Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe
-
Size
512KB
-
MD5
45cb60ae113dec6e981c4de731eeec82
-
SHA1
9379357a85748e623c7ba9c6c7b293e947dc5ed8
-
SHA256
3b9a638cd3fe3315d7aa86d50f41647c0d33f05893d8d3f67ed360cefb670e86
-
SHA512
593b4fbffc5a4870ce9dbfebbdafdd17c674796cf32bf6e35a274f1c909b12153c7790c4e25b43f25731cd298ed047d06f0f3e32c2a2fea83055e63725ce4d90
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" rawzmsvtwq.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rawzmsvtwq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rawzmsvtwq.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rawzmsvtwq.exe -
Executes dropped EXE 5 IoCs
pid Process 2132 rawzmsvtwq.exe 1944 omupujwxtivgfok.exe 2596 sznufzsr.exe 2672 jlttdjmydcbbv.exe 2564 sznufzsr.exe -
Loads dropped DLL 5 IoCs
pid Process 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2132 rawzmsvtwq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" rawzmsvtwq.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wbqgyfke = "rawzmsvtwq.exe" omupujwxtivgfok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pfmzukdg = "omupujwxtivgfok.exe" omupujwxtivgfok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jlttdjmydcbbv.exe" omupujwxtivgfok.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: sznufzsr.exe File opened (read-only) \??\v: sznufzsr.exe File opened (read-only) \??\o: rawzmsvtwq.exe File opened (read-only) \??\x: sznufzsr.exe File opened (read-only) \??\k: sznufzsr.exe File opened (read-only) \??\q: sznufzsr.exe File opened (read-only) \??\v: sznufzsr.exe File opened (read-only) \??\y: sznufzsr.exe File opened (read-only) \??\p: rawzmsvtwq.exe File opened (read-only) \??\z: rawzmsvtwq.exe File opened (read-only) \??\j: sznufzsr.exe File opened (read-only) \??\r: sznufzsr.exe File opened (read-only) \??\s: sznufzsr.exe File opened (read-only) \??\w: sznufzsr.exe File opened (read-only) \??\k: rawzmsvtwq.exe File opened (read-only) \??\l: sznufzsr.exe File opened (read-only) \??\t: sznufzsr.exe File opened (read-only) \??\g: rawzmsvtwq.exe File opened (read-only) \??\b: sznufzsr.exe File opened (read-only) \??\e: sznufzsr.exe File opened (read-only) \??\h: sznufzsr.exe File opened (read-only) \??\u: sznufzsr.exe File opened (read-only) \??\a: rawzmsvtwq.exe File opened (read-only) \??\r: rawzmsvtwq.exe File opened (read-only) \??\t: rawzmsvtwq.exe File opened (read-only) \??\a: sznufzsr.exe File opened (read-only) \??\e: sznufzsr.exe File opened (read-only) \??\p: sznufzsr.exe File opened (read-only) \??\l: rawzmsvtwq.exe File opened (read-only) \??\x: rawzmsvtwq.exe File opened (read-only) \??\u: sznufzsr.exe File opened (read-only) \??\n: sznufzsr.exe File opened (read-only) \??\q: sznufzsr.exe File opened (read-only) \??\j: rawzmsvtwq.exe File opened (read-only) \??\g: sznufzsr.exe File opened (read-only) \??\n: sznufzsr.exe File opened (read-only) \??\s: sznufzsr.exe File opened (read-only) \??\b: rawzmsvtwq.exe File opened (read-only) \??\h: rawzmsvtwq.exe File opened (read-only) \??\n: rawzmsvtwq.exe File opened (read-only) \??\w: rawzmsvtwq.exe File opened (read-only) \??\l: sznufzsr.exe File opened (read-only) \??\u: rawzmsvtwq.exe File opened (read-only) \??\a: sznufzsr.exe File opened (read-only) \??\o: sznufzsr.exe File opened (read-only) \??\w: sznufzsr.exe File opened (read-only) \??\i: sznufzsr.exe File opened (read-only) \??\m: sznufzsr.exe File opened (read-only) \??\e: rawzmsvtwq.exe File opened (read-only) \??\s: rawzmsvtwq.exe File opened (read-only) \??\y: rawzmsvtwq.exe File opened (read-only) \??\j: sznufzsr.exe File opened (read-only) \??\o: sznufzsr.exe File opened (read-only) \??\z: sznufzsr.exe File opened (read-only) \??\t: sznufzsr.exe File opened (read-only) \??\z: sznufzsr.exe File opened (read-only) \??\r: sznufzsr.exe File opened (read-only) \??\y: sznufzsr.exe File opened (read-only) \??\i: rawzmsvtwq.exe File opened (read-only) \??\q: rawzmsvtwq.exe File opened (read-only) \??\h: sznufzsr.exe File opened (read-only) \??\m: sznufzsr.exe File opened (read-only) \??\p: sznufzsr.exe File opened (read-only) \??\b: sznufzsr.