Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 09:09
Static task
static1
Behavioral task
behavioral1
Sample
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe
-
Size
512KB
-
MD5
04d94caa6a97084b6b204a3e81070c5a
-
SHA1
abd419bb1fabfde4cd8cc5c8558ad8db73a14508
-
SHA256
9866404f1c221e476925793f6023f38bf0ddbab112316315239c98af6647e9e9
-
SHA512
713df4b771ef148893091c5fd7f84073b832d41b6408c6c2dcae3761faf8c80bd17393943fda848092ec5df671ff56e85fdb9bc385873680943e14d402497d6d
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
ohunsppuet.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ohunsppuet.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
ohunsppuet.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ohunsppuet.exe -
Processes:
ohunsppuet.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ohunsppuet.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ohunsppuet.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ohunsppuet.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
Processes:
ohunsppuet.exexjpewrcyzjqnqih.exeptxgkeie.exefgbqxvyjqjjsj.exeptxgkeie.exepid process 3680 ohunsppuet.exe 3360 xjpewrcyzjqnqih.exe 2920 ptxgkeie.exe 3496 fgbqxvyjqjjsj.exe 4536 ptxgkeie.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
ohunsppuet.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ohunsppuet.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
xjpewrcyzjqnqih.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dsdvmxgv = "ohunsppuet.exe" xjpewrcyzjqnqih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qqhhigqp = "xjpewrcyzjqnqih.exe" xjpewrcyzjqnqih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "fgbqxvyjqjjsj.exe" xjpewrcyzjqnqih.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ptxgkeie.exeohunsppuet.exeptxgkeie.exedescription ioc process File opened (read-only) \??\r: ptxgkeie.exe File opened (read-only) \??\j: ohunsppuet.exe File opened (read-only) \??\m: ohunsppuet.exe File opened (read-only) \??\w: ptxgkeie.exe File opened (read-only) \??\v: ohunsppuet.exe File opened (read-only) \??\g: ptxgkeie.exe File opened (read-only) \??\p: ptxgkeie.exe File opened (read-only) \??\w: ptxgkeie.exe File opened (read-only) \??\i: ptxgkeie.exe File opened (read-only) \??\r: ptxgkeie.exe File opened (read-only) \??\e: ohunsppuet.exe File opened (read-only) \??\h: ohunsppuet.exe File opened (read-only) \??\a: ptxgkeie.exe File opened (read-only) \??\q: ptxgkeie.exe File opened (read-only) \??\s: ptxgkeie.exe File opened (read-only) \??\t: ptxgkeie.exe File opened (read-only) \??\s: ptxgkeie.exe File opened (read-only) \??\a: ohunsppuet.exe File opened (read-only) \??\z: ptxgkeie.exe File opened (read-only) \??\z: ohunsppuet.exe File opened (read-only) \??\l: ptxgkeie.exe File opened (read-only) \??\n: ptxgkeie.exe File opened (read-only) \??\x: ptxgkeie.exe File opened (read-only) \??\v: ptxgkeie.exe File opened (read-only) \??\g: ohunsppuet.exe File opened (read-only) \??\z: ptxgkeie.exe File opened (read-only) \??\q: ohunsppuet.exe File opened (read-only) \??\m: ptxgkeie.exe File opened (read-only) \??\o: ptxgkeie.exe File opened (read-only) \??\e: ptxgkeie.exe File opened (read-only) \??\h: ptxgkeie.exe File opened (read-only) \??\t: ohunsppuet.exe File opened (read-only) \??\q: ptxgkeie.exe File opened (read-only) \??\s: ohunsppuet.exe File opened (read-only) \??\l: ptxgkeie.exe File opened (read-only) \??\n: ptxgkeie.exe File opened (read-only) \??\x: ohunsppuet.exe File opened (read-only) \??\b: ptxgkeie.exe File opened (read-only) \??\n: ohunsppuet.exe File opened (read-only) \??\r: ohunsppuet.exe File opened (read-only) \??\p: ptxgkeie.exe File opened (read-only) \??\k: ohunsppuet.exe File opened (read-only) \??\o: ohunsppuet.exe File opened (read-only) \??\p: ohunsppuet.exe File opened (read-only) \??\w: ohunsppuet.exe File opened (read-only) \??\h: ptxgkeie.exe File opened (read-only) \??\a: ptxgkeie.exe File opened (read-only) \??\j: ptxgkeie.exe File opened (read-only) \??\k: ptxgkeie.exe File opened (read-only) \??\v: ptxgkeie.exe File opened (read-only) \??\k: ptxgkeie.exe File opened (read-only) \??\t: ptxgkeie.exe File opened (read-only) \??\b: ohunsppuet.exe File opened (read-only) \??\u: ptxgkeie.exe File opened (read-only) \??\g: ptxgkeie.exe File opened (read-only) \??\y: ptxgkeie.exe File opened (read-only) \??\m: ptxgkeie.exe File opened (read-only) \??\o: ptxgkeie.exe File opened (read-only) \??\e: ptxgkeie.exe File opened (read-only) \??\i: ptxgkeie.exe File opened (read-only) \??\b: ptxgkeie.exe File opened (read-only) \??\l: ohunsppuet.exe File opened (read-only) \??\y: ohunsppuet.exe File opened (read-only) \??\j: ptxgkeie.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
