Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/04/2024, 00:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe
- Size 512KB
- Sample240408-adbbraae9z
- SHA256 afd35693c2339d6a6b68bb4500613c1d2d1c03cc79264b7d7472f6af409e4892
- MD5 e62c5177639e961570d81f9091ed4a45
- SHA1 65da596a28538bdc0451520cd2051948e1222fbe
- SHA512 35a501a0f5bdd2940574b877f8fc5b34fcf2a2014d8d64ac058ef1cfd9c3ccb6088800b9ef5cea30031692ad1bdb8973bbcc4b41e64ef2e318b1392d9587fef8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fluhcvcdtr.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fluhcvcdtr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fluhcvcdtr.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fluhcvcdtr.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2960 fluhcvcdtr.exe 4236 vtqpxztgogfxyez.exe 1312 fedmappz.exe 3092 kzztzbarjieeh.exe 4932 fedmappz.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fluhcvcdtr.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kzztzbarjieeh.exe" vtqpxztgogfxyez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\swenaeze = "fluhcvcdtr.exe" vtqpxztgogfxyez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kalahmqb = "vtqpxztgogfxyez.exe" vtqpxztgogfxyez.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: fluhcvcdtr.exe File opened (read-only) \??\w: fedmappz.exe File opened (read-only) \??\i: fedmappz.exe File opened (read-only) \??\t: fedmappz.exe File opened (read-only) \??\v: fedmappz.exe File opened (read-only) \??\g: fluhcvcdtr.exe File opened (read-only) \??\t: fluhcvcdtr.exe File opened (read-only) \??\a: fedmappz.exe File opened (read-only) \??\b: fedmappz.exe File opened (read-only) \??\k: fedmappz.exe File opened (read-only) \??\x: fedmappz.exe File opened (read-only) \??\k: fluhcvcdtr.exe File opened (read-only) \??\n: fluhcvcdtr.exe File opened (read-only) \??\u: fluhcvcdtr.exe File opened (read-only) \??\h: fedmappz.exe File opened (read-only) \??\r: fedmappz.exe File opened (read-only) \??\k: fedmappz.exe File opened (read-only) \??\n: fedmappz.exe File opened (read-only) \??\i: fluhcvcdtr.exe File opened (read-only) \??\l: fluhcvcdtr.exe File opened (read-only) \??\x: fluhcvcdtr.exe File opened (read-only) \??\y: fluhcvcdtr.exe File opened (read-only) \??\y: fedmappz.exe File opened (read-only) \??\b: fedmappz.exe File opened (read-only) \??\l: fedmappz.exe File opened (read-only) \??\z: fedmappz.exe File opened (read-only) \??\s: fluhcvcdtr.exe File opened (read-only) \??\e: fedmappz.exe File opened (read-only) \??\s: fedmappz.exe File opened (read-only) \??\h: fluhcvcdtr.exe File opened (read-only) \??\m: fluhcvcdtr.exe File opened (read-only) \??\a: fluhcvcdtr.exe File opened (read-only) \??\q: fluhcvcdtr.exe File opened (read-only) \??\r: fluhcvcdtr.exe File opened (read-only) \??\v: fluhcvcdtr.exe File opened (read-only) \??\u: fedmappz.exe File opened (read-only) \??\v: fedmappz.exe File opened (read-only) \??\e: fedmappz.exe File opened (read-only) \??\j: fedmappz.exe File opened (read-only) \??\u: fedmappz.exe File opened (read-only) \??\o: fluhcvcdtr.exe File opened (read-only) \??\g: fedmappz.exe File opened (read-only) \??\p: fedmappz.exe File opened (read-only) \??\b: fluhcvcdtr.exe File opened (read-only) \??\l: fedmappz.exe File opened (read-only) \??\n: fedmappz.exe File opened (read-only) \??\q: fedmappz.exe File opened (read-only) \??\x: fedmappz.exe File opened (read-only) \??\w: fluhcvcdtr.exe File opened (read-only) \??\i: fedmappz.exe File opened (read-only) \??\m: fedmappz.exe File opened (read-only) \??\z: fedmappz.exe File opened (read-only) \??\q: fedmappz.exe File opened (read-only) \??\o: fedmappz.exe File opened (read-only) \??\j: fedmappz.exe File opened (read-only) \??\o: fedmappz.exe File opened (read-only) \??\g: fedmappz.exe File opened (read-only) \??\m: fedmappz.exe File opened (read-only) \??\j: fluhcvcdtr.exe File opened (read-only) \??\z: fluhcvcdtr.exe File opened (read-only) \??\p: fedmappz.exe File opened (read-only) \??\a: fedmappz.exe File opened (read-only) \??\r: fedmappz.exe File opened (read-only) \??\w: fedmappz.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fluhcvcdtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fluhcvcdtr.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3980-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0008000000023206-4.dat autoit_exe behavioral2/files/0x000700000002320b-26.dat autoit_exe behavioral2/files/0x000700000002320c-32.dat autoit_exe behavioral2/files/0x000700000002320a-23.dat autoit_exe behavioral2/files/0x000500000001da81-66.dat autoit_exe behavioral2/files/0x000400000001db5f-72.dat autoit_exe behavioral2/files/0x000d00000001e707-94.dat autoit_exe behavioral2/files/0x000d00000001e707-99.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\fedmappz.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kzztzbarjieeh.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File created C:\Windows\SysWOW64\fluhcvcdtr.