Overview

overview

10

Static

static

5

f65eb219b3...18.exe

windows7-x64

10

f65eb219b3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 16:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f65eb219b3f600691f3d107086f69a64_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    f65eb219b3f600691f3d107086f69a64

  • SHA1

    9e1df9b4b85cd00867a617e8667fd963d37588af

  • SHA256

    38f07c6c853142e95b203761f4eaf66f97b032106466b4269c094fe0bffbdc26

  • SHA512

    f17a4c862f4cb148d9c9765778200943d918910d0e98102c955c0cb1c4f991ed03e80b9fdc2dbce07c729ba87c41716543b20bd9978307406bb8e442d7687bea

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f65eb219b3f600691f3d107086f69a64_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f65eb219b3f600691f3d107086f69a64_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\rkniowlqaj.exe
      rkniowlqaj.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Windows\SysWOW64\mpcqgnuh.exe
        C:\Windows\system32\mpcqgnuh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2016
    • C:\Windows\SysWOW64\yxydkefnavowhfj.exe
      yxydkefnavowhfj.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3844
    • C:\Windows\SysWOW64\mpcqgnuh.exe
      mpcqgnuh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1488
    • C:\Windows\SysWOW64\lddsrfkxxpfyf.exe
      lddsrfkxxpfyf.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1936
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4292

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Modify Registry

        6
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        4
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          dc157a49408ffe2577bc02a2b238f332

          SHA1

          4eb240a98343972269bf67cd7d86c473e0885c77

          SHA256

          72a8e4d6c619429cad4509f7af2e905934d2c27bfaf93deb53c417fed8a45183

          SHA512

          254d4aaa7d5384bfe2db0c3a4eb32089e6712d11d79f2f12dacb76a3dd98f595630ec082024d45c667eb528130a6551f72a4d25dc285d2685912b0021a7937d7

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          8b2b0d107a006681a16429a4c99cbbb3

          SHA1

          a26426d2e776ae594277810c1b69b2dd99acf689

          SHA256

          9f028de17edc20e22335022de47d967fc619a545bdbececb8dffda3fa649b900

          SHA512

          9f21c02798b22835db4f06aeae70b3dfdb90c5f9f770cd28d84bcca853395c74adee6993834f4e7a183b27e8fa3f21cb99ccba957b26f04211a64933e87e8e39

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TCDD1D6.tmp\sist02.xsl
          Filesize

          245KB

          MD5

          f883b260a8d67082ea895c14bf56dd56

          SHA1

          7954565c1f243d46ad3b1e2f1baf3281451fc14b

          SHA256

          ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

          SHA512

          d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          Filesize

          297B

          MD5

          7613fd8ff9ec1a60e4ae147319a5b912

          SHA1

          b2221e1a590311f9448a3b9bdee24a3748da8524

          SHA256

          597db3687448745ad002f2c5e026777826294b48663cbb4d3ae579be405957eb

          SHA512

          3dc9dd32c660eaa87f822db29aefdea296224e852058099b61ad18cef8d871c564c2a2c63056aa92c68c83ca746a896dc1878a8b54ef3431afb5976579105b32

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
          Filesize

          16B

          MD5

          d29962abc88624befc0135579ae485ec

          SHA1

          e40a6458296ec6a2427bcb280572d023a9862b31

          SHA256

          a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

          SHA512

          4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          1KB

          MD5

          d1bcf3a21dc501545d98c160d0b2d241

          SHA1

          7e87e769e6c3b8d7e136b60523e03fdbacdbde3e

          SHA256

          460822bbd3598ace3670fe660234e808af34bef3b570f343ae9c2adf3e8b9ac0

          SHA512

          ae4c930ac9a7a6a3b914188527236cb0079d8ed3df0273057562101d29d2dcbc84109fc86ea8689a24cbb6862dbb9dd88252bd13b3f9401adf894ef7bba8140b

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          2KB

          MD5

          690ff72228bf2e96a30814f034dbf9dd

          SHA1

          9bb8a25a4a652defaab98e4f9faadbee961db5db

          SHA256

          bcd522a0e4525ca7cbe2aab5cc28eb9834aaff7a9c3e9898c66c35611aef9d5b

          SHA512

          0e0571130216fdff4256e0b50d1aa3ef8b8ef856031e32a72a02363b99f67c794655a45a3606ced4a5e30354721705a53f76a543d88eaedc1b85d57cef79e9a0