ohunsppuet.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ohunsppuet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ohunsppuet.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3708-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe C:\Windows\SysWOW64\ptxgkeie.exe autoit_exe C:\Windows\SysWOW64\ohunsppuet.exe autoit_exe C:\Windows\SysWOW64\xjpewrcyzjqnqih.exe autoit_exe C:\Windows\SysWOW64\fgbqxvyjqjjsj.exe autoit_exe C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe autoit_exe C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe autoit_exe C:\Users\Admin\Documents\SuspendUndo.doc.exe autoit_exe C:\Users\Admin\Music\RestoreClose.doc.exe autoit_exe \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe autoit_exe \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe autoit_exe -
Drops file in System32 directory 13 IoCs
Processes:
ohunsppuet.exe04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exeptxgkeie.exeptxgkeie.exedescription ioc process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ohunsppuet.exe File created C:\Windows\SysWOW64\xjpewrcyzjqnqih.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ptxgkeie.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File created C:\Windows\SysWOW64\fgbqxvyjqjjsj.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fgbqxvyjqjjsj.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File created C:\Windows\SysWOW64\ohunsppuet.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ptxgkeie.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ptxgkeie.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ptxgkeie.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ptxgkeie.exe File opened for modification C:\Windows\SysWOW64\ohunsppuet.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xjpewrcyzjqnqih.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File created C:\Windows\SysWOW64\ptxgkeie.exe 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
Processes:
ptxgkeie.exeptxgkeie.exedescription ioc process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ptxgkeie.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ptxgkeie.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ptxgkeie.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ptxgkeie.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ptxgkeie.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ptxgkeie.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ptxgkeie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ptxgkeie.exe -
Drops file in Windows directory 3 IoCs
Processes:
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exeohunsppuet.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33372C0B9D2C83516D3F77D077262DDB7DF465DD" 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8CFFFB485D82699030D6217E9CBDE7E633593667366246D79E" 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ohunsppuet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ohunsppuet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ohunsppuet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C7091593DAB3B8CD7CE3EC9F37C9" 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ohunsppuet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ohunsppuet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ohunsppuet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFABEFE14F1E5840C3A4386983E98B3FC02FE4269034EE2CF42E908A2" 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ohunsppuet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ohunsppuet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ohunsppuet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB02E44E6399E53C5BAD7329CD7B8" 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F568B6FE1B22DED27DD1A68A7E9017" 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ohunsppuet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ohunsppuet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ohunsppuet.