Overview

overview

10

Static

static

5

ed06643a0a...18.exe

windows7-x64

10

ed06643a0a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 06:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed06643a0af08af627c7ef2038523c6b_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    ed06643a0af08af627c7ef2038523c6b

  • SHA1

    a034292ab885b32549a99d8600d9f12c5175d0b7

  • SHA256

    1cd080d3274d833629c0c12073dad92026609136335c4f3b11abbc7f3949d21e

  • SHA512

    c77a31bea10aa5d85a6184e7b47aaae1f5faf152de28559ce5e0f91e0702a1fc4ed5bf1e543e60a9529cdd35be65f50aa9abd5d896c964700b438d443d03e1c1

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed06643a0af08af627c7ef2038523c6b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed06643a0af08af627c7ef2038523c6b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\SysWOW64\xvgiujxrmv.exe
      xvgiujxrmv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\SysWOW64\hicvrijp.exe
        C:\Windows\system32\hicvrijp.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2120
    • C:\Windows\SysWOW64\dsnmgunlwlhqdfb.exe
      dsnmgunlwlhqdfb.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2728
    • C:\Windows\SysWOW64\hicvrijp.exe
      hicvrijp.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2668
    • C:\Windows\SysWOW64\gjnshujvkbpzk.exe
      gjnshujvkbpzk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1048
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    90cbc6def18d0378096e5d9627673e22

    SHA1

    33d1eee0ed2edd06d2034f425eead45530de211b

    SHA256

    cdff5d85f8965382430617fe67ceb7f5a2b7a62aee02a3964799fa503d12cd49

    SHA512

    6c7f69c62f448ea0b5654734903bd338e42bc9721cc0c5f3dfcda95b695abe403012be9ee6ce3511f67e516229fde491caebaa32494069185afe5ad253a72bc7

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    5af583af6acfeb200008883e903bea09

    SHA1

    11349c6ad9f1c9cfc2d2e2653e61520da3a90cc7

    SHA256

    5fccc6674071b414ecffc4a505aee8ba8484ef461696471bcb45448b3405a2c0

    SHA512

    5f5039c128bd7c1c146ff6289a4c36b9559d5c3341407d158da217d95ade77a200392d2a3a5b25990ae8473ba177e30b251ff72243688c8e17f1bfa4f1da127a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDBFF6.tmp\sist02.xsl
    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    305B

    MD5

    80ce8b14846abceb07ad63c086fe62f1

    SHA1

    38785cb5990f5bbaa1d5de5c93a2fb36c8fd50fe

    SHA256

    e48173d3860a2ad55e7e6d2701e0cba701146071ed759a114482aeabe9323da9

    SHA512

    6331d7679b31898225b2c672d353bef4aa2c294914eb2f0d567fcf273d5a082d280d17ce5da7d7bb3f5043d6e2334a930dcec2498e6404a50cb46aae59c4cf38

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    1KB

    MD5

    0f2a24d170b2ea01aa748126219ec077

    SHA1

    a7d60e6f9ffacf7d12958b06506195ff92a756f6

    SHA256

    a8bc67403bf64f9668357988e848b8531ed2f24e5070df67029535a6aed49af5

    SHA512

    be6a0a6d4220b77f987ac4b82a10ab3acc29f24034d4394f0b0ce858a2bce8f22d4a383a6f1b8a68e5c1600889113279e45377963842c07c9caca2a9a4d518f3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    2KB

    MD5

    01ffb9e85c96ee9a5de6482db1635e1b

    SHA1

    9a1021b2efb9cee7c9331602fcd214a937ef79d4

    SHA256

    56cb00d435a09a5f847d6fdd0876754b6ec498ac30efedebf3be9caae85b16eb

    SHA512

    9ad05d043ca942918b06a75977595030bf500c242de3142b2eca8b966e845466ef6ecccece977aa2d505d37094f9ff9855e4b1395ca9382c91246f51463badd7

