Overview

overview

10

Static

static

5

e22363a9bf...18.exe

windows7-x64

10

e22363a9bf...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2024 09:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e22363a9bf090c96c9cbbd60dded7842_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    e22363a9bf090c96c9cbbd60dded7842

  • SHA1

    5149473f2ca50240947bd08fabea6889649e219e

  • SHA256

    a6b684502b288e48c8d30c266440d96e349a80113287bdaad7692aaf8657505f

  • SHA512

    2221ba04ee745fd9f7fa6763883fbf0c9c804eaf7d1747f2c4ce496e5df231193920e6bd79bb8a62a813f1da2817268db36908a74999b7c93a9577d151e278d1

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e22363a9bf090c96c9cbbd60dded7842_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e22363a9bf090c96c9cbbd60dded7842_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3256
    • C:\Windows\SysWOW64\ewswocmaxi.exe
      ewswocmaxi.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3336
      • C:\Windows\SysWOW64\bxrgitei.exe
        C:\Windows\system32\bxrgitei.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4124
    • C:\Windows\SysWOW64\wyyfysasycmlnxe.exe
      wyyfysasycmlnxe.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4304
    • C:\Windows\SysWOW64\bxrgitei.exe
      bxrgitei.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2768
    • C:\Windows\SysWOW64\gmpqwfcizgoko.exe
      gmpqwfcizgoko.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2308
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    4150a4dc43d8691594631bbe5fea62a8

    SHA1

    9bc426848934b84176f7b411e6410f49c7fa3656

    SHA256

    4e9c75c57f45b2bb47398dfc33021d23c4270ae344849af6815b26f1ef968b57

    SHA512

    551b0982470e961605945c8468e4e3ef69abc95ca5411f9153e636801eb93dd910b4f8f676a60338135cd28dcb8e2e63c1736f06e5d87e9de7f0a8f9877241de

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    cdd2712bfc023d41211ef665b9c0c372

    SHA1

    e1cc4cc8caa5c51eab511e75f69cfd15b177ad99

    SHA256

    e9b28cb09e5d19ca9c31f3bf4fb06d1cce6fd720006749eb8823b4a1cde23583

    SHA512

    fef24bdef0071adc622e49000212aaaf2ff7c6f179f8da4ccb8e5f5e1d16106776d44da8ebe025a80c395976cebeb672c061e6bc8ae2c56c8acb013630eae605

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD4F0.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    414B

    MD5

    c4d533e683f53883c7231206cd18bf37

    SHA1

    07f075e942b9b6b5bec45b991b6b5b41c69e2b8c

    SHA256

    2f5a204b57af38481712184e7f593283d9aad4da49981fab96f2a83aee1597dc

    SHA512

    7ef39fac284871653eddb51c1c81312ef6ee3f7d8ecc8c2187009f9fd8d841f4a1a7fc83aae6d533a581535496a76cab3cdf9958be4b4c6fe11a3fb28ef299a5

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    269263b988992fdce22cab7263f2e2c6

    SHA1

    f3428afa30b04f9bc2097f1722ae85530fb3cabd

    SHA256

    3f02361a2bf6b6ff02b94f84123caedb58575c9732c5b3d2659bdae051e09ef2

    SHA512

    69bceb7da91fe450b8cdd2a6b21bc44a218f339fa51182a264393cb610e01365451dc0f86e3e5dd60656f2918e6d832ef0d1dd59e6b1901749ef71d087677a97

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    2KB

    MD5

    06b2355952073aa135e2cd9c23c26a4f

    SHA1

    b036e16bfe776ca782c852d9c20bd3264f226f7e

    SHA256

    91508e67ed699bc99c333c93e452b74bda4931821a11b821f4975b95daace788

    SHA512

    903834bc4cefcf0b40c7d3e655aaf42df46851ab2a1d8a6ea47263b6f8695498359ecb7783e92e7c715e6d2c6ae1b19b66a373a3e43da6f0796618d6a1c0d16d

