Overview

overview

10

Static

static

5

fa7c328ed1...18.exe

windows7-x64

10

fa7c328ed1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 13:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    fa7c328ed1155f461e2907e95e71888e_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    fa7c328ed1155f461e2907e95e71888e

  • SHA1

    f62a47454d0705212e9c84681bb68da2e8547ea4

  • SHA256

    b71dba1e942d77326b3aab54a73fdafe2e195a6e22fa73eb9ab023dfc4544b3a

  • SHA512

    30d2a24208a5bce51226f559ca4470e2bb01ca5e6360815b6243307fefddba4ef96cdc80d9d372099e2138a266b052533a71d75f4b294ae1ef7ec7a8229288cc

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa7c328ed1155f461e2907e95e71888e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa7c328ed1155f461e2907e95e71888e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Windows\SysWOW64\ycslkabysa.exe
      ycslkabysa.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\SysWOW64\bipunwae.exe
        C:\Windows\system32\bipunwae.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:916
    • C:\Windows\SysWOW64\dvnzwpajkvpqfoy.exe
      dvnzwpajkvpqfoy.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3612
    • C:\Windows\SysWOW64\bipunwae.exe
      bipunwae.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4788
    • C:\Windows\SysWOW64\hxgrrdcixkwbz.exe
      hxgrrdcixkwbz.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1576
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3004

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Modify Registry

        6
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        4
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
          Filesize

          512KB

          MD5

          a7de09472d4133108e63b7a2f96cbc86

          SHA1

          fe446edab319f2d4bdd5a17d41ff5e9ef713e8b8

          SHA256

          78b8127f4d8245d59d86398db32287fe63313b74e844fdb4139b2329844a6e6e

          SHA512

          e49814fde71d6c77a52821d6bc379a75e2deaeed20177e1d6f12642c613b02f3b0521ea70b891cb90c39071b2087a68ca3bceb56a7be2aa2edea0334245c074d

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
          Filesize

          512KB

          MD5

          baa6f60c6108668b1e2ddc5c401b6f50

          SHA1

          bf56b432516ed3ebecd1eeb5ad398e4980f2d17f

          SHA256

          880bdd624a5734f18548cdc358535ca127b8de8f855feadd229da3a8081a0eb3

          SHA512

          98006ebab6c3836690c732c56446a49f3806db64479f711ac5b0a92d6612a52bc8bebbfe065ce4a4e71ae038502c6693f79788168e29810032546f275458c9c4

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          Filesize

          257B

          MD5

          24cd80077f61c414edb7150dde297822

          SHA1

          2e30a320e1381f40efd8f5c1786be69b5e4a3f08

          SHA256

          d3d99afe05f200e532960b1c22b8818cb1cc43545eca238b15f06109a7fc537e

          SHA512

          463947108e0a95c9b328669fb8e698a57e2728470c2b769283341c4a4f43614a86148fe2432fa9cc6c18a907858c0638fba22ca9b144a2fd3186b79193f4ade1

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          2KB

          MD5

          89b58231d7be3de263f4ee8b6f15041f

          SHA1

          fc7b770eefa2e4f9667c06c0eacb3059ddc1c566

          SHA256

          cc04d12c1a22b7159cc31e209f2691aca8c2041c03d9f0ea42e8e576e7784fb7

          SHA512

          28dd313fa7cc6cef78b7e938802dcf584357132e40978ff46c190e5a7c19573da060523a8a438a6e911a8d8374cc57e3c514a3365589f385ce9dc7aa23936535

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          Filesize

          1KB

          MD5

          dcfc0285e65f789d4e64f3b34f59799c

          SHA1

          90686dc7e0f0ca3f0ff1b0942547b8567c6e96c5

          SHA256

          e9b65631b0bc9d4d3dcdfe43eab0ff44cd1dc3e55ae2fdf87c9c1797f13baa39

          SHA512

          93f3ee71c78c9a1abb2f8b343d088735d52c522777fbe73dff76fa257fddb300cefab31c381110221e6364fa0bc434d64e49de8ff7ec79483f4713bf724ae4cc