    Download Submit

  • C:\Windows\SysWOW64\dsnmgunlwlhqdfb.exe
    Filesize

    512KB

    MD5

    248074d903ce9a319c387eb778f6c40c

    SHA1

    9dc699779f989aee91f60161a058b8b69121cd8d

    SHA256

    3ff6ee65f316af18a655eba95989494a4c451588f886e021c7a5ac821d629515

    SHA512

    386fad7683f32f97028a075f7f3e1b248e6cbe46662381ab8273f633e3b61663063f4befc5b60bd5355c19e3a1578bbde9597671e5373288e2bf3443d2c3d7e3

    Download Submit

  • C:\Windows\SysWOW64\gjnshujvkbpzk.exe
    Filesize

    512KB

    MD5

    af077ab559f8fd42e2f8cfde92392a54

    SHA1

    2393510334187f08f7e354b4bfcdf4aac4b28be2

    SHA256

    26985d9f823656fdc0127096e274c167f185b76c098108dc95b9fccea5b4ab4f

    SHA512

    a6ee59c15539926d46f05eb4011cea5f27c96d8e256f467799a6426bb20324f7b5e89d6c3faf6ad2b479f7fa18a4614eafc4343722990200f17e73d088f7fce0

    Download Submit

  • C:\Windows\SysWOW64\hicvrijp.exe
    Filesize

    512KB

    MD5

    dfb266a6b01da08edee2e1dd94ef537a

    SHA1

    b86381ac4b59bde64062bf457520a143722fa742

    SHA256

    096b0a95fcf93b158bde9a17ffdfdd83ef4126d1bdc0ac1436d0ec7a0f267bde

    SHA512

    88f8f1d8030b1bc350eb5016cd072f0d2cf02bdb0faa9e7e51792e0fcedcfd109834063aaa35e6b8f8b74bd5b5dd440478ee918153cd3aab2776a36ec614fba6

    Download Submit

  • C:\Windows\SysWOW64\xvgiujxrmv.exe
    Filesize

    512KB

    MD5

    7e7cc459e990515e4e8ee326caa9561e

    SHA1

    43072bcc693025f36c7e8901ac313757ecbceb18

    SHA256

    bc1c34a18e97ac7ba61a0e1077c16654a1a6de26524b6b74bbadfcc20697d58f

    SHA512

    3181e831b6a33a8b823d87a780d0bd092f0ba3e2e2156cdae31c2c45bb62f195879535681d54289504f51b3e43b2b9dddeee93f9671b504342ae0e52b45637b4

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    3b8af2990c896c6e6331d117f73ff1e1

    SHA1

    83bfadfd8bc0f4978932b04d43c77af1eceb2387

    SHA256

    a692377a521a6d780090689a4c4359bb04ff802b10fd3f2828e0c53925c70de8

    SHA512

    7f486f4c391a8b3781e935b05d318fc387448706562c28693d5d762d16445cf48dd43b73f40e1db41e71870d2527c8f1d86e6d5d5fd733795994268e974e286f

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    5fa892aaf60b78f491eed1150ba95bce

    SHA1

    0a3c7774efed30e23e4b28e21c19ca75a67bf850

    SHA256

    043f1ed3cc972ebfc827daf60d02f97d61f3522cc37be499d8d891bfb8cbaa88

    SHA512

    468c6734e75fa71068658e52f54197b455bed9486d5d0fa639ac486a90e11a864f28930278d607027e5b8a1c7680950f2f39a6d7afa8cfaa9d3530e7b35c3e02

    Download Submit

  • memory/2700-596-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-39-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-38-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-36-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-37-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-40-0x00007FF9EB7F0000-0x00007FF9EB800000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-35-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-41-0x00007FF9EB7F0000-0x00007FF9EB800000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-599-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-598-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2700-597-0x00007FF9EDFF0000-0x00007FF9EE000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4280-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download