Overview

overview

10

Static

static

5

eddc7fb220...18.exe

windows7-x64

10

eddc7fb220...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 15:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eddc7fb220618debbd834bcd8af3eb48_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    eddc7fb220618debbd834bcd8af3eb48

  • SHA1

    eab8235d004f92cb6405e8176c27f8ca874dd484

  • SHA256

    672418c0e5acbfc1b2e0dd1afb1c98830df4536de7cb93a29fb5497397067ad4

  • SHA512

    8b9bae819d4a87ff9487011b6077b06424e7c4ffadfbb8d370a582b92c9cd85972caaaa4f9033ec31342c507aea249fc681e23da5da0a1e0d582b23d7f8929e0

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eddc7fb220618debbd834bcd8af3eb48_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eddc7fb220618debbd834bcd8af3eb48_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\phqsenogtq.exe
      phqsenogtq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\htfcvsvh.exe
        C:\Windows\system32\htfcvsvh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1800
    • C:\Windows\SysWOW64\lfmbecuidqrazxj.exe
      lfmbecuidqrazxj.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1516
    • C:\Windows\SysWOW64\htfcvsvh.exe
      htfcvsvh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2636
    • C:\Windows\SysWOW64\zfgpiaiverwth.exe
      zfgpiaiverwth.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2796
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    0f2aaf9880a36bb623f6abd8723a6be4

    SHA1

    64b57c8d07f36d695ec6a0ca6710880a0db3a066

    SHA256

    c0c6751948820870c0fce842d838997d39b7a4174a3e8b04f1e1a8d57ecb898d

    SHA512

    614d315fae447885f6fc9b3cb8022872d2ed985d0cc77c5df1236c87172f432a3924e35be88706c4a30ef7868586dede8071e3bb77582990690b3ab96d804310

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    19bba34ec9b2908c88b3f21c33351bbe

    SHA1

    d3f1f21bc0f4f9e3485df1f146ebadcb74a6aba1

    SHA256

    b51db37d5194b807368e5b9c8d4a9b72d748f593407373620c7de57f01794c4d

    SHA512

    616c51616f63719ba09cc770c61e9dab0ab2451b0d83c70291d0d53428ff4bf257895175946d452569e877409af5b2ed8c19b0eb125fb64f9bc1dd239ba3a95e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDEA54.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    400B

    MD5

    21a647d24a148fe28beeee124b17af35

    SHA1

    821b1501f7809ea7c9f8671f6c3bba37c4c1da07

    SHA256

    e89f7710fd7d5a112b2c0b7fa548843c9499a3c73af644ca69ac92bd5925ef74

    SHA512

    b3aa833432846f87b9c93448db7b484c96a9d8c81964bef33a0e0d43a0c5ce17614f9c6cfeffc8f68f99957dc4fc4d277c4253c93e86bd9d783b660c3f04abf7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
    Filesize

    16B

    MD5

    d29962abc88624befc0135579ae485ec

    SHA1

    e40a6458296ec6a2427bcb280572d023a9862b31

    SHA256

    a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

    SHA512

    4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    1KB

    MD5

    eb8aea72d51599eeb157572b4455bd27

    SHA1

    c6a093b88387d1a9512b2dcc20aab96bfa749cef

    SHA256

    9037479815e1f479fcda36ba2d5444f22960c120c50b01b8dbaea08a60335cb7

    SHA512

    a83798ca09fc5dc9229492dcf2951f1e63284a7753db41b497e6400d920148e2f03de67d5bcc8af505e3785e8e4dc813a530bfbeac865064c3dde9f2045cab22

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    2KB

    MD5

    7af95c7889eaf64d364870b2130567ca

    SHA1

    f0bb137e0a3efc9c4b3e13ef761547c9c55497ff

    SHA256

    085e29253297f2745000175ce8864dea48c35d0b574a2013c15f65f653892dff

    SHA512

    0a9a4a0d4ec525f703b3ef22781f5758310db8c48e21f36417b584389b60196d48feb542044880d4674c28d6aea342c26420362ff6b81af6817644559c68f2b0