          Download Submit

        • C:\Windows\SysWOW64\lddsrfkxxpfyf.exe
          Filesize

          512KB

          MD5

          beb2f605745ed30b56ac5584b2f6cfe0

          SHA1

          d6feab4d7bf6f319d22dadd1eb13e3656946c193

          SHA256

          b08d6938090c19026a6ddba3e58f250a6c14f15950cfc6493e74599ea6091953

          SHA512

          23ff618f9f8d5cb6b1806f85fa6e6833c83216e58bd35962b5023f533399745816a18f5460adf1bb4c8a4683984881b1377dfdc43ddf971b928eff128f76ec7a

          Download Submit

        • C:\Windows\SysWOW64\mpcqgnuh.exe
          Filesize

          512KB

          MD5

          b9e6f1692629e707fef8ade5e796b559

          SHA1

          62cd818848acd6a9f2e7b55be013a14df1de6a0c

          SHA256

          24c12ebe3270d2a87bcf77d0885288581cd6d23a64b33020dcfdd6c59a746b84

          SHA512

          7a7a55e366ab4457d5f74abccbcc8381ddefa4ee7794f9197058a916d43cfd724dcf7e2c92f5e7254656c29fafbf4e986401d01e6a645a712fd2cd3521e149bb

          Download Submit

        • C:\Windows\SysWOW64\rkniowlqaj.exe
          Filesize

          512KB

          MD5

          cfd99ab13abeefe4291fb649ee85a5ad

          SHA1

          07b006524c3a58c94bf2feed261fb4a78433389f

          SHA256

          915b98434c230fa8d3473e184e55f6f0bd6c9a0c04da237915b1e462b6392bfe

          SHA512

          adc848942f26c088e56d08c60278cc6c22189f53fe443e77257e666a228db856a32087c25f818963c2578f9763a18213ed24553efb369da131cb9b6f7df90625

          Download Submit

        • C:\Windows\SysWOW64\yxydkefnavowhfj.exe
          Filesize

          512KB

          MD5

          d7cd988e7dc79dff20a047073112f0b4

          SHA1

          e9e772ea546233166592008349a168fb47df1d4d

          SHA256

          9e2e50aba8e0fb7d89b9f889556f46d4977b58660099783640f3ca2df2ea01c5

          SHA512

          703217950af2915575abac07c68de2ed678de69c528239cc3baeb7f4a6ab7ce368cc1a4fdde03abf78fd6d8767cf4c83717d700e129b5e1d7b8341269a24a017

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          8c6aed11a39e2cf584e7abbb1303ec88

          SHA1

          9caaf8ec19f57926ba89e95ee9c9f1a874ebfde7

          SHA256

          26bbf1b39de0715f4d19f6bb05e39e7b2311e6897973c7fa57b4436aff86ec3e

          SHA512

          0ee01154830495204646b9ed2bfff389f289b33f89c48d545c084efec4f6f575a4c0bbd721d4553fca779208d9055e9c8215e11bec2d31b409c198ac0cb00db8

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          916b14bc2228a96cacfff9d276c5e024

          SHA1

          8e46a60cfa1a42df65d7702b6e6d95b543f71860

          SHA256

          d6d5582a163b443fc47089aec9635ea1578aca9e4c1b304172563484c9f7c518

          SHA512

          b56bbb6352d1198e9d04abcfa8a93040cb26fc81a786f85ec726efd69787b84d7205434a5003bf8313302ff64e520c47410eb9e00981c05dac08e90e63262021

          Download Submit

        • memory/1740-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download

        • memory/4292-38-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-36-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-37-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-35-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-40-0x00007FFE61950000-0x00007FFE61960000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-41-0x00007FFE61950000-0x00007FFE61960000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-39-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-602-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-605-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-603-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4292-604-0x00007FFE641B0000-0x00007FFE641C0000-memory.dmp

          Filesize

          64KB

          Download