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" rawzmsvtwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" rawzmsvtwq.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2060-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0009000000016ca5-5.dat autoit_exe behavioral1/files/0x0009000000016a29-17.dat autoit_exe behavioral1/files/0x0008000000016cc6-27.dat autoit_exe behavioral1/files/0x0007000000016d16-33.dat autoit_exe behavioral1/files/0x0006000000018ba1-68.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\omupujwxtivgfok.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\omupujwxtivgfok.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sznufzsr.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File created C:\Windows\SysWOW64\jlttdjmydcbbv.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll rawzmsvtwq.exe File created C:\Windows\SysWOW64\rawzmsvtwq.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rawzmsvtwq.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File created C:\Windows\SysWOW64\sznufzsr.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jlttdjmydcbbv.exe 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe sznufzsr.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal sznufzsr.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe sznufzsr.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal sznufzsr.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe sznufzsr.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe sznufzsr.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal sznufzsr.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe sznufzsr.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe sznufzsr.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe sznufzsr.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe sznufzsr.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe sznufzsr.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe sznufzsr.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal sznufzsr.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" rawzmsvtwq.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAFAB9FE13F29984753B4B819C3E99B38B02FD4215033EE1C842EF08A1" 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat rawzmsvtwq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32412C799D5582556A3177D377202DDA7CF265D8" 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFF8B4F5F826E913CD72D7DE7BCE4E136594467456345D6E9" 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" rawzmsvtwq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs rawzmsvtwq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2584 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 2596 sznufzsr.exe 2596 sznufzsr.exe 2596 sznufzsr.exe 2596 sznufzsr.exe 1944 omupujwxtivgfok.exe 1944 omupujwxtivgfok.exe 1944 omupujwxtivgfok.exe 1944 omupujwxtivgfok.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2564 sznufzsr.exe 2564 sznufzsr.exe 2564 sznufzsr.exe 2564 sznufzsr.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 1944 omupujwxtivgfok.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 1944 omupujwxtivgfok.exe 1944 omupujwxtivgfok.exe 2596 sznufzsr.exe 2596 sznufzsr.exe 2596 sznufzsr.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2564 sznufzsr.exe 2564 sznufzsr.exe 2564 sznufzsr.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 2132 rawzmsvtwq.exe 1944 omupujwxtivgfok.exe 1944 omupujwxtivgfok.exe 2596 sznufzsr.exe 2596 sznufzsr.exe 2596 sznufzsr.exe 1944 omupujwxtivgfok.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2672 jlttdjmydcbbv.exe 2564 sznufzsr.exe 2564 sznufzsr.exe 2564 sznufzsr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2584 WINWORD.EXE 2584 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2132 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 28 PID 2060 wrote to memory of 2132 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 28 PID 2060 wrote to memory of 2132 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 28 PID 2060 wrote to memory of 2132 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 28 PID 2060 wrote to memory of 1944 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 29 PID 2060 wrote to memory