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File created C:\Windows\SysWOW64\vtqpxztgogfxyez.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification C:\Windows\SysWOW64\vtqpxztgogfxyez.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fedmappz.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File created C:\Windows\SysWOW64\kzztzbarjieeh.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fluhcvcdtr.exe e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fluhcvcdtr.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe fedmappz.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal fedmappz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe fedmappz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe fedmappz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal fedmappz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe fedmappz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe fedmappz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe fedmappz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe fedmappz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal fedmappz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe fedmappz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe fedmappz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe fedmappz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal fedmappz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe fedmappz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe fedmappz.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe fedmappz.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe fedmappz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification C:\Windows\mydoc.rtf e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe fedmappz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe fedmappz.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe fedmappz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe fedmappz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe fedmappz.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe fedmappz.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" fluhcvcdtr.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc fluhcvcdtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" fluhcvcdtr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf fluhcvcdtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fluhcvcdtr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs fluhcvcdtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fluhcvcdtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC6091597DAC5B8CC7CE9EC9F34CB" e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fluhcvcdtr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fluhcvcdtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAF9B0FE17F29984783A4B819F3996B080028843150248E2BE429E09A0" e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB6B12F479539EF53CFB9D233EED4CC" e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFC8D4F2A826E9032D75A7D94BCEFE141593767426344D79C" e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F268B2FE1821ADD208D0D28B089116" e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" fluhcvcdtr.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452C0F9D2C83576A3F77D670252CDA7CF365DB" e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat fluhcvcdtr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fluhcvcdtr.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1788 WINWORD.EXE 1788 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 2960 fluhcvcdtr.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 4236 vtqpxztgogfxyez.exe 1312 fedmappz.exe 1312 fedmappz.exe 1312 fedmappz.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 3092 kzztzbarjieeh.exe 4932 fedmappz.exe 4932 fedmappz.exe 4932 fedmappz.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1788 WINWORD.EXE 1788 WINWORD.EXE 1788 WINWORD.EXE 1788 WINWORD.EXE 1788 WINWORD.EXE 1788 WINWORD.EXE 1788 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2960 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 87 PID 3980 wrote to memory of 2960 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 87 PID 3980 wrote to memory of 2960 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 87 PID 3980 wrote to memory of 4236 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 88 PID 3980 wrote to memory of 4236 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 88 PID 3980 wrote to memory of 4236 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 88 PID 3980 wrote to memory of 1312 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 89 PID 3980 wrote to memory of 1312 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 89 PID 3980 wrote to memory of 1312 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 89 PID 3980 wrote to memory of 3092 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 90 PID 3980 wrote to memory of 3092 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 90 PID 3980 wrote to memory of 3092 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 90 PID 3980 wrote to memory of 1788 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 91 PID 3980 wrote to memory of 1788 3980 e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe 91 PID 2960 wrote to memory of 4932 2960 fluhcvcdtr.exe 93 PID 2960 wrote to memory of 4932 2960 fluhcvcdtr.exe 93 PID 2960 wrote to memory of 4932 2960 fluhcvcdtr.