Overview

overview

10

Static

static

5

ed41a69b8f...18.exe

windows7-x64

10

ed41a69b8f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 09:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    ed41a69b8fbfbdee0148eba63b9c6e01

  • SHA1

    f67434b508c5eed439f835407e228e8502585786

  • SHA256

    cc3e5058ac37e5db39fa7e4ea00e44ec20f06400a3ea2e4930da4cadf77b2546

  • SHA512

    15ec8b4857834c9bff2eb44eec9e7791c8811f5568862ed0f263b54681e65c9f40c33bc33d62d3e98337e5466e29ebdea04a3a5b6c62f81c0410608c109edbca

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Windows\SysWOW64\pepcxawfsv.exe
      pepcxawfsv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Windows\SysWOW64\kwpjqyim.exe
        C:\Windows\system32\kwpjqyim.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1288
    • C:\Windows\SysWOW64\raeqchhxfiwjxbc.exe
      raeqchhxfiwjxbc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:824
    • C:\Windows\SysWOW64\kwpjqyim.exe
      kwpjqyim.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3396
    • C:\Windows\SysWOW64\bxnycikautust.exe
      bxnycikautust.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4136
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    7e3ec48ac1e7ba59c6ae3bdbb5fe68cd

    SHA1

    3c71e581d1af4260c716fcbe2654aa91367c0fba

    SHA256

    3c5bba190cc2fac4069c6c94affb43dfa528ba77e77f833848e34189f44f2e96

    SHA512

    045edc56cdd6922c9174f4289fb3003a31be85794a69b114d49ab6de08584717030316fd8f7cf349732adf57cb25a3a63acfd9e0a82a8d76e580dd59ef64bdc6

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    0a70a166215d086aae3e1af601d35a06

    SHA1

    a7d5bc2c3974324fe0f2ad8b60860ae0483b0758

    SHA256

    df5816462cfd251ada633a23b24f0838cf566b4da9dcc6816b6edc010d67ba43

    SHA512

    c2d11e2f2e9aa15f47673f1107f2445eef2a540d7c12b4335d7f2d33846d2e19584b13fb192b4e20401c5fa026d6849de12cebb1b7bd4ab2a005336e04bc0cb8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDC7C3.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    267B

    MD5

    8410c954848192052f6d1a78d28f7086

    SHA1

    7e77c4cfd688a90531611a1dba6e973a8ad504e6

    SHA256

    198b913e8c9e0c4b3141910660586abc5c6200ca9390fdd81a7219847676321d

    SHA512

    f27f2cbfcff04f8d37f8d083596a5673b4b7b50c75788fe6f18a6e1e05dc771419fb7e9723907973461056769b8f189cbbaea33c70c085adb145dadcf1ca7134

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
    Filesize

    16B

    MD5

    d29962abc88624befc0135579ae485ec

    SHA1

    e40a6458296ec6a2427bcb280572d023a9862b31

    SHA256

    a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

    SHA512

    4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    674B

    MD5

    ffafaa254d24f4428bbd9cf706c03057

    SHA1

    5fc68cf1652ed5f8da1ba5359c71d69dc12a6f46

    SHA256

    5c58a3b050496d25d18745f38d12c966e6bc29dc7bf464b8eee16c85e94e0081

    SHA512

    f3c5f743409829a197863648166a04ad7b2b9494723b925fca722f723e6a84bd44324f9b09092efcd5978740c362b120218e49730516c407c2192306daf6a115

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    1KB

    MD5

    5d8213662a8ad0e19a43f27cc07c5d00

    SHA1

    505b7455c667ff7abf8d21e8c6dbc6c723214edb

    SHA256

    1247701015ba18f167a42e2443a4f5d49c3a843d5a80620e6bed4ec6ffaa85fa

    SHA512

    4d8f29df46ba7945c2de28d9c03119c758606bbb0b5163d464bc0c74be02bdb2a30b48ccb94064fdcedd97fc7c7c19109f1f2233bab85cffe0ea6cee408e0b95