    Download Submit

  • C:\Users\Admin\Documents\AddResize.doc.exe
    Filesize

    512KB

    MD5

    d9648218f74ed86d4bbf421903225c6f

    SHA1

    5ecb075907717892c2741b8da9c720f53ec61a6d

    SHA256

    cc4b403c5232e0d0da3aa8bd869fa40317859bf472cd2fc1cf9f784385a88ac5

    SHA512

    976402b1b3318da0df2586c9b2a1cc721f14faf92e4e74e04c5e57a0c6dfe41cc7f38d42e7abec49c21e1ea76c3ee83a3527e73eb87caf0a820f97d830a872fa

    Download Submit

  • C:\Windows\SysWOW64\htfcvsvh.exe
    Filesize

    512KB

    MD5

    c684bf9f5e066d8f56e6d03bb32ea697

    SHA1

    6db5ec64ebf4b9f893b5c5611e66ae8fd2c765df

    SHA256

    644ef79a1d358919ec12828512cdd8c2f73adab274cc7da98c80c8cd556b7060

    SHA512

    2059ace4252ecdcadeae14d823fe0d84cbf2d662542ab50155c4523960edf7358f835e419f589f13c8970b2969537892914df2ee492da97f329bd28e6d538d7d

    Download Submit

  • C:\Windows\SysWOW64\lfmbecuidqrazxj.exe
    Filesize

    512KB

    MD5

    6f3badbc5435011828c637a0101719bf

    SHA1

    381f5620871924fafc053962c3c9f15025f21495

    SHA256

    0b7e1dbad87068e9e7db45ba3474f92a896a6626af6d4ad976be14898cc8f41a

    SHA512

    36ead3fe2db342fe20301c01a1e09692fbc6ed48e73397d36e98781c216bf332cc26bf85e7599ff2fbfd96b9301ee57d15efc0041170ad3e62cce3a9abbfc570

    Download Submit

  • C:\Windows\SysWOW64\phqsenogtq.exe
    Filesize

    512KB

    MD5

    021a9143df087de13a841831f1f5bb97

    SHA1

    ac984883f2881b79972e8e6f03c6a16cec5b8d8c

    SHA256

    d2791e62ca0ba05fe3a98f711960ff2fc2c0bd2bc0406ea224d78d93de790f26

    SHA512

    b4e6392253460b59dab18605cbad45e09cb9622899e5f5e9fc4336112c4734262e86ae8bc7edc9d6bab608c41c88411308288b364e6964019dc47657fccbed15

    Download Submit

  • C:\Windows\SysWOW64\zfgpiaiverwth.exe
    Filesize

    512KB

    MD5

    9d20c09fdc07c96f692292391e73bf05

    SHA1

    6d0fb00db979367b4a0e8b94064ba3815355e207

    SHA256

    19fdf46cc0731258e11198570364842f091b2325156779d19f2a2df9a20ceb44

    SHA512

    d19e5fb239db20a07ddc425fa575fb519c7ccc91a9d7da2f670aa6896388853a8320b85a541c2e791e79006e8a464b2f0c0a1a809131c3e7ec2c82262b988ffa

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    07f5f90eb596997f285d3fe2a7d9f93f

    SHA1

    815c468410e7baf786ed0126faff314d1e538bb9

    SHA256

    b40e06dca67cd5708c8a6143705bdb2a682737fdfaf7b1886b1167f3239983aa

    SHA512

    10bffcbf258e09f2edb85e9e5cd199f3aae92abad9f0a71dc2082be67e92c267c66e789a1bb88f8651f1333ad604c1dcdedaa7dc2e6f222aa388b168517ee366

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    6e0574b94d953285984fd66e58bf2e30

    SHA1

    b72f9a60be81801ab9e5aa7320983a3381d80eb0

    SHA256

    e1251c2bed1875f7186967b610497926beb1384620b384c0e490095c9408315f

    SHA512

    047ad4519a12b3880dc635dad5c2a1acbc00bd0a674cb469e89fa27fe42b64ab115e67a994b6e0d872ce55fc7dce94a2c967ca10927f75f18b507159ead41757

    Download Submit

  • memory/2044-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/3996-39-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-40-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-38-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-41-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-42-0x00007FFCA92F0000-0x00007FFCA9300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-43-0x00007FFCA92F0000-0x00007FFCA9300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-37-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-247-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-249-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-250-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-248-0x00007FFCABA50000-0x00007FFCABA60000-memory.dmp

    Filesize

    64KB

    Download