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e62c5177639e961570d81f9091ed4a45_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\fluhcvcdtr.exefluhcvcdtr.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\fedmappz.exeC:\Windows\system32\fedmappz.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4932
-
-
-
C:\Windows\SysWOW64\vtqpxztgogfxyez.exevtqpxztgogfxyez.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4236
-
-
C:\Windows\SysWOW64\fedmappz.exefedmappz.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1312
-
-
C:\Windows\SysWOW64\kzztzbarjieeh.exekzztzbarjieeh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3092
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1788
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 243c4ea5520684030f231b9b17bdff4b8f7619882f7b1e78f5b452d17b7e5e9c
- MD5 e45fa9c1bab2eadb3026ae822361db03
- SHA1 04e6cb1b6048a7c338e1e8730236ebfc1c66f33e
- SHA512 abb1256bfc502910cbb4c1e20a8feeb63ab4935f9497ee5ee5f3f1ded8af120da5ca2fcab6e31edab1dd9c02dc1e184990fbcd18205cad0f635431b6c99a9367
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 355e4fd1d7a85c3b704073d27fcb8ebf8e4795d7d203c5c6850e1a9259280d2f
- MD5 857e86473f09a477a36091d8339eabc2
- SHA1 c347e7d37fe4da30cbbaf3c8afeb8b9aa7f56ebb
- SHA512 71baabb9068f70743d97fcd597c5a520565994bac526f641a9a002e29253242260b51b796baa32b788a98e782d873f936ed599662e12f7f23f237f8fb0bce6c3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 2024e10e35dfa5ddbf07aab879c539ef0523efa33768525299c5be8fe4f40d11
- MD5 d547eea2056cf565235b0a584f287f9a
- SHA1 87ff94ce534bebe335d794599f97c915029065d0
- SHA512 2ed946cffe4fcf21a2124b9b73f18dc470cb42f0cbaba6629012e09508b3e2c22493931047675d5edbe2b3d07efb344f37ecb2481a5f12213ed770f3eafeb8f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 96aa660fb5c3acbe8faec940c447ac0c6b952ab9e16db3d71b577101539b9cb0
- MD5 3541c322b90ea0e21d16ed46f5bb1f7b
- SHA1 2506045b70c02c380c64d8c90df0b4cd9f1dfa73
- SHA512 064e672f02ae6cbef5f9e49c672a21209fc569cee66964cef10d1b679931767f0b814a0152d1fddbbfbb0c32b681928e39bc0292d56c29eaa0de10c8744134c2
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\fedmappz.exe
- Size 512KB
- SHA256 1296e4d6eece31c7062b9df14beea5ef81108fd038e8a48439e2839052e40141
- MD5 42bb91e6b8ffa11e9ffe27b3da31b523
- SHA1 11a2237e41c229def278ad3e3fb3d1960af5d5ff
- SHA512 301144d6e5a5359276ad4d196c4d0a5dfa0febf4e655aa54d45e02a3e94569254eb2fc483257ce6ee0956dd3dac9fb64f589fcfd7823d0eba83361c28b446c08
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\fluhcvcdtr.exe
- Size 512KB
- SHA256 eed395741f37061739ea6cadfa069389dc7bf5a2490d5a1a5d7c853066a583bd
- MD5 976b76f67727bd75b8859dbdfc864c23
- SHA1 e410d9597f7e6e64cc2d9a904cb438a4d54c1c80
- SHA512 42ae1130af8bc147805229ff41914f23d788ecd6728bb73452107ef5877172ee03ecf07fc8923c2fd680df8a9fcee0e30b54a569942ee6ceca9eba6171694b5a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kzztzbarjieeh.exe
- Size 512KB
- SHA256 5fb86a8c25a59b5c5e21b866fb8e09773d4be0a954c21ab00eb17d1d9e634bc2
- MD5 4ec83190ac46b732abfd2721255a3eaf
- SHA1 7e4f5a2453b84ed6e465619539207676e7e117ce
- SHA512 466e4684ec6b35c8e1ae14b173b565e28f3fa012116e060446b3b385ecf3891dd382ef1d970eb720ca73822eff5697dc4adf7266b84ec7cb763a6809d9f4fff5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vtqpxztgogfxyez.exe
- Size 512KB
- SHA256 2307f3619c89ef43378dd66217e6ac536b3317b0cf83b7f7a9dfabb7da7f5b02
- MD5 f72579fa7483a0ff1d7b2157b46f7131
- SHA1 8193897116c37b5e045a86e3b595bcacc14400ec
- SHA512 dc4e0599145bd502d58f235754a556baa662177a5d0dba2ab60204c68997648105dbfec576493672fbdea5f74141e640826eb563c26332a63bdc30550910dda3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 1092d5db8a1cc4d97bfef0a1fc42036a12ef7192ce4781a380005b5e32ab11b0
- MD5 cc3dd9494b98b1ef3b9fb161c0a46421
- SHA1 49f5de5449c51401ccebbd4c703de0b8b2b95607
- SHA512 4d189279e28222283e17c42ed47d4e29ed1830efbdb6d9e8a61f0dd12e4d5ddf42e1b6a078bbeea2f4f074606502ab44891411e19af2e0277f0b7187ee34153f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 a543a43b922a58681fe50da8f26227f2b8ae1186457b4f4d3a6a9ee1232c811a
- MD5 af25bff0e1c31ff7cb87edd6431bee13
- SHA1 5038d755e485684e713c6759af6437ab1a71c2b2
- SHA512 c6369838fe13c42616b008c98b6422400d52a621917ba6346d990b87d6018f3ee4d88c221606ed92bac927ad9dff5b3ca4aa37c37d9eccacd55be65d77f10b60
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- MD5 SHA1 SHA512 SSDEEP