of 1944 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 29 PID 2060 wrote to memory of 1944 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 29 PID 2060 wrote to memory of 1944 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 29 PID 2060 wrote to memory of 2596 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2596 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2596 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2596 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2672 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 31 PID 2060 wrote to memory of 2672 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 31 PID 2060 wrote to memory of 2672 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 31 PID 2060 wrote to memory of 2672 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 31 PID 2132 wrote to memory of 2564 2132 rawzmsvtwq.exe 32 PID 2132 wrote to memory of 2564 2132 rawzmsvtwq.exe 32 PID 2132 wrote to memory of 2564 2132 rawzmsvtwq.exe 32 PID 2132 wrote to memory of 2564 2132 rawzmsvtwq.exe 32 PID 2060 wrote to memory of 2584 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 33 PID 2060 wrote to memory of 2584 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 33 PID 2060 wrote to memory of 2584 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 33 PID 2060 wrote to memory of 2584 2060 45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe 33 PID 2584 wrote to memory of 1516 2584 WINWORD.EXE 36 PID 2584 wrote to memory of 1516 2584 WINWORD.EXE 36 PID 2584 wrote to memory of 1516 2584 WINWORD.EXE 36 PID 2584 wrote to memory of 1516 2584 WINWORD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45cb60ae113dec6e981c4de731eeec82_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rawzmsvtwq.exerawzmsvtwq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\sznufzsr.exeC:\Windows\system32\sznufzsr.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2564
-
-
-
C:\Windows\SysWOW64\omupujwxtivgfok.exeomupujwxtivgfok.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1944
-
-
C:\Windows\SysWOW64\sznufzsr.exesznufzsr.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596
-
-
C:\Windows\SysWOW64\jlttdjmydcbbv.exejlttdjmydcbbv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1516
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5dd776bb7ce50084504e777295215ee7e
SHA171a94593f4e62ea40a880877377a68e8c6a67d5f
SHA256dade16dfc07fa446eca15837b51b2d282cb3234c409753612de7101e1201184c
SHA512f05137777c35fb87887e018fdb4bae1ff5026332e85b72d975e5fa3a5bb193000bfce5bb99d7da13879f8ca0b4962a544530b7d95366fe740b0d3ccc8e632763
-
Filesize
20KB
MD50820c40e887801700a3b8a9e7f7ee80a
SHA19d89a4cbeaebc8e73ac4c21edbde85f1d8910f45
SHA2562b31beab00c29d486aaf3a4e2a6206fdbf038603ed348c501ca8ce949597dbf8
SHA5127bf7b1a10df90d64ea4b62bccd5d791284129da23b24235e3cf5aff9d5eae0bb4cbf4dcd78b230b742b3988a3539ceee44f7ceb05a6666e1545ceb1cdb964a12
-
Filesize
512KB
MD5db26e0d6f05c046c319ce16d45f1e6a5
SHA1fb035daa8a1d8b941e19c4092671fca2eaf5e316
SHA25698dd67a228f1615723c69ee3a499e32ec35c1ae87105daf5dd6f1da6b776b7d8
SHA512b1df8e6b5998215474b473b349f53fc19ace83ab92289cb5483bbbe147f0b4126c2fe7c84c859a9d7c071eecb3dc8f6c4e82a743afc02edb4fd9bc1daa51af93
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5a7983ed0cc36b67717ed0f7c43900f89
SHA1fb9d959f6d5614cc6a9f6a07ff111362c04fc3d0
SHA25640635b905afd88fb8762f76794c3517ce3fab0251cd8995e8c5996efdf4613cb
SHA51205a15af7d5ef38f52981970e70dadc9c37a440d3d6084e5f5fb091d2de225786ff74b243d491fbd44de309aa85e9301b0aa474221545eac964fd69a773c8c34a
-
Filesize
512KB
MD5aa04d7069a86e719a79a8bd27f5aa364
SHA1ffbc4dc8a4dfe0f4a6276f4e93a60d4479d2dd27
SHA256fc8a6f0b012f066d6819e947dfacd43d799eab1614c9e5780755522aa945c66e
SHA5127d61097a75c33a26f90691a80958d0f6ec6609b276ec2f762a4698e1d293dd49582e56b4f0be1990ba78f202dfa4faebe6277c980a5fa4859cc9575723410aad
-
Filesize
512KB
MD54a822b533c807eba42eafcbf79383565
SHA10a765f2c290a2077ae9f2870fe5d3dfd4c0392ee
SHA256a90b57804548ac070247f04d4cffe222487d28d4e6e49df7358e5ebb52e2645c
SHA512068d756050946e3e3fdf4a4e44ec652a85429a405c267ecb075b1c3601e65ef3c9e7e1f1bf8251e1e11a2933021f0a855c271e71c3daa0152ef381d6dcf458ba