Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 16:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe
Resource
win7-20240319-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe
-
Size
512KB
-
MD5
ea66de35fccee48b59a4b2f6b0a59443
-
SHA1
f7b5a0c65b4e0e625fa981189f7d641e3ed86b60
-
SHA256
834700b75b173085d276886ca050cceba15c2ce3028b66d372447192e2772868
-
SHA512
46e8f5f8eb12c9a8253e19149c47489a6ebb8ec5d0fa4aebb9c269c49ca74f78d69933e8be82a5739b5fe74c647ead1be4b58baf3128e5bbb8e8fdd236d72988
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jkfupsiowm.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jkfupsiowm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jkfupsiowm.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jkfupsiowm.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 4932 jkfupsiowm.exe 4696 cjswpefx.exe 4392 vxljrhednceuf.exe 4624 kfzrtmcdsviftmn.exe 2588 cjswpefx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jkfupsiowm.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nllmoelw = "kfzrtmcdsviftmn.exe" kfzrtmcdsviftmn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "vxljrhednceuf.exe" kfzrtmcdsviftmn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xgmwizvo = "jkfupsiowm.exe" kfzrtmcdsviftmn.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: jkfupsiowm.exe File opened (read-only) \??\b: cjswpefx.exe File opened (read-only) \??\s: cjswpefx.exe File opened (read-only) \??\b: cjswpefx.exe File opened (read-only) \??\a: jkfupsiowm.exe File opened (read-only) \??\g: jkfupsiowm.exe File opened (read-only) \??\u: jkfupsiowm.exe File opened (read-only) \??\n: cjswpefx.exe File opened (read-only) \??\z: cjswpefx.exe File opened (read-only) \??\w: cjswpefx.exe File opened (read-only) \??\r: cjswpefx.exe File opened (read-only) \??\i: cjswpefx.exe File opened (read-only) \??\e: jkfupsiowm.exe File opened (read-only) \??\h: jkfupsiowm.exe File opened (read-only) \??\i: jkfupsiowm.exe File opened (read-only) \??\m: cjswpefx.exe File opened (read-only) \??\h: cjswpefx.exe File opened (read-only) \??\p: cjswpefx.exe File opened (read-only) \??\v: jkfupsiowm.exe File opened (read-only) \??\w: jkfupsiowm.exe File opened (read-only) \??\k: cjswpefx.exe File opened (read-only) \??\x: cjswpefx.exe File opened (read-only) \??\l: cjswpefx.exe File opened (read-only) \??\u: cjswpefx.exe File opened (read-only) \??\x: cjswpefx.exe File opened (read-only) \??\k: jkfupsiowm.exe File opened (read-only) \??\m: jkfupsiowm.exe File opened (read-only) \??\o: jkfupsiowm.exe File opened (read-only) \??\a: cjswpefx.exe File opened (read-only) \??\j: cjswpefx.exe File opened (read-only) \??\q: cjswpefx.exe File opened (read-only) \??\v: cjswpefx.exe File opened (read-only) \??\p: cjswpefx.exe File opened (read-only) \??\u: cjswpefx.exe File opened (read-only) \??\a: cjswpefx.exe File opened (read-only) \??\w: cjswpefx.exe File opened (read-only) \??\s: jkfupsiowm.exe File opened (read-only) \??\m: cjswpefx.exe File opened (read-only) \??\p: jkfupsiowm.exe File opened (read-only) \??\z: jkfupsiowm.exe File opened (read-only) \??\o: cjswpefx.exe File opened (read-only) \??\q: cjswpefx.exe File opened (read-only) \??\g: cjswpefx.exe File opened (read-only) \??\y: jkfupsiowm.exe File opened (read-only) \??\e: cjswpefx.exe File opened (read-only) \??\y: cjswpefx.exe File opened (read-only) \??\j: jkfupsiowm.exe File opened (read-only) \??\b: jkfupsiowm.exe File opened (read-only) \??\r: jkfupsiowm.exe File opened (read-only) \??\g: cjswpefx.exe File opened (read-only) \??\h: cjswpefx.exe File opened (read-only) \??\l: cjswpefx.exe File opened (read-only) \??\t: cjswpefx.exe File opened (read-only) \??\v: cjswpefx.exe File opened (read-only) \??\j: cjswpefx.exe File opened (read-only) \??\o: cjswpefx.exe File opened (read-only) \??\r: cjswpefx.exe File opened (read-only) \??\s: cjswpefx.exe File opened (read-only) \??\x: jkfupsiowm.exe File opened (read-only) \??\e: cjswpefx.exe File opened (read-only) \??\n: jkfupsiowm.exe File opened (read-only) \??\k: cjswpefx.exe File opened (read-only) \??\n: cjswpefx.exe File opened (read-only) \??\l: jkfupsiowm.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" jkfupsiowm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" jkfupsiowm.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3160-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000700000002321c-5.dat autoit_exe behavioral2/files/0x00090000000231d1-18.dat autoit_exe behavioral2/files/0x000700000002321d-25.dat autoit_exe behavioral2/files/0x000700000002321e-26.dat autoit_exe behavioral2/files/0x000400000001db64-73.dat autoit_exe behavioral2/files/0x001000000000a314-82.dat autoit_exe behavioral2/files/0x000400000001e7fd-100.dat autoit_exe behavioral2/files/0x000400000001e7fd-105.dat autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjswpefx.exe File created C:\Windows\SysWOW64\jkfupsiowm.