          Download Submit

        • C:\Windows\SysWOW64\bipunwae.exe
          Filesize

          512KB

          MD5

          c62594352fab7112c612637f3b7ba2b1

          SHA1

          810be4a4cd723070115f7075db497d92d7471b88

          SHA256

          73e670bae1649ed858cc43922d24b69fc3bc3637d8f3aea247cb56f597a3d140

          SHA512

          098ee3078eb6b1890fd347522a7c31dffc543f50bd1d1ee547bc53ef401d598682f616bf901220801d29805782e8cbaa479a7f84206ab392d40876ee54965f56

          Download Submit

        • C:\Windows\SysWOW64\dvnzwpajkvpqfoy.exe
          Filesize

          512KB

          MD5

          ff401bd6f3eaccaaca965d791a444188

          SHA1

          e80f0e31cd14b6392af51187f3d268c0446caa36

          SHA256

          a0ab7ce8c33d4ad9ce075d27b8891561c1fb6bef39e2e221dce99dbf64bc3242

          SHA512

          b6b23b9c5a00dca8a66356bf3bd88b5b8f553ce1ee8237f388a71e4d572320931b9629c93fbea2cc324a87c741f7a1690576d5dd35e6ca128f930c732b4037fc

          Download Submit

        • C:\Windows\SysWOW64\hxgrrdcixkwbz.exe
          Filesize

          512KB

          MD5

          ba3b968700864e07be002b35b8362f2b

          SHA1

          5c9635c9843a7f7a7ddba10d21f1f84df40340d5

          SHA256

          df5f4e31927a71c3069d9d6ffc980c6340e135bde3e142cef2a86507772d26b4

          SHA512

          8709d5d151478e34a3b34001ab4e6d0a2dbfe092ac9303e6d45a69d2c23a9a81dc4f5500675c5d802bda16ee236dd1b57d11a5171d5c422663639190a26f2810

          Download Submit

        • C:\Windows\SysWOW64\ycslkabysa.exe
          Filesize

          512KB

          MD5

          fdfd42e196101f8e178c21cdca02e6d2

          SHA1

          59844d6f5a0e00329626c293252dcb42d4b48e7a

          SHA256

          e0f410a596d985682eb908974a4eec17953b9f5dd912ae51b913e2aaa8dd524a

          SHA512

          2c3566a9e9e87c7d0461f1b77001faa43523a768daa2c65067b8756d138cfe8e5ddc5c19c0a6cb7fd9f37953dddbe9cf9931ce46cb758b7c6c926fada38f2561

          Download Submit

        • C:\Windows\mydoc.rtf
          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          a31ecf5cf8ab0476e83dff8bdcbbb298

          SHA1

          80467fe5390493eb26b2c9455111963fbf41c82f

          SHA256

          564ac960d5caf5ed1ada841f83592f1918a2ec0b55007f5215559a3d8a4d6c3b

          SHA512

          18bf151301a374b05d28573591f46b77c2d9e66c2b3b2e9fd48ea53fc248efa991646bc73124d1b443646fcf0631ae503ba2bd8e8fd4422c6f5e4e8e0d3e3e43

          Download Submit

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
          Filesize

          512KB

          MD5

          28de355eea98eac8c098bcd2f6f7b79a

          SHA1

          2ee78def631626b24a7bec7e135f02254e2f7646

          SHA256

          f68038084bc49081a74af40672cc703128a4760dcd8f512aab8caaa2b6cfe727

          SHA512

          4611108b9a6b5d6838ba31c7c95ee3f466b3ea22da331dec2da533cdd84d5537ab80caeeef00330747766a528c76f63a4ee40df4d0ea86ea5295f965a8960928

          Download Submit

        • memory/3004-37-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-39-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-40-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-41-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-38-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-43-0x00007FFC36EE0000-0x00007FFC36EF0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-42-0x00007FFC36EE0000-0x00007FFC36EF0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-585-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-584-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-587-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3004-586-0x00007FFC394D0000-0x00007FFC394E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4816-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download