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1968 WINWORD.EXE 1968 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exexjpewrcyzjqnqih.exeohunsppuet.exefgbqxvyjqjjsj.exeptxgkeie.exeptxgkeie.exepid process 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3680 ohunsppuet.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 3496 fgbqxvyjqjjsj.exe 2920 ptxgkeie.exe 2920 ptxgkeie.exe 2920 ptxgkeie.exe 2920 ptxgkeie.exe 2920 ptxgkeie.exe 2920 ptxgkeie.exe 2920 ptxgkeie.exe 2920 ptxgkeie.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exexjpewrcyzjqnqih.exeohunsppuet.exefgbqxvyjqjjsj.exeptxgkeie.exeptxgkeie.exepid process 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3680 ohunsppuet.exe 3496 fgbqxvyjqjjsj.exe 2920 ptxgkeie.exe 3680 ohunsppuet.exe 3496 fgbqxvyjqjjsj.exe 2920 ptxgkeie.exe 3496 fgbqxvyjqjjsj.exe 3680 ohunsppuet.exe 2920 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exexjpewrcyzjqnqih.exeohunsppuet.exefgbqxvyjqjjsj.exeptxgkeie.exeptxgkeie.exepid process 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3360 xjpewrcyzjqnqih.exe 3680 ohunsppuet.exe 3496 fgbqxvyjqjjsj.exe 2920 ptxgkeie.exe 3680 ohunsppuet.exe 3496 fgbqxvyjqjjsj.exe 2920 ptxgkeie.exe 3496 fgbqxvyjqjjsj.exe 3680 ohunsppuet.exe 2920 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe 4536 ptxgkeie.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1968 WINWORD.EXE 1968 WINWORD.EXE 1968 WINWORD.EXE 1968 WINWORD.EXE 1968 WINWORD.EXE 1968 WINWORD.EXE 1968 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exeohunsppuet.exedescription pid process target process PID 3708 wrote to memory of 3680 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe ohunsppuet.exe PID 3708 wrote to memory of 3680 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe ohunsppuet.exe PID 3708 wrote to memory of 3680 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe ohunsppuet.exe PID 3708 wrote to memory of 3360 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe xjpewrcyzjqnqih.exe PID 3708 wrote to memory of 3360 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe xjpewrcyzjqnqih.exe PID 3708 wrote to memory of 3360 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe xjpewrcyzjqnqih.exe PID 3708 wrote to memory of 2920 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe ptxgkeie.exe PID 3708 wrote to memory of 2920 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe ptxgkeie.exe PID 3708 wrote to memory of 2920 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe ptxgkeie.exe PID 3708 wrote to memory of 3496 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe fgbqxvyjqjjsj.exe PID 3708 wrote to memory of 3496 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe fgbqxvyjqjjsj.exe PID 3708 wrote to memory of 3496 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe fgbqxvyjqjjsj.exe PID 3680 wrote to memory of 4536 3680 ohunsppuet.exe ptxgkeie.exe PID 3680 wrote to memory of 4536 3680 ohunsppuet.exe ptxgkeie.exe PID 3680 wrote to memory of 4536 3680 ohunsppuet.exe ptxgkeie.exe PID 3708 wrote to memory of 1968 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe WINWORD.EXE PID 3708 wrote to memory of 1968 3708 04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04d94caa6a97084b6b204a3e81070c5a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ohunsppuet.exeohunsppuet.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ptxgkeie.exeC:\Windows\system32\ptxgkeie.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\xjpewrcyzjqnqih.exexjpewrcyzjqnqih.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ptxgkeie.exeptxgkeie.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\fgbqxvyjqjjsj.exefgbqxvyjqjjsj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
6Impair Defenses
2Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
512KB
MD50702ff472194973cfedb70bcbcafbc0d
SHA1d02c92d7faa9eeac9b9eef41fd513764fe9b228d
SHA2561e7f29345a2dcc0dfd9b11887d8a05801131c9a9015f349383d404de5fce098a
SHA51260a3e282c31fdcdefd93e3d520f9eca9d7996f93921b5fcbb58d001b8918210519bb9dad8007f9c4ce7c3ae511d8bc03bf40eed2814bb5d4e3d927409e67a310
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
512KB
MD5eeb16e29f007972981b5aff85658da23
SHA1e2fe593fc2aebe03115f6a9f7f4a7695f66e398d
SHA25602f9cf4439a3c27a0547448533de4b62f275f1d8268fa8215550e89efbbfc7c0
