Overview

overview

10

Static

static

5

eac79cdb7f...18.exe

windows7-x64

10

eac79cdb7f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 06:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eac79cdb7f97cd5e8dd28a23a31dc4e1_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    eac79cdb7f97cd5e8dd28a23a31dc4e1

  • SHA1

    7121b8daa129b4461de1c146ebcd2e61b0561d72

  • SHA256

    2b0df4533a9fb5eae92cbfc49d503ec8426346151bf0e59a96f4a51bd073ed0e

  • SHA512

    f23b9fd3c1736a6b2e762bf1960ef4ef8903448d9bb40b82caf24aa72e1fd5f364133e4a3e3659b4a1c541b516e07265c08ea0f17e5881efe54c1a14b17ffb1f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 24 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\eac79cdb7f97cd5e8dd28a23a31dc4e1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eac79cdb7f97cd5e8dd28a23a31dc4e1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\SysWOW64\ohsgzctebe.exe
      ohsgzctebe.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\SysWOW64\ovisphsr.exe
        C:\Windows\system32\ovisphsr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2632
    • C:\Windows\SysWOW64\yaobcauilmjhoxj.exe
      yaobcauilmjhoxj.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2144
    • C:\Windows\SysWOW64\ovisphsr.exe
      ovisphsr.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2112
    • C:\Windows\SysWOW64\ohvsamfstpwrl.exe
      ohvsamfstpwrl.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2864
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2120
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2820

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Modify Registry

    7
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      239911de59b3ce4763ebc94dde461cec

      SHA1

      b2db599c25fb6453c36334a91a1070108e47f1ff

      SHA256

      d9559f5c0b133e885bd492973ef22084a9fc676a322d1c8722ce0a3944eb5be8

      SHA512

      9765645ac9d1b3381c9bb9db9dff08607e8aaa7b09deb88270c2585ba73743237bdb6bf83403a3f471036259579c5a8ca91ce0738441627da97e06a503c6a3de

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      a4a64666610646f73d08170d1a80025d

      SHA1

      5c31d70e5b0e2c91aa9b25cdc4a488ca53139d79

      SHA256

      0d5456a865897280a3fa70dd732b47582f467b6355c175c83446762f05727c2b

      SHA512

      b66e9cfd0d0ae75f540e234254a66277c12fc9b5d78ea124784d504104cc1628a0c571c8959e8503600c6744ec68b23e6ac0f7dd2fe06417ef2f1f6558371b21

      Download Submit

    • C:\Windows\SysWOW64\ohvsamfstpwrl.exe
      Filesize

      512KB

      MD5

      150e659763d8cf8796ec680c4beab277

      SHA1

      381e2a8e6c1d7be0f8b96b13e8cd202c9b433d90

      SHA256

      a3a8447f5d892650188449f280760630ca31a7cd05eee2c0a34837e78ecda490

      SHA512

      96fcebed2147cddffea506d35ba465ce865ac75fd975f476bb3105c920df05c4bf43f5180746701334617f5b642ce7c38eef9a9463408a447278054ff4e5077a

      Download Submit

    • C:\Windows\SysWOW64\ovisphsr.exe
      Filesize

      512KB

      MD5

      0e5b533e64947ba3910e4dc25ea446c1

      SHA1

      10c6d05282d1253cb3c71589c23f961a5478d3b9

      SHA256

      fbd958c0e34912fb8a1f3f883731f32bf2d1d05aee3096067a9bfac24a7b5e7f

      SHA512

      b9ed24c1f829c1a1d200912babb349b1559487d1da813ad8304fc50ca8c548a4d2c01c4a3a04bb861e58834beb3a9f924823670b50b0c38beca0f052770478b2

      Download Submit

    • C:\Windows\SysWOW64\yaobcauilmjhoxj.exe
      Filesize

      512KB

      MD5

      6072cc6d78488ccc4c99f1c54882df5e

      SHA1

      5f095e1e1c027a6b0ab11f6ba9b4cde474cb3773

      SHA256

      c5388f9d1f08ea296771c955eb51931b98aba892dccaeb8fc23b01e3f50923c4

      SHA512

      b155d8ad8365783d5c863afed2394250332c9d77cd8344681a28674e6d3d469ae1321f9f25ce842f7f06d8e67a92395b8da9e823a3c7edf598f6ff59686fa716

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\ohsgzctebe.exe
      Filesize

      512KB

      MD5

      86489d33e0adae39604037b3290da018

      SHA1

      74d18a30d00f78456f94416aa50d866d948116ca

      SHA256

      ffba653e754f4e4463ba4a9c004fbda49e0503ae291a4471c00501dce17ac7c3

      SHA512

      1f012fbb7c130aaac07a86f5b1a4c9fdb8a520de36cec7bd668ef77c9511db66454d918569b890cf5cb1c24e1847fa9825876d84817af8df1699e28ff37de6c2

      Download Submit

    • memory/1860-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2820-76-0x0000000003E40000-0x0000000003E50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2904-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download