Overview

overview

10

Static

static

5

c77b62ee98...18.exe

windows7-x64

10

c77b62ee98...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2024, 19:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c77b62ee98ec26daf78fbf665aa91b15_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    c77b62ee98ec26daf78fbf665aa91b15

  • SHA1

    9796f131b693171bdb2b7b872d252fcd93ea9b1a

  • SHA256

    ddb113a5d9524d2181e902163301eb99f5dc5a362959f4a61284683983c884c1

  • SHA512

    ad36d7ba262b04194fa5cd68fab29ac3ba16a5c4fa172573de5c31cc3f2b6f7d54f5b79255ce8948d10e6cf658836ef9301b0f4070c65013f291f72233288eed

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c77b62ee98ec26daf78fbf665aa91b15_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c77b62ee98ec26daf78fbf665aa91b15_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Windows\SysWOW64\qhpwvokhic.exe
      qhpwvokhic.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\SysWOW64\tqsqqagl.exe
        C:\Windows\system32\tqsqqagl.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2304
    • C:\Windows\SysWOW64\yolsrfwaagqfqwx.exe
      yolsrfwaagqfqwx.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4492
    • C:\Windows\SysWOW64\tqsqqagl.exe
      tqsqqagl.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:824
    • C:\Windows\SysWOW64\qurpqysbukxpp.exe
      qurpqysbukxpp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:448
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    ea47f540e5569fa758441dcad8cf1370

    SHA1

    fa3aa64dcc5641fb229493d490b29344e24998b9

    SHA256

    97ca67c791235acf804b7db8c4391830a165409774a6408a3c86e7d7b394dbc9

    SHA512

    9bbbfe5c8fff83c249a0d7934bd18e8c641a197b4bf1192dc2a969e202d70e10f331f5412d101e78eb09986d3aff163f8e2155f12a58dbfae6315dd2b68093da

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    56bf74776ec2fa89db8cd8a756ad9c67

    SHA1

    a9ea85ac4acf77ad915bee3d271543c4f8779318

    SHA256

    aa9d54ab7019a1ff43f670d8763335b79a74e21453264d0d0c1e49797b8c907f

    SHA512

    fae4aa4a406e91c21bd8ea8cb18e54a6f903d1d864ddef2fba2243861b6eb6be507b11660023c7134236da8cc4ea1b22c7922d873b0cafeb42298ed28e9b3fcf

    Download Submit

  • C:\Program Files\MoveCompress.doc.exe
    Filesize

    512KB

    MD5

    8b17d5b1f27ff6b1684ed22c6473faee

    SHA1

    45cdff27ca67093743744c229b48dba3b762a40c

    SHA256

    2169b0af0d6b6baa506c04f5402ae0e293643fe0de7798f2669565ec1a46acc9

    SHA512

    57393c83cde2bd271d69aa569b9d8f5eae413f4c8b1081a0d5b543f7214b1aee00b87884adb63554a0ed721c535553b6a8d8ae901326c8a9ed6b10b440e875d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDC707.tmp\sist02.xsl
    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    299B

    MD5

    7bb151a568216da11d03e3a741cd37e3

    SHA1

    c570cdc70c982f1b11a3bbebcffb3e1c148a0061

    SHA256

    5cb978310880f33609b2096e1c79d14d66711939a7da7cde07c5e8729efa2faa

    SHA512

    80c74bb193fc48d43a120019684987fbedebb1b39018cb530d457a13a6ca9dab8b0ea508b34f7b891ef0d0f4ed79787b4e384876c89b20441660012d8299c8f6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
    Filesize

    16B

    MD5

    d29962abc88624befc0135579ae485ec

    SHA1

    e40a6458296ec6a2427bcb280572d023a9862b31

    SHA256

    a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

    SHA512

    4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    674B

    MD5

    05c072bd149e9e0a8cfffd627e2cde49

    SHA1

    61157dd7a8ddc04338badbb3df48402aeda8fa90

    SHA256

    f4b34e7e69160dc818daba7c3da9480e235dc3d7b1018782061f25bbc601de5c

    SHA512

    d140c99ca7f589d5448bb9495e08ab966159473210e99a20c0c1bef9cccc513e9a00c55ebe914df3ab15828869fffe57826f76f55845f3f43cdd3a5bb0019cc6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    1KB