    Download Submit

  • C:\Users\Admin\Downloads\BlockInvoke.doc.exe
    Filesize

    512KB

    MD5

    41dd0017e4131c5a391d64e4c6438b7b

    SHA1

    d7b6c64a0afd89eeb1307f173a5c6ad75e245c71

    SHA256

    e1887532af6249272d0928f11e5971495be24619be67c832efd263f96c819e1a

    SHA512

    3d54b7c0a0ed475581a3d838b5eb58a816630993b9082df4f24075c20e383fbac7ac9dae36b40f3bb6fc463b5258b25daac9e23f50786b1a4d944872854d3251

    Download Submit

  • C:\Windows\SysWOW64\bxrgitei.exe
    Filesize

    512KB

    MD5

    cdb3bf0cad819372c79328699b48b6ba

    SHA1

    38d391be277c1d9c3e396b6034c8b3ad19fd108c

    SHA256

    bb2f0e1a15b3f0d95008e2847b5a8eac6b210d979b125383bd8fe86646a5da01

    SHA512

    f1d060e1fb7df25472438dcf8a1b80b608af7a4861d9e3160ed265818de91524499eec72e0482825d7f5a73220a2bc64142c4945bbdb873f546cfcaea890de55

    Download Submit

  • C:\Windows\SysWOW64\ewswocmaxi.exe
    Filesize

    512KB

    MD5

    7c7dcb7854f2fd9ff3857187c0cb1154

    SHA1

    c5361dbfb39ec005f058b74ad72f272393c4ef28

    SHA256

    78cc9b127242cee2ea7a424eee3ce1950eb98933a880efc5a504c50897ff605b

    SHA512

    6662690282b7084351a5f99b527ee1808a96ba4e7f55c1e4da2289af60fecf3d5a665a6d4f37d08f15b9e2319bcb249818fd5b56fae562630c5649813d365abe

    Download Submit

  • C:\Windows\SysWOW64\gmpqwfcizgoko.exe
    Filesize

    512KB

    MD5

    fbd9c2488a8a38130eb706cc833569ee

    SHA1

    44f028c38d5e0b420c52a0cba9e3134ef77dc365

    SHA256

    004e157ad93cb8619cf2c91a25d05b38c8b2494eb53ec4bfe3e3972fc0c27421

    SHA512

    c4510f019648a681c311fd5d86ed747273e8fad8bb04354eb6dea487fb427f3e0c3ed5f2fa0b79289742ad347c0d5fe16c839041d6fee063511181b9cc74694d

    Download Submit

  • C:\Windows\SysWOW64\wyyfysasycmlnxe.exe
    Filesize

    512KB

    MD5

    c07757103cd48b723a88e6e82cb997dc

    SHA1

    c8c1cf2c6a292a571c6868f51696f71e92b22dd4

    SHA256

    455650a723091aaa6c6e11d36c5885aef6517e7b76545823858eebe3585559d6

    SHA512

    74b3365a2252ba347c214d18e2f146d9fadb0259e45904124313b4d9be7d84012808a3f66c1260e56b6f1b7db7d8a9d273a747c5bc872b4ea03e4997a52dbf95

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    f744b7c6c3eee6e474dfe2b2b5c48eef

    SHA1

    b3fc1e3aa9d524bec5a29f120905a724eefab37c

    SHA256

    e4b4a793349756b6fae64e0d2e4f4f129a0740e4d18c07c92ff39d96eb22aad2

    SHA512

    408c40ce1e917aa45fcbaedb32882bb35c59766dc48c3088b5a9a52e8d2145cf66b292db54efd8900bc2a30278b1ce42ad870ce30694b1a61daf9373f7cd1337

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    d3feaed863185bb4672b627f1d6deb7e

    SHA1

    b659452ef2bbbd4af5ed83a7a746446f8f374b4e

    SHA256

    d66a0367f6bdfb475065f74fb2160711c818b2b06877b0d1a851e6faa6d9e97c

    SHA512

    d386dc21c32088b6456fbd006cead287ac706261dbd4c7b98c0b476e8175e5b6f478958542dff2a2c4b74f02407fdee60a0e91428fda52690de0dcc4691e3984

    Download Submit

  • memory/3000-41-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-40-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-39-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-38-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-42-0x00007FF9D4890000-0x00007FF9D48A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-37-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-43-0x00007FF9D4890000-0x00007FF9D48A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-250-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-249-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-252-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-251-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3256-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download