46b2461bc835e07ac3db383f332ff68e0cf32a3f4593761cf56ae951809b30fb27afcbaf979942120b52957226da37f0d74badceeb43e9d84

          Download Submit

        • C:\Windows\SysWOW64\ozynbmcuflkjjjd.exe
          Filesize

          512KB

          MD5

          1dc7b5be26a201e46999d1905e163348

          SHA1

          9926ed78c73b9eb530d87bb432f95188f64117f6

          SHA256

          98b05228c9c4d5e1b2232bc6dd3778bdf0bd95ec1ca73d63c042833f7f81ea8e

          SHA512

          d011901bb245e922a2dd10377326d08846a6de5b2b9a206c7d31e9940c54bb6b28613e949c72f9f669ec89f8b9e858b8a6ede098945631522aee67fb4dddb5c7

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          d9bd928cb02e665b914871dac02a9fae

          SHA1

          1689a024382c2b1e0c13479cfd5ab8aa0ccb5d4c

          SHA256

          200c493f299c0a2704b805745319c376842673397f308bb1a45ae207bd3dc709

          SHA512

          7981db3808ddc3130a6773b7fccf5b5e244d25e8dd468430b6097a7443f75eaaa4168b51e083abb2d304950acc77306f450f4eed6b27a432329d44e6b71c06cd

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          4de214a7c4ca98e4dfb35b8bb3c20785

          SHA1

          a91b1105ddde3ea9382c7176afaabc86459a9a7f

          SHA256

          007a56ffc829b229b3711dfa1c661c29533f96133d8d90b61971e3e49d9165a0

          SHA512

          889675bad0615d50003ea8f8660fbc11ec6934d37982c1966924206df7137e62382f00956d1aad939981316f09a1d348d06d3b52fe19781338569fc46e9af9bd

          Download Submit

        • memory/2808-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download

        • memory/2848-40-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-43-0x00007FF979E10000-0x00007FF979E20000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-38-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-39-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-41-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-42-0x00007FF979E10000-0x00007FF979E20000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-37-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-600-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-599-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-602-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2848-601-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

          Filesize

          64KB

          Download