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cjswpefx.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File created C:\Windows\SysWOW64\vxljrhednceuf.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File created C:\Windows\SysWOW64\cjswpefx.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vxljrhednceuf.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll jkfupsiowm.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification C:\Windows\SysWOW64\jkfupsiowm.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File created C:\Windows\SysWOW64\kfzrtmcdsviftmn.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kfzrtmcdsviftmn.exe ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjswpefx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjswpefx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cjswpefx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjswpefx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjswpefx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjswpefx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjswpefx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjswpefx.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjswpefx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjswpefx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjswpefx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjswpefx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjswpefx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjswpefx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjswpefx.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjswpefx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjswpefx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" jkfupsiowm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" jkfupsiowm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" jkfupsiowm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302C0A9C5682236D4577D3702F2CAA7CF264AF" ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B1204494389E52CEBAD73293D4CE" ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8CFC8F482C851B9041D72F7D90BD90E13C594467426244D7E9" ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0866BB2FE6922DFD279D1A48B7F9165" ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" jkfupsiowm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABEFAC9FE67F2E084743B3586983995B38C038B4361033FE2CA42ED08A4" ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184EC67D1597DAB6B8CB7CE1ED9237CE" ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat jkfupsiowm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" jkfupsiowm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg jkfupsiowm.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf jkfupsiowm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs jkfupsiowm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" jkfupsiowm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh jkfupsiowm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc jkfupsiowm.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2900 WINWORD.EXE 2900 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 4696 cjswpefx.exe 4696 cjswpefx.exe 4696 cjswpefx.exe 4696 cjswpefx.exe 4696 cjswpefx.exe 4696 cjswpefx.exe 4696 cjswpefx.exe 4696 cjswpefx.exe 4624 kfzrtmcdsviftmn.exe 4624 kfzrtmcdsviftmn.exe 2588 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4624 kfzrtmcdsviftmn.exe 4696 cjswpefx.exe 4624 kfzrtmcdsviftmn.exe 4696 cjswpefx.exe 4624 kfzrtmcdsviftmn.exe 4696 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4932 jkfupsiowm.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4392 vxljrhednceuf.exe 4624 kfzrtmcdsviftmn.exe 4696 cjswpefx.exe 4624 kfzrtmcdsviftmn.exe 4696 cjswpefx.exe 4624 kfzrtmcdsviftmn.exe 4696 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe 2588 cjswpefx.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2900 WINWORD.EXE 2900 WINWORD.EXE 2900 WINWORD.EXE 2900 WINWORD.EXE 2900 WINWORD.EXE 2900 WINWORD.EXE 2900 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3160 wrote to memory of 4932 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 86 PID 3160 wrote to memory of 4932 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 86 PID 3160 wrote to memory of 4932 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 86 PID 3160 wrote to memory of 4624 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 87 PID 3160 wrote to memory of 4624 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 87 PID 3160 wrote to memory of 4624 