SHA512a337326e1f363077485ec0e631269abfd63e9247c9e8bb59b9bfac79d03de89848bfa8d8c874005e4c9c21f2f1213c3c2d50b8b16894b8a2dcff28bb1e81aebd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msFilesize
3KB
MD562b77f6bd5585e900eeab7df89f73f4f
SHA12ed5732fc6d5a942a50f2e1c80fe1311d54eb5c1
SHA25601892177107720949141ce668f0cb51360265c00879f36c9404b6e4bb82205ff
SHA512d047fc91e4a19eb24d5fa21a2678b7dddad3240178974e69a73f58958ce3fa0ae20151c87439416aa5ba801cc6f6fa5514e5107681e1bd60db839a3551dd8824
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msFilesize
3KB
MD52cc39bbe4a4d9b356bce91ca902cf9b9
SHA19a566bef7db9127d7bd3ada6bda3b45932d05176
SHA2566f4428171b7d5676403ef8662d01f686fb4fe7ad48d690c9df389104e226cb0d
SHA5120d2d4dccf368c8f190f92e6b0f1dc4793a1fff05c4189f3439732001e06131bc4623df957861a1e007562f7e827673b79de81101c5d74fc07931c8e4d76579bb
-
C:\Users\Admin\Documents\SuspendUndo.doc.exeFilesize
512KB
MD51535792cf5c0a60a9bf077183f42fa60
SHA10a8d347bd18d84fa3966ba2f5290e6d5174a96fd
SHA256bb7179eacf4cb373136fed9a2ff4e754bbaf2899049114b1b5533cff0144ef19
SHA5125072834b9eaa9e6a92dabdd7ecd4670d1e146e547b912f2e214ddfa99673b2941d0a84636559349354f52050410187264f62c150b5a880119bf0eda75b8eb146
-
C:\Users\Admin\Music\RestoreClose.doc.exeFilesize
512KB
MD5428e62fde22ffff42425bd67983a02ee
SHA13269bb0ca419d7bbdf145d644658feff0574b47e
SHA256313fd3fc6820aa16f78c02382a7d7431b9bba1b31796e27a7c49e3db18a1e184
SHA51297b904f59a691b59994d30f4900ea8bc961306cdcfbe5f3a4387c3e5a440fa34740b0de876b7b9851ce1108c9c8a158c1f5781297d3b99541a28485452de44cb
-
C:\Windows\SysWOW64\fgbqxvyjqjjsj.exeFilesize
512KB
MD5da865b226e0f129e3d7d993c747b22e1
SHA1beb0abd2d0d3304dca6705138a5518629ef6ff8e
SHA2561e848734a80916550d8661ed8b369c84be82ecc2d5b33d8330ecd8950fb08d97
SHA5121418a58d7a0dbfa86cab91196ebaa3f7b30c127f59ababd910054adfd93780f0e4db119048f43b0a2487b073746ee417eaa0bf5bef3825d6c54d34c16be11796
-
C:\Windows\SysWOW64\ohunsppuet.exeFilesize
512KB
MD5616e7616b4b83d360b1ba96b8539c11e
SHA1b3f84bfc32b9bfcf21e469dcbcf01dfbfc083d5a
SHA256208be5ddc3001aa830bb9440059a5794bec47b5fc1dd5becd939743068ab385d
SHA5124c8ab1509b31bcb93d765cbf1ea80873f9a5add59b8e20b1da3b8dc75822d7f07b4b1fc81e84aa2f678b7ffd38da8fe651f89be7c9709c40968e893965cc3fb3
-
C:\Windows\SysWOW64\ptxgkeie.exeFilesize
512KB
MD549f40e40e3df80eb0e8c6b2849274f93
SHA101677dcbdbc5b0aefc81468af72eacd0552e9f23
SHA25632c9a784328d00ea392632420e7c780ece037757903e6cf9837fb896a3f3ee1b
SHA512bcf8baef5cc37a7888df21afdffcc9efa90971d0011eb0df7c32a100a2866740f9a466ea50f6a09e29f86f261b9b3d54d0e236559e1c6ce6d4cefce19d8b3b29
-
C:\Windows\SysWOW64\xjpewrcyzjqnqih.exeFilesize
512KB
MD5a43bf81411029afdb3dcc4eee272a382
SHA1364c74015c9eba621381f09edca528bc2e52923f
SHA256a685109808cddb5d4fad2c9212d1dc8963b9b6a12f52f5bc912904c4eecaaf4b
SHA5125b3c48c249ed88f79918fe11196456cb93c4334bdbfa7c92685291a901aada8a1219f317817f32f720baf8ba1e04b3ee1d7ce7acb23c9d8f78687dfac75b3f33
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
512KB
MD57ed4a70250a0bb1cc23534e0f407e608
SHA14c47180cf2e6fe678236bf1b4c9fb975d0622bce
SHA256e111b88edfb8d35e1425aec1de6ac9a311eca02f61ace2207ef9acd08adea595
SHA5129df3fcb078f3a8e50a06f907236f6ff9962341e1a1f9bc001c0c8a77fa6f39cc1f337d69091c00ec31fc55d203cb246ec3034238f3c8b5a966ed0a2d57c1ea9a
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
512KB
MD56575260bad02bc905db5c410a5b41b34
SHA1120240ee1ea2e3047c4ad3f1929a0bb4232c3120
SHA256097678ee97d99c13f1fb6ced60f7284a0dac2745a916564c096fcc6c15e63ea0
SHA51213e4116abc23cbafc6b754f894d41b0493ca11c0dcf80b56db5df9941da14a39ab73ce59936304a437a51fffb3cb2087ba7cef06d884a642a0b71face9de3bb3
-
memory/1968-41-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-40-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-37-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-39-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-38-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-42-0x00007FF80B8D0000-0x00007FF80B8E0000-memory.dmpFilesize
64KB
-
memory/1968-43-0x00007FF80B8D0000-0x00007FF80B8E0000-memory.dmpFilesize
64KB
-
memory/1968-131-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-130-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-129-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/1968-128-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmpFilesize
64KB
-
memory/3708-0-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB