Overview

overview

10

Static

static

5

eac79cdb7f...18.exe

windows7-x64

10

eac79cdb7f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 06:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eac79cdb7f97cd5e8dd28a23a31dc4e1_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    eac79cdb7f97cd5e8dd28a23a31dc4e1

  • SHA1

    7121b8daa129b4461de1c146ebcd2e61b0561d72

  • SHA256

    2b0df4533a9fb5eae92cbfc49d503ec8426346151bf0e59a96f4a51bd073ed0e

  • SHA512

    f23b9fd3c1736a6b2e762bf1960ef4ef8903448d9bb40b82caf24aa72e1fd5f364133e4a3e3659b4a1c541b516e07265c08ea0f17e5881efe54c1a14b17ffb1f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eac79cdb7f97cd5e8dd28a23a31dc4e1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eac79cdb7f97cd5e8dd28a23a31dc4e1_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\SysWOW64\bifyahqihq.exe
      bifyahqihq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:708
      • C:\Windows\SysWOW64\qmkawlee.exe
        C:\Windows\system32\qmkawlee.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3580
    • C:\Windows\SysWOW64\ramsbawegwwsogd.exe
      ramsbawegwwsogd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1040
    • C:\Windows\SysWOW64\qmkawlee.exe
      qmkawlee.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4820
    • C:\Windows\SysWOW64\biuukycznpdmr.exe
      biuukycznpdmr.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2320
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    545a3bfd0376bd0b550ae73988e4d139

    SHA1

    4265cfc0d3fbb0bb89e89fdc1edbc0347e6b02a0

    SHA256

    a05274dcbc59a36beef77a488d55e3c2720c216b429ceee4bf25e0f4536e1a50

    SHA512

    98f7dd65db2e692705034d25d54edf5edf0dee67b7b8046d81951fb4e25c22b8a8ecdf8d0fa09f07583981c903866a5e736152bc44fbe97edebb90eb0b0ba7b0

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    b1031e894fb4c9e139d4de9251b418a9

    SHA1

    0892cf5157004f7cfdd153272fe75d0e6336e6af

    SHA256

    24ce56b2a6eb2e32d97678c8351a55171d761bdc3bc21a12d35b187aa559460c

    SHA512

    03eaae2f79f95c827a73022e0e2c957df4b58aafcb00049aeee183b3de93b3440379e8ca5f7b6188eb44de3c6265e1126a509a2ca2231446f7e4a5cdb996a2a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDC8E3.tmp\sist02.xsl
    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    297B

    MD5

    87afdc14c01b52d80f894a8be1071cd7

    SHA1

    f1db9e136693b6cdb779112e98d224fc3cca29be

    SHA256

    2485b926e17a5a48283280f4183afb10aac1397c8398884fac08a845226c86a5

    SHA512

    17f47208e9fdbcaa42623c5c7b7fb70a49f7cd1313cb668440f8e872da9a1da9dabb88315337c17b7401ec0f8bcc4821abb71c4766a7a39fc88d05ead9e8fb47

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    674B

    MD5

    d2de11ab9c9b5e32eaee7bab63c912f2

    SHA1

    d006c9fe369d90552b8556e581fee101585dc108

    SHA256

    a627e4068bc01877718fba042627461a469d3ad79792afb79bb0797816e01bac

    SHA512

    f594352d276cbbb31f4174fb5dd014ea420995cbca662e868881e7263e219a0b3f27f2516b657e9afa0a27030feb6e413f5c5ce80b65c11d93fb264460235ec2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    1KB

    MD5

    aae947ca432cf059014fc8dd34328d6f

    SHA1

    96f502a493a8822202d38d40fdf1ca5d65c34da7

    SHA256

    1571742984ef661f44d86ff02843e48fa8d003bfc212058fffbaf2001c04cce5

    SHA512

    cb3b31b45314ff162d85d24b86f5240a06387d005339a0004080b9c62392d150907d383b793c60dafe28c9921bf2bd558e2a848d179ad3c32fb2557bf3ca701c