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 87 PID 3160 wrote to memory of 4696 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 88 PID 3160 wrote to memory of 4696 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 88 PID 3160 wrote to memory of 4696 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 88 PID 3160 wrote to memory of 4392 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 89 PID 3160 wrote to memory of 4392 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 89 PID 3160 wrote to memory of 4392 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 89 PID 3160 wrote to memory of 2900 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 90 PID 3160 wrote to memory of 2900 3160 ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe 90 PID 4932 wrote to memory of 2588 4932 jkfupsiowm.exe 92 PID 4932 wrote to memory of 2588 4932 jkfupsiowm.exe 92 PID 4932 wrote to memory of 2588 4932 jkfupsiowm.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea66de35fccee48b59a4b2f6b0a59443_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\jkfupsiowm.exejkfupsiowm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cjswpefx.exeC:\Windows\system32\cjswpefx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2588
-
-
-
C:\Windows\SysWOW64\kfzrtmcdsviftmn.exekfzrtmcdsviftmn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4624
-
-
C:\Windows\SysWOW64\cjswpefx.execjswpefx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4696
-
-
C:\Windows\SysWOW64\vxljrhednceuf.exevxljrhednceuf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4392
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD57278f5242464281c6473f2f411cb2df4
SHA16951eeccb79c86b3e5b3d24a0fa5d7b98466c132
SHA256d3edc087b3dcc197352805db71fa314814d349c5c50d414a977acf660ddf211a
SHA51237583492e4dbce220fe0e39da32806228f2a0ea19ebb0472b0423f08a5b9666ab6c63a60e2dc8b52f0323e1838c14edc236bf34eeb4783c949a6a4887bfd2454
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5419d9e31a6667f860f5d0f6f305d278c
SHA10f81efe2a4df3a598b98a40f56446629e3180070
SHA25623cb406b0a25aca94be2b39f5e7019ad2fdfda46865e96739b44dfa996f206f5
SHA512a69787722ccb298cd96c89d7957eb168ddee553998aec484f4e9933d43ef3b848f9c52e1e528cde9116b5dd6e1bc88f1272e4a37cb236d5698ad135089e85372
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5a5db7e8cfaa5aac62421513bcca3ec88
SHA12892f0aaad40d87b7aef9ccb286b9c5ed6f98dcc
SHA256539d4ed112da638eef54e9fba5e852208f0505610d10f136dc8d8a7362bc8c28
SHA51280f3bdf432ec463b3047eeddff610a51736831de3672f7aa5593c219f6a1ff2aab44f43c0577a72d3406e06b98593fcf8e5b36572ae99e1899ee2f8368b96a15
-
Filesize
512KB
MD555971677f8080e56eb6c3c69309708fa
SHA158c59e7802ed6e985440f10561d239684dcae9c5
SHA256f23471d858841638eed68d058378d0e35895487c6d201e5d6a0bb1dd67d76541
SHA5121e67c914ba3c3ac85251f7b8a6be826b4620d7b7e21c7f4b3f073d9bcd92497cf78222460e66e0aa550c3b69e78ef6afaa210e374f15c36808f93161159a2dcd
-
Filesize
512KB
MD5ac55326d697d97dc9816c2269b169817
SHA175edf1144ddf86ffc7e4eaf666454db3291ea135
SHA25657fd6dc107c8dd4410e9563afd9538caa732b2ca2c373462476d1401276fc2e9
SHA51280f0e298236209a0bf485292e43f797462095355a67b863511e6aaaf5d596902d107705f2bfd3f04f67c1f9b57f027aad95af29453cd7e7d6d90035f396e71b6
-
Filesize
512KB
MD59783e791bed3f197bb1afadc3bc5c1f0
SHA141bd99160bfc429bb9849af2494d3cbb1695a43c
SHA25654e2726694be75c28cefeaa7ab1748d9a1c68d24538961ddbb24b0ddda0fba01
SHA5120157268741bb17968031b761ce76fbc5d789391195de795c03f0c1410fee455cb5418b61f1942d9fc0de2f7624b496fb7a06dd15adf23bb8a437630f2b0bc759
-
Filesize
512KB
MD530c1497809d3a583b9791f03d0da1c95
SHA13f851059a8073c4047b0a169d158254adcc8279e
SHA256c5980ae8e72a6926528edb82efc569dc43b8d0ca40ae45f11a5d5c2594cf1ba5
SHA512ddaf60060532eaec400df785a050a2b668d6e89b7d227532abf8f32ce739bdc406eb5fa59b3e2aacf8be488b5638cd1fbb49e51d73faaa27c5f69581c569d3f2
-
Filesize
512KB
MD5ae1545a9d77688f82342d0949dc8beff
SHA1a8278d47250a5d03c4a962ad61b7cc8fcc874ecd
SHA25622008022f49f0b7b7fa26aad14624bb9040bffacf9208b0b7ddea650c9454a2b
SHA5123125bcfcbc24b954cfd8211687b8f9e823f2b234d5248474ac2bc4847767f8516575e43cf78134d1e3757bb44fd918ac182218722b2692673682df00e662f72b
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD56a58553e93df579090eaecfed3ce6d4a
SHA1638992cf112fac9be0b1bc85487fde89fb1c31aa
SHA256866aa3bbf7720cb6dd09588bb75aa9d4336a820c9bd6b3589d1a50464affc32f
SHA512938cff2e3d0c0ba2e47501ddffba601a83448ca53a8213aa1d062aa0826bda74a2d6f6f0071238c50c1c83686ab0b10edecb9caa9898cfd695dd160358e02685
-
Filesize
512KB
MD554a233fd8b9aeafc244aa9c1d5cfaecd
SHA11b48bec890ffd29144296e791a284a2d00ab1f6a
SHA25697d83bfa1eb57873d9e23ed1412033854f3a62cc34a070e3f7dd8bb6fdd90fa8
SHA5124a5e4dfd70e7cccd1ef206da6ad552f0cfdd413f85d0afdbb687a298574727291880227c960b8b400aeb70ed02e9a57353fc93a7081686d3967222e6b815b171