Overview

overview

10

Static

static

5

d0901274aa...18.exe

windows7-x64

10

d0901274aa...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 22:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    d0901274aa7c321903124f1ad9096c69

  • SHA1

    a54ef8d4ac46693775d0c4eb8dc79bef055d22be

  • SHA256

    2d96443c35b8d0c00d70e6bc92bcd3d23ef4bfed55397b8957d0e126517da59b

  • SHA512

    6c744c9e1c852bdc72029eeb78cb3ee931a646b487ca657c36e88f3c2efd0686809174be8c42906516e08fd45b012578ece6e8b2d2ff87e70ce906305b06b5ab

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\SysWOW64\tzgprkmzcw.exe
      tzgprkmzcw.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Windows\SysWOW64\yemuiltw.exe
        C:\Windows\system32\yemuiltw.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4216
    • C:\Windows\SysWOW64\jsumvruwkvxybas.exe
      jsumvruwkvxybas.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:408
    • C:\Windows\SysWOW64\yemuiltw.exe
      yemuiltw.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4912
    • C:\Windows\SysWOW64\kgbualpffaclp.exe
      kgbualpffaclp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1528
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1700

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Modify Registry

        6
        T1112

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        4
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          0cf5f3a39e3855520b56f1f0ea55c6cf

          SHA1

          6aeb87362b1d39a82d5b2102040057051243bec1

          SHA256

          0953c560dc28757e03b838bf306cc10d69fd1baae989e9c6e5b77883be7c4807

          SHA512

          1fb8026e65ecdf290912d8c302efa0dab13173411e39c98d401ad10a0e9c1f6cddd9c1ea828ed86d0bfa9a5a253ed149b0bd75da3d35106c9a31e7e574bf5097

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          22986bedb379aa308be39f53bd8be729

          SHA1

          c156ce5a10406010c3f060fc368a54d784a78dfd

          SHA256

          c87cfb5f8b8f4299df4ee62bba64e6a8badee0f36d9a66a7ed7ee79267f60f04

          SHA512

          75efba791d4f9092c10c0d8d12253860aad4aeb37f16bf0efb6cfcca2767fe79d5a5d19a72fafc7372b345d6d8e2477b500b97ad6be2a4a2ab04e8ff522a8eee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TCDC711.tmp\gb.xsl
          Filesize

          262KB

          MD5

          51d32ee5bc7ab811041f799652d26e04

          SHA1

          412193006aa3ef19e0a57e16acf86b830993024a

          SHA256

          6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

          SHA512

          5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          Filesize

          267B

          MD5

          ad2e5030bad7c50cf0de7044cfcb9be4

          SHA1

          4d669d7e4283ad94a8945be69a6290a6691428c9

          SHA256

          660d045ceed32a9453cb10e2e91bbabfb70b087502b3f28ca33c0355d9c2f03d

          SHA512

          8eb12f787755fa29f834d8a254582eb5af1a0072639b06634271ac84bde6aae4da59e2ce5800029081266b5287e30153497b6217ae663a6428103a47268ab393

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
          Filesize

          16B

          MD5

          d29962abc88624befc0135579ae485ec

          SHA1

          e40a6458296ec6a2427bcb280572d023a9862b31

          SHA256

          a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

          SHA512

          4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          1KB

          MD5

          1403b956aa992e70f5b46cc02c90bdc8

          SHA1

          3bc7cbb7526f59e58d0ae06621856af8ca0e3b1b

          SHA256

          8492a614a8743708b346780230b8b3d41481a89e39c31f853c4c92438ef9830f

          SHA512

          2f013b81dc0ff2c40d5d213b4065f67c13e0bca99f9d7703caf5a287e58d6913f2bb0078f3a8556caede96d6f1b81dd04b6eb5e1321487b3276e8191a70496dc

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          674B

          MD5

          a07fcd08aa48eb4ef62984ca71b9c5d1

          SHA1

          513fe199c595a353a5c94e7de0d532ba9deb5942

          SHA256

          b53a13a2fb8dc034d5b78c47ed53dbd86108f8db32ce9d60bbe68a2476ad26f8

          SHA512

          93032b3362c7362d2f3f90a0b3c2cb9d93e87b617e2b500f43ec0f30b1476d0ae6e4fac3d1c3e4ff1bc80b76389eac4cc0daee003c9054fa2ce8aa77a2831af4

          Download Submit

        • C:\Users\Admin\Documents\OpenTest.doc.exe
          Filesize

          512KB

          MD5

          dc05daef3b6b70eb721808ae97ef1ed1

          SHA1

          6c1741f12aad80a4967db2cc7e6e0abbbed637a0

          SHA256

          25bc559b27e0c15d1ce0ca9448aa763ce616deb5c5825b176df03ab7bccad597

          SHA512

          78a17d98b1dc377fee474e21099f6cfc21c2845c01ae970647fe47ba3557c560796bfda112180934d75f7a9a6f6a2a8a60ac9c0fb206e20f032a28df4841b202

          Download Submit

        • C:\Windows\SysWOW64\jsumvruwkvxybas.exe
          Filesize

          512KB

          MD5

          5614f29651dc42eb9c6ae5c7b3f6d2de

          SHA1

          285517daed8ab8b542f80d4f46adbf9a4dae2152

          SHA256

          f39d22154d8a2fec0300a9cb2e8e7c3ec576cd896ba5a49fd2179be70c46a682

          SHA512

          0400b2a79a7905dac6df0bd7119e9970a95d0897ff7bc6340a1bcec610b22a2a3c70756e23fc5db96ea3f4695378c27ce6d8e3deecc7180de2b719c13385588c

          Download Submit

        • C:\Windows\SysWOW64\kgbualpffaclp.exe
          Filesize

          512KB

          MD5

          8552a399eb8762032b167b98de5cb23d

          SHA1

          9e431934628759e21bf24228225d33c3d0f7fc53

          SHA256

          219c284d1a2184ad98e963fa65fb8d88b2e09ce712800948d2cc39d3f216a8c2

          SHA512

          432bceaa045724621028c4cc1c7c52099d41c09f0dd02000d86123debaeb6fddb2aaa5f2b3c84aa174ab09901c007386a369acfd164b8b7ea2121cb3d0e90621

          Download Submit

        • C:\Windows\SysWOW64\tzgprkmzcw.exe
          Filesize

          512KB

          MD5

          df593830d5550d773da2f1b4c3d60726

          SHA1

          93d6f716e8ed1b9464e2ce4dca592ed2d7fe25bb

          SHA256

          f6796aeb227e4b90d17ed45acf35b447ea299152b363f357fc32edeec0b5d19b

          SHA512

          3d310ea50c083d4218b7211b611d88e0d6a18937ccdc4d3212cc24375703230837fae7bb9ac6397e4944530828e766c8879eb6ef4490501b9a2a71f5f1d72dbb

          Download Submit

        • C:\Windows\SysWOW64\yemuiltw.exe
          Filesize

          512KB

          MD5

          d2b7c7074f09bd6e0cd4b855ea072e29

          SHA1

          2ef79de5cc9705da44c94e90e647e8905d85ccf8

          SHA256

          faaa2b623a255009b36359e67de228af84ad6a60c75817168a3422f0f4b7c84b

          SHA512

          5b725e073dd4289f2d14288b3cb7046364b084229407b297a4229077d258b7e9e124c818120e4cb393756cfd407ec282e95b1f2ec1f593b3ca2a740e05605727

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \??\c:\Users\Admin\Downloads\NewUndo.doc.exe
          Filesize

          512KB

          MD5

          df6b393835c0219f82a9b817e9ca4f7f

          SHA1

          6e6d06af68492bf6084d46e2f7168ab553b76abb

          SHA256

          579603baa6e902eb74b5ead8e213d406a203764533499bd2e5bd341b32331f33

          SHA512

          c4fde809c5dc9ff9d4dc5208adb8c29b49c9538d429dc1b37abcd2ffb3b279361a1a543ee4f0a1f5e582bb644bedc5a214102f216a6fc86d2e4c3081e8b443fd

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          8ccae2ea720e9140065a67d36fe6ae43

          SHA1

          fad4b994ebeb92aecc702a1195bf49a3609509e1

          SHA256

          cb6dff866fd119c8d740601ba5a89e73d5e2cb1ef757ed20dd8eb184d4360979

          SHA512

          1235a7bfeea8358298b86b2535e0690e3746a6a21dcf4874ace520fba5ac1085e16379c6b95a72345e72b60cd16c8782061025cc069d638467fd9012c88af65e

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          ee6f3dbceb478855d1b016dc87cd9e83

          SHA1

          e28769b259ac658a16b3bf0682bafa98ef5677db

          SHA256

          834e627435baaef2bd0a19573382eb0c7f3e8c08181164b0ed72849eb46020e0

          SHA512

          8c37d1b97bd27f9e16022391c09de480e44a0cece2532c588e6fe0a48239d5c9f00a8bc85370ce08e5669798752e76a609374cdfa0fd784680c7ddc3c8671a1d

          Download Submit

        • memory/628-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download

        • memory/1700-40-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-43-0x00007FFBA5CA0000-0x00007FFBA5CB0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-38-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-39-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-41-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-42-0x00007FFBA5CA0000-0x00007FFBA5CB0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-37-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-592-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-593-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-590-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1700-591-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

          Filesize

          64KB

          Download