    MD5

    37135a0c813edca1dbcee16344f56a67

    SHA1

    446a4710858f7dd7904a0b60e4b3df34b1e248b8

    SHA256

    75366247c6828ea9ea5a2f6ede3254d0b0e61344949a40cfda3a55b44d5b1165

    SHA512

    d87cfa20bdfbab8e48f5733199e56ea997915d43ed6ce6ceb30e05a11e9284d6782b4031ead05ed8fe593dc362c77bd01097ab29ed60f927cfde718a2a7098a9

    Download Submit

  • C:\Windows\SysWOW64\qhpwvokhic.exe
    Filesize

    512KB

    MD5

    da306f484196b4f48f30b48d0beda927

    SHA1

    da55006ceb587b40732926f9bd3ca1ddf184023b

    SHA256

    3f7d3053b04363e972b8139579014c172072b93313a6cfe7aa852cb31f9f297c

    SHA512

    ff77ecae5251f2da622c6ade23967a8ec4296d3caa34fa9ed3b74a729e0bf5771021627bfb42ddaf18e3598ae6de5744a026f4ca66863cbf5e78beb74fa0ddbf

    Download Submit

  • C:\Windows\SysWOW64\qurpqysbukxpp.exe
    Filesize

    512KB

    MD5

    0642f4344416c1c5b862708bceee7992

    SHA1

    65f85e1e8448c2a3f3f83df88460ed0b81c7be08

    SHA256

    0b6f9b89ed24b1ef34a8acc1692dfc548f3bc8a53f0022cf290a6980aaa45f7d

    SHA512

    7cf2416fc9b55e76f0bd9a3c8eff98a0b76ef53f2bd721dfc19a112ef64034a4028411f041f436cf334c2862b38d8d7e86eef0e1bd6e45b0344ebb8924395344

    Download Submit

  • C:\Windows\SysWOW64\tqsqqagl.exe
    Filesize

    512KB

    MD5

    e772b025e108488306e578278b3b56d6

    SHA1

    b22638ede9af35950ed877f72e11ecef055f81fe

    SHA256

    85490b7928d38eb2e33e82b1a706bb129c2de261ac9c5831a4af79ae8d88bbd9

    SHA512

    02c6e923a919dda777bf96536cecc72f17b90f6f98af91e081a68193d354d52e59cd06499c2e60c095601da0bbb0b72d5c133432891113573fa6b1cacbf134cb

    Download Submit

  • C:\Windows\SysWOW64\yolsrfwaagqfqwx.exe
    Filesize

    512KB

    MD5

    45823bed0ad6a0f2a73e3c7c2a4385a1

    SHA1

    5989721ef9b4a1fec790cbf7e7e6eba1d2457eed

    SHA256

    720612061c29cd5d8fd410aa9d271302eeae897f6677b0300475fe135f1034af

    SHA512

    699e546e16a27ff1615e0454fab231b0ac7d380b9b8658860db25b46b71ae9a7306b339ae45c30dc04f9b04c09909e32920f1ee6969647b516a4db7de93dbafc

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    d4b2f64507408822bd57b809fcebefeb

    SHA1

    afd16f9b648d9113f13593424d9636a73b568ea1

    SHA256

    1016378616d316b9e72a6d406e9c0da4d162f825658407bcc8fe6d78a6406156

    SHA512

    e562ae529c88ef46277fb4272769e5efa96f0c1aa8e9bf09ace0f82edf0218da7feebbdbef07528a78c9ec21a41a756007f2ce895e35b3beffe0a62906392912

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    09dbc9ea79a46071eb9f4a1c2119f128

    SHA1

    5157410dae36ea10c6a527308f496fdea8675039

    SHA256

    c7df4f7d1f306574ca4199727d0dd9248227fc68f64c6ffc449f334aae5ec781

    SHA512

    0845f5cd314f02d64c349e53dfe6ad76144369ea07dc07ef9789502033e4d4aa2eb4e1457f346909662643c01b8a944e9ea95f7028a596baac13a5ba69986326

    Download Submit

  • memory/2600-39-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-41-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-40-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-38-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-42-0x00007FFF79B80000-0x00007FFF79B90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-43-0x00007FFF79B80000-0x00007FFF79B90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-37-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-610-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-611-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-612-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-613-0x00007FFF7BF50000-0x00007FFF7BF60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4908-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download