    Download Submit

  • C:\Windows\SysWOW64\bifyahqihq.exe
    Filesize

    512KB

    MD5

    433f16f73f808ddb1ba2a8991b993e4a

    SHA1

    cc666a2c2e3df788cf1962442681bb8277515a8f

    SHA256

    5f6183a4f631f2fe4d92835c74c532151493b688659ae1a226f9e09ea11b1626

    SHA512

    3c36b168490ac20871a71d014332a5f9a0780223410b4ff473f5a32cf5a67c5c2573f9cf493419fb5305b768bac6df0043ec2c7eee3e4c18769fff4c4f431e27

    Download Submit

  • C:\Windows\SysWOW64\biuukycznpdmr.exe
    Filesize

    512KB

    MD5

    2685a140bbe9fd608e1ba6156cadbf22

    SHA1

    e6a20b8ab93ce9d97eed1dc5987dc8555906fb32

    SHA256

    73ac4def150bd56599d51675f83f2cc0aa97ceb868e8ae8f241b15cad2362cd7

    SHA512

    2bf335316cf2b6d46068279ca2d6c757a2198bb186bf602204ed6664e07317905877437a23eb95bd3d141275baef0ec9b1b24e4a1c3d06ccac80512593df2713

    Download Submit

  • C:\Windows\SysWOW64\qmkawlee.exe
    Filesize

    512KB

    MD5

    460a4c9ac46cb8924fa6ee2a0bbd5862

    SHA1

    ddafc9c18be1b436f9bb47c588f25e625e7f825d

    SHA256

    3fff3dae88998d8c980be4c7aa2e049251be8de534401eb30227a3fc9652a767

    SHA512

    e820daf705d0e25d6a33bd6b3db2c5606d0e02f8c675c8fb495ec7653ff5c2fc35ae7a747612b585ea0cdb87d601c244cda7ae9f19a93b576a675ec3a6e34a42

    Download Submit

  • C:\Windows\SysWOW64\ramsbawegwwsogd.exe
    Filesize

    512KB

    MD5

    8d15049817c330d89cf18e9c51df9782

    SHA1

    7d6da95db2b642329e46bfc62e557680cfbbceb2

    SHA256

    44fefdf03dce10e6d75fa77e7ab0507baff09ef70dc064bf9df4871e7dae4fe3

    SHA512

    beefb67f4bb2d1864503bf9028a1a4ce713a1f652ca2599197a9a238a99a7e3a3bfa5f3d2ac20744e8252ab3d5abce9234c787621e00649b052717bf58881fbb

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    f8eebef622ba55a8f813a6ea7039d075

    SHA1

    25ba50c59d7bb23b3b3fb6065247d95f63a02cb0

    SHA256

    3b08317f7a66d758d54252180f5d76ceb33fa0532eb78a1fc4e4bbccdb89dfd3

    SHA512

    144aca841e3ae92e1571f4f8150abc432d5b1f02b37cd6f91fe778f5b39dd8576d1a4ec86fe4fff2d04e61bc79ba558c63e99e52f077f68b291b4417b01c1d64

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    7d093cd7952abb65e7977bb84d2dbb92

    SHA1

    0d3c9cc10d462204319224fb0f4686cf3ebacdfa

    SHA256

    f85190263eba9c5bb641aa31cae455ca2ae9b103ce16d0267d5c5c2bad732b6a

    SHA512

    2cdd6e35977693e4e860d555abfb65c3f3ea1293f5b04f52b4b1da5535b7eb121a7dd2ac8e1873fe425c398cd0b385669ee294fbfca5031f0179ebc1cc180acc

    Download Submit

  • memory/1076-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2404-38-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-43-0x00007FFCB0390000-0x00007FFCB03A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-39-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-40-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-37-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-42-0x00007FFCB0390000-0x00007FFCB03A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-41-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-598-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-599-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-601-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2404-600-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

    Download