Overview

overview

10

Static

static

5

ee5e6fea32...18.exe

windows7-x64

10

ee5e6fea32...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 20:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee5e6fea32f00c231e2ceb684d8c1585_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    ee5e6fea32f00c231e2ceb684d8c1585

  • SHA1

    2334a9434d70723574a57d77f76974cb1b7fe70b

  • SHA256

    e0b1f76c0c8328ca4b4eb476b18f95359e63165495987a3158865f8955f73518

  • SHA512

    5febd2abff8c88da07e2e8365fe0d31be65c9ee7147c474261108a67c04632f95760e70cf178cfec1daabab2fde10b1d439bc0e02abc074c4780bb4529774e11

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee5e6fea32f00c231e2ceb684d8c1585_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee5e6fea32f00c231e2ceb684d8c1585_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Windows\SysWOW64\ixfhanfbln.exe
      ixfhanfbln.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\SysWOW64\bpzrziyw.exe
        C:\Windows\system32\bpzrziyw.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2008
    • C:\Windows\SysWOW64\jhykesxeidjirft.exe
      jhykesxeidjirft.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2216
    • C:\Windows\SysWOW64\bpzrziyw.exe
      bpzrziyw.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1908
    • C:\Windows\SysWOW64\xgbtqgrethikd.exe
      xgbtqgrethikd.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4812
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    c40e318af43d27c556a25f595b503370

    SHA1

    8d1523054ba3db9ecee026772f9d15f61b232825

    SHA256

    77d4466263d27a51c6ca930893db70affe3f7ed7840d479e6562e77c21615d13

    SHA512

    759f761a75876c88b4f992c46a3d120d42db96cf63ea1845dcee65d5376ef769d12e17bf471c3df7287c27cde624549dcb7fb5eee664103ebc3fdffc0ff11095

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    4bb36f52e557c5ed6709f376b992ac10

    SHA1

    405a154137c429bd79133bfd4ea620554481ccac

    SHA256

    fb25b32211a344662a1783a053e898a772faf08e974ccd1e0967a526a8dc8c1e

    SHA512

    83083439e5cdc7246953351181045f806e2c802177d7142bbc809e602eccc4ef33e2f59d94cbc26116ffae3a3c6c2184ca85d9fdb67feaadf587c7f958f4f919

    Download Submit

  • C:\Program Files\UnpublishNew.doc.exe
    Filesize

    512KB

    MD5

    ab420c3d32e1891fc06d49bfc58ebe44

    SHA1

    5bc2199eab05c1a257c023a2b707f65acfa7a589

    SHA256

    68c63dc4d6ec713870355985f45b52b4c91ba66e457cfc42ff4828baa251235b

    SHA512

    696a7dc8b97b185c8a1b41402229aa5c664bb4831b30e65724a6e9bdecd644cfd499da49e39f2e900ea449e6631861b19ba30bc32617d16ad49de586f29ae4a5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCDA60.tmp\gb.xsl
    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    404B

    MD5

    5d80fe00997372965023691b9bb75c78

    SHA1

    0713aa77cf4f0e9867ac23ffc04d6fe32876ee75

    SHA256

    9f6e5afad72ae85588b8a8ac34bfb1f3e80519e744d3801e0a7060e88ad85de8

    SHA512

    56ef403e7a86dbc8e21573c4e3fe9d4cdf5774eeaac9fb57d0f4efa38e5befc59acca9aaa70865c04e89e20ab30d2f3ccea851976006f0f66fdcf2a3b39d6a33

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    2KB

    MD5

    8bfd02b940d03fcdf656d198b66b703a

    SHA1

    168385e79c2ed6c20020a270bdf71805a580e2b3

    SHA256

    6e483398d7392b0ec266d5102b99c263c0337614612c4eadcf74c8be13ede126

    SHA512

    442230e9ef1be2c68ebbc8c3fed82c98b961c8707bf739527b45b1794bf59eacc6a1a6ed81687e175b9cb6ef3a23b7e47832e819b06c494752455c3d9595fa8c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    728407a0a07709b46b6f730523d67f2f

    SHA1

    24841aa91acd8e03f0fe0495c325e1e7f84a815f

    SHA256

    4ae465bae752c6b6833c60fe7b36addf0249e35622b81f2a1579a17daceca4db

    SHA512

    ce4a814c437dcfc9d08f6b6ac1752926e24f7838903829e61b972ce97e7c13e44e66b2a05233af08c291ea7628e7fda1bab5425476d4d52c3509b196720f52b8