    Download Submit

  • C:\Users\Admin\Documents\OpenTest.doc.exe
    Filesize

    512KB

    MD5

    c81963b7127438bab5fb7113a1966b50

    SHA1

    b8118791e49e6704feb307ed7c7e8b4f5d7dfa0a

    SHA256

    4c75c675e543fc8c887a4989fbc5881b3a22d5ba38ee719a34d60f16f79a0c89

    SHA512

    eefe45c3dc4bae2cf688a4b8c12d76103a8b0d330b613409e67341633be8dedf34d05e254919c2509d64a0c8777e8bcbdb399ec1716ac2330ef9cfbf014b3c6f

    Download Submit

  • C:\Windows\SysWOW64\bxnycikautust.exe
    Filesize

    512KB

    MD5

    064071712b69e73c973a7aa4d9b629e4

    SHA1

    cace84c31b0efe7dafcb512d184f49c7f4f9eb76

    SHA256

    abacd6c5ea0cb4cb44429347ca7dd06da5d0a2a56e230fb3f155ed0a40d22b56

    SHA512

    03a773789a16ccab4e3b0e300d746d880c94368c5ba3f657e28be1bca356e8b85649da26fa450385b1d9a960b57c65dda7df089f40f8cdc8772cf1aa7c20cb9a

    Download Submit

  • C:\Windows\SysWOW64\kwpjqyim.exe
    Filesize

    512KB

    MD5

    3c8e5ec0518d65bda696c76f70bc08b6

    SHA1

    fa19912b84dc946476730cc2e0c4277b431825d2

    SHA256

    42d644bd21e38cc5d3627d0ba432ecd782942ce407d7960dea1638b31151774b

    SHA512

    7a49e99ea24a258b5c737f2abc4a2c7e407ae1416f1138de07dccbd322680300a5d5fe2145a396d6adb1ca7f9afdfb32b26928fdfc9db6138dc553c7cb0aeb8b

    Download Submit

  • C:\Windows\SysWOW64\pepcxawfsv.exe
    Filesize

    512KB

    MD5

    81dddb6bd8aa2b48665bf8416a258aac

    SHA1

    35f550fc25080f8ea9043686e1b44933423f57f8

    SHA256

    bcb878936558121c3cc0de5b60e5707b329869f38b1e4af835349bb077e673a7

    SHA512

    384839ba3701b3e04ada0ff288d064841e3600881e7ad354ed2d9e84a7989b0671e04c895c389b8182829ba04c71704be0bfbc30ae07cef8d42446d09f6c962f

    Download Submit

  • C:\Windows\SysWOW64\raeqchhxfiwjxbc.exe
    Filesize

    512KB

    MD5

    2a4adb0c09e200a4ac764cf42e81e604

    SHA1

    0b9bd19a5738506906e270acc5ef812352ad38f5

    SHA256

    41a0da3a46df62b19904602e0fc8fc5f9d79a3c9fa5239fa84dfad23c99e88c3

    SHA512

    639c8fb0b2265123e0a388b35d1c12cec56f766a85f0b56c2ab87816002de0b9b06004eddce2e7957fc07d8fe897789607f24cb8ce98a67ab08fb9c3b01aec80

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    af1744bdf3af389d6a32c32d2e64e95c

    SHA1

    172e9e632d9cf97470d0f722e93de889c6b50948

    SHA256

    eb7e29f05abd24064273c43d260148d13a797786848f5e428b1b3a5f443a3bff

    SHA512

    d7050ae07c4ab876324cba01f90e96b1b5cca45fb0ffb660bcb97842b758bed666baef047dca65e60b8d90cf173bd447afdaf16069bd0e1e19d1c168e3b63459

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    79622753d3c8950d612cfb3150a5b085

    SHA1

    ae7c3d8def827ad2a2b1bcbb1703ba89b8fa055e

    SHA256

    7a3bfc530b93aa8daacc043019e26067a61ce794b118b91deaa8a7219829a534

    SHA512

    38af99cb3bd6fb5f12d349503307ad0ebaceb05b634e0fb4aa9aed88f86729df44b61b95d29a8c44007c513de654cf690784e0f831e33db182390f515809961b

    Download Submit

  • memory/2996-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/3556-37-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-36-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-38-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-39-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-42-0x00007FFBA5CA0000-0x00007FFBA5CB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-43-0x00007FFBA5CA0000-0x00007FFBA5CB0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-35-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-613-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-614-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-616-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3556-615-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

    Filesize

    64KB

    Download