Overview

overview

10

Static

static

5

fb3404e916...18.exe

windows7-x64

10

fb3404e916...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 00:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    fb3404e91682666191ca2521075cdf8c_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    fb3404e91682666191ca2521075cdf8c

  • SHA1

    f7b0d536ab155235c4edf528035d1a1a4d48702c

  • SHA256

    351124adf2040c41417cc0eae67a53125c5c6f6ada75087425890ed36deeaace

  • SHA512

    ff86934a229e4de766addcfdb9ebe46ec89ac2281afbac53af7d612dceefe4c6384702dcecb311e5ddc7ed2b4203e7bc2acd493a3a25eec7765f0f5fc9a5ae57

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 24 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb3404e91682666191ca2521075cdf8c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fb3404e91682666191ca2521075cdf8c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:276
    • C:\Windows\SysWOW64\bnqulipakh.exe
      bnqulipakh.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\SysWOW64\bomkishv.exe
        C:\Windows\system32\bomkishv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2840
    • C:\Windows\SysWOW64\ukjcwmzvrtvufhk.exe
      ukjcwmzvrtvufhk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2852
    • C:\Windows\SysWOW64\bomkishv.exe
      bomkishv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2704
    • C:\Windows\SysWOW64\fklsqhagzwojq.exe
      fklsqhagzwojq.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2812
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2908
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2648

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          3
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Privilege Escalation

          Boot or Logon Autostart Execution

          3
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Defense Evasion

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Impair Defenses

          2
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Modify Registry

          7
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            c3c4a6d6f8b49686b7aca1c074dda67d

            SHA1

            40af022fe17ce383015c73829943726014330387

            SHA256

            72c7e65b5e2bf329dd60e2a76d0611ea3d396cd716c493c2fb82fe66e4ef7100

            SHA512

            e7696edad474e731a576772974ba73e5d53d1ec82d4c8acc2716c3b5feb487ff015cfdad6e5b839406c37823665cf32b46b548863c151cb20bd6138b21213ed1

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            b0024c15357a1cde98476a57b9af0877

            SHA1

            e88a04ea5b162bf5e28eacca4ad5a5bb76ab27c4

            SHA256

            91d9f8d01f8a12fbf2f668c0a3c0df1eb9ccf3687097e7d06c86adf715252825

            SHA512

            85a9208f07bfb21343cbbdf119a50cded9f202cd5fa1a801731100ba2b0923ca2ed246254dd79d07ffd2ab7beb3b5cc83bfc4ea179677fc1777f3830fdf42823

            Download Submit

          • C:\Users\Admin\Documents\InvokeUninstall.doc.exe
            Filesize

            512KB

            MD5

            bc989ae5e2698363b62e0263d07f5e11

            SHA1

            f7156ca3a80f90723ce44dc293c6d967b60f62b4

            SHA256

            4bb2c11fd557f08a349f9c9789da04c3f89d9a582c55d956ef42b20f1e744246

            SHA512

            8adf27825067e44b5af21890c0b63773904443607d5fbbf6244d25950be3510a32d3db32076ca7ff2ed8f3333b59e4cb2040bf74edeaa048ca293551887d6802

            Download Submit

          • C:\Windows\SysWOW64\fklsqhagzwojq.exe
            Filesize

            512KB

            MD5

            6c9001f6efd87320b559fb6c32e9ffce

            SHA1

            ddf2cd9033029791d0023d805c34b63b44876071

            SHA256

            09b7c208cc7aa76edc66d4060d2702c4fb4f3136f6680e5ee079bd1d438ccabe

            SHA512

            ac098a88bb741174233238c248b7fc06ce969856a4fbbdf9a11ef6bf03f093e445f042558f9de4053bdfddbb576e6d794f62d37392af92bf0b599e7a12b35d10

            Download Submit

          • C:\Windows\SysWOW64\ukjcwmzvrtvufhk.exe
            Filesize

            512KB

            MD5

            28a6e6bb0a35b29854357661c3fb71dc

            SHA1

            efd243b156f81243a6c9fe59e5ec52d3077c4917

            SHA256

            805d840a005f163c8262b2cb48944eb901c1ed8de58641a4c073b437f9fe32ea

            SHA512

            dfb72280b8b59788f8db64aff6e50736e93b340db698700d9651d327ee310ac79d50a6a15fc77ea8880f516878926ea06937334ad47f23a46c7a47781c03686a

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\bnqulipakh.exe
            Filesize

            512KB

            MD5

            ac6b16b6ef436d9fec3abc2e4446d4b4

            SHA1

            3fa344ab5a2b79f3a182c7289af5716d555d128c

            SHA256

            2756f25281faeb1c630c56be7d4322d04e443851deaf518f8ac2cc9dad5d3cb4

            SHA512

            ffc1d7ec9b262a65ad82ec3449764cb1b94a0992424ab1c7533d2d7f53ed34fe3abafb91de1a2f25edced6fef266f5f226d1758734974d589c39b20874247633

            Download Submit

          • \Windows\SysWOW64\bomkishv.exe
            Filesize

            512KB

            MD5

            79ed306d7fefefb84855727ad5a6c80b

            SHA1

            a7ef27a50b1a89c648b08d6dc1a7902d1ba3424e

            SHA256

            a61cbb34e909f4bfc38a798b06c41008ce93e07b2c3cbad074b6341282ea8ac3

            SHA512

            89bc3d2189f37a376c1b6d66880502896741eb28fe326988776d036e13206656d78487e2b1e473f12af518657ee00318e4cfdf69eba164e4b33a8f3e23632c1f

            Download Submit

          • memory/276-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2592-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2648-85-0x0000000003D60000-0x0000000003D70000-memory.dmp

            Filesize

            64KB

            Download