    Download Submit

  • C:\Users\Admin\Documents\PushHide.doc.exe
    Filesize

    512KB

    MD5

    006ee947bd669d3e30ffb9c12adf3893

    SHA1

    749bef684afae7522c1974cf8c7a379b578858c1

    SHA256

    2dc6e2c25f9ba90032b39c5b93ebb9282dd4cf7fd99717f8060f54010a902dd6

    SHA512

    630b1aba01025d0f0e886505d4f868217687e875d509df027eaf7dc97c8f7872d127d2e2f12ed3ebe5cd64291af699638462eca867af90555213d9b863e3d7b9

    Download Submit

  • C:\Windows\SysWOW64\bpzrziyw.exe
    Filesize

    512KB

    MD5

    dcc17519a5d6b1296c0026bc62538be1

    SHA1

    1bc9ee720bb495aadae35648662b8472d7bb3dfc

    SHA256

    aae6283cb9c4815f37a710ce7c8023325c3e697e8cbd7e30911db3751b424652

    SHA512

    ff470677b09965fb831f2b783006a19b51cfbaf8a891c49ce2de894405037981a6737769886bdb9abfb3862648b33b80003d17ff446f394140f6eef95da1d897

    Download Submit

  • C:\Windows\SysWOW64\ixfhanfbln.exe
    Filesize

    512KB

    MD5

    e8b59173f0c041c17165c6af3b05b0c0

    SHA1

    5ca21f8676fa421226ffdf76c46ddbe5dee75064

    SHA256

    525017f021e7fd58000501f1ab64c067140cbc3d5828be01188756df4368adef

    SHA512

    943b18cb940b114ea38ff760c7ce86fd63a01e9636a11ffdeb34ba8f1f6d3de5926b53335873f3e5d06350a28bbd69e8fa204878c518717c04adbe151e717096

    Download Submit

  • C:\Windows\SysWOW64\jhykesxeidjirft.exe
    Filesize

    512KB

    MD5

    7889e5e0f18bd5e7b95db98fc01472b7

    SHA1

    65e3d91e273928776af2acc7d9aac02cd168a680

    SHA256

    ec08fc02a74e8d6792d38a362398497e41707607dc2329a3eb4e91c81190d4d6

    SHA512

    d933fd420b73ac062d278029fea4445c2f49432b9609bf227220e054225f9ea4ae2ee371a800f175930199a8bc62571d3488aa21ed8b05d8c94d352017ab11f8

    Download Submit

  • C:\Windows\SysWOW64\xgbtqgrethikd.exe
    Filesize

    512KB

    MD5

    251b7d0df2cdfa95ffc7424defad3837

    SHA1

    6a4a36c4bd8cb11fd8d5064509aca5f6140a47f5

    SHA256

    c20b434936798664e0253dcecef3826a16ac0723e4cd984008c0e887c78e0cb7

    SHA512

    fad7a9f844b7e5e57799f73eca31a9d83d6f142e9f1781a1d897d70773678df5b92611bcedcac4a31be2a0b553083ef19819740e6e0526da7d3809cd6bc3dded

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    f7764654e2fe11f736f6a2cc842be8b8

    SHA1

    25561609f3153f558ee19dd82eca0ff2a0aa65a0

    SHA256

    74ee99a5839935c1c3b814b1561be34aa748c070f16a6c13cfa95d6b68027c2e

    SHA512

    c3e38c762d4712cc3991ee66ad6c91b0b758d08239fdb1d122aacb9c504ab9aade49ce38dc21a9c9596d9c499d141ba2178cfcf8c933cfb24a9f308bcba6e8e4

    Download Submit

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    c3e20f29ab2a46c7df37d38763b2f1ac

    SHA1

    b3412b65ec44ca9ea1bef01a60431d60dfee8564

    SHA256

    110cd557d871669cb1aec2a309b4aced60aaf4150b7843556a04167c2422d79b

    SHA512

    a839036fe65b9095f70895d13c9014c64ec11504a00e1aa305127f01e919c7d095dd45c508f5b9baf7a5ca73679e4e7e53c05b2ebce7e3ccdeb1181cc8d8a226

    Download Submit

  • memory/3580-39-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-41-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-40-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-38-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-42-0x00007FFE2A9E0000-0x00007FFE2A9F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-43-0x00007FFE2A9E0000-0x00007FFE2A9F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-37-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-387-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-388-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-389-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3580-390-0x00007FFE2CE10000-0x00007FFE2CE20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4024-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download