Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
4606ac894da9657c311fe457556622e9_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4606ac894da9657c311fe457556622e9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4606ac894da9657c311fe457556622e9_JaffaCakes118.exe
-
Size
512KB
-
MD5
4606ac894da9657c311fe457556622e9
-
SHA1
2bea8b70cf15ef00d4615481fd231658b5726a4c
-
SHA256
1d28a74a7ebf34d131a32f0f3b6d6158019b51c3c0d5943ea629102473517611
-
SHA512
48c2e95f62f948f00c353c08c197b791457edfc66be152d91b48a64716e9aee3899607569bd745523a94541b88b6230f2189ba5e528fbcb280dc678aafa30b94
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" iooblqauqt.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" iooblqauqt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" iooblqauqt.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iooblqauqt.exe -
Executes dropped EXE 5 IoCs
pid Process 2152 iooblqauqt.exe 2664 kxcrowhfrhhjvdr.exe 2736 pxibhcin.exe 2800 ejtpleezkycno.exe 2760 pxibhcin.exe -
Loads dropped DLL 5 IoCs
pid Process 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2152 iooblqauqt.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iooblqauqt.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bcjdarpo = "iooblqauqt.exe" kxcrowhfrhhjvdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vsbleuli = "kxcrowhfrhhjvdr.exe" kxcrowhfrhhjvdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ejtpleezkycno.exe" kxcrowhfrhhjvdr.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: pxibhcin.exe File opened (read-only) \??\k: pxibhcin.exe File opened (read-only) \??\l: pxibhcin.exe File opened (read-only) \??\t: pxibhcin.exe File opened (read-only) \??\h: pxibhcin.exe File opened (read-only) \??\i: pxibhcin.exe File opened (read-only) \??\m: pxibhcin.exe File opened (read-only) \??\p: pxibhcin.exe File opened (read-only) \??\z: pxibhcin.exe File opened (read-only) \??\a: pxibhcin.exe File opened (read-only) \??\x: iooblqauqt.exe File opened (read-only) \??\z: iooblqauqt.exe File opened (read-only) \??\t: pxibhcin.exe File opened (read-only) \??\u: iooblqauqt.exe File opened (read-only) \??\v: iooblqauqt.exe File opened (read-only) \??\w: iooblqauqt.exe File opened (read-only) \??\j: pxibhcin.exe File opened (read-only) \??\l: iooblqauqt.exe File opened (read-only) \??\r: iooblqauqt.exe File opened (read-only) \??\j: pxibhcin.exe File opened (read-only) \??\o: pxibhcin.exe File opened (read-only) \??\i: iooblqauqt.exe File opened (read-only) \??\m: iooblqauqt.exe File opened (read-only) \??\p: iooblqauqt.exe File opened (read-only) \??\v: pxibhcin.exe File opened (read-only) \??\n: pxibhcin.exe File opened (read-only) \??\b: iooblqauqt.exe File opened (read-only) \??\h: iooblqauqt.exe File opened (read-only) \??\t: iooblqauqt.exe File opened (read-only) \??\e: pxibhcin.exe File opened (read-only) \??\m: pxibhcin.exe File opened (read-only) \??\q: pxibhcin.exe File opened (read-only) \??\w: pxibhcin.exe File opened (read-only) \??\g: iooblqauqt.exe File opened (read-only) \??\k: iooblqauqt.exe File opened (read-only) \??\u: pxibhcin.exe File opened (read-only) \??\b: pxibhcin.exe File opened (read-only) \??\o: iooblqauqt.exe File opened (read-only) \??\n: pxibhcin.exe File opened (read-only) \??\o: pxibhcin.exe File opened (read-only) \??\v: pxibhcin.exe File opened (read-only) \??\j: iooblqauqt.exe File opened (read-only) \??\k: pxibhcin.exe File opened (read-only) \??\y: pxibhcin.exe File opened (read-only) \??\s: iooblqauqt.exe File opened (read-only) \??\b: pxibhcin.exe File opened (read-only) \??\e: pxibhcin.exe File opened (read-only) \??\z: pxibhcin.exe File opened (read-only) \??\h: pxibhcin.exe File opened (read-only) \??\i: pxibhcin.exe File opened (read-only) \??\x: pxibhcin.exe File opened (read-only) \??\x: pxibhcin.exe File opened (read-only) \??\s: pxibhcin.exe File opened (read-only) \??\u: pxibhcin.exe File opened (read-only) \??\q: iooblqauqt.exe File opened (read-only) \??\y: iooblqauqt.exe File opened (read-only) \??\g: pxibhcin.exe File opened (read-only) \??\w: pxibhcin.exe File opened (read-only) \??\r: pxibhcin.exe File opened (read-only) \??\a: pxibhcin.exe File opened (read-only) \??\l: pxibhcin.exe File opened (read-only) \??\r: pxibhcin.exe File opened (read-only) \??\s: pxibhcin.exe File opened (read-only) \??\y: pxibhcin.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" iooblqauqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" iooblqauqt.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2952-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x003400000001562a-5.dat autoit_exe behavioral1/files/0x000b0000000122ec-17.dat autoit_exe behavioral1/files/0x0008000000015c7f-28.dat autoit_exe behavioral1/files/0x0007000000015ca2-38.dat autoit_exe behavioral1/files/0x0006000000016d2c-71.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\kxcrowhfrhhjvdr.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kxcrowhfrhhjvdr.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\pxibhcin.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\pxibhcin.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\ejtpleezkycno.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll iooblqauqt.exe File created C:\Windows\SysWOW64\iooblqauqt.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iooblqauqt.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ejtpleezkycno.exe 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pxibhcin.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pxibhcin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pxibhcin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pxibhcin.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pxibhcin.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pxibhcin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal pxibhcin.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pxibhcin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal pxibhcin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal pxibhcin.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pxibhcin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pxibhcin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal pxibhcin.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pxibhcin.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" iooblqauqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" iooblqauqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB05B47E7399953BDBAD1329CD7C8" 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat iooblqauqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F36BB6FE6E21DCD208D1D38B799165" 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc iooblqauqt.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf iooblqauqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2696 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2736 pxibhcin.exe 2736 pxibhcin.exe 2736 pxibhcin.exe 2736 pxibhcin.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2760 pxibhcin.exe 2760 pxibhcin.exe 2760 pxibhcin.exe 2760 pxibhcin.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2664 kxcrowhfrhhjvdr.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2736 pxibhcin.exe 2736 pxibhcin.exe 2736 pxibhcin.exe 2760 pxibhcin.exe 2760 pxibhcin.exe 2760 pxibhcin.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2152 iooblqauqt.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2664 kxcrowhfrhhjvdr.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2800 ejtpleezkycno.exe 2736 pxibhcin.exe 2736 pxibhcin.exe 2736 pxibhcin.exe 2760 pxibhcin.exe 2760 pxibhcin.exe 2760 pxibhcin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2696 WINWORD.EXE 2696 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2152 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 28 PID 2952 wrote to memory of 2152 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 28 PID 2952 wrote to memory of 2152 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 28 PID 2952 wrote to memory of 2152 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 28 PID 2952 wrote to memory of 2664 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 29 PID 2952 wrote to memory of 2664 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 29 PID 2952 wrote to memory of 2664 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 29 PID 2952 wrote to memory of 2664 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 29 PID 2952 wrote to memory of 2736 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 30 PID 2952 wrote to memory of 2736 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 30 PID 2952 wrote to memory of 2736 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 30 PID 2952 wrote to memory of 2736 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 30 PID 2952 wrote to memory of 2800 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 31 PID 2952 wrote to memory of 2800 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 31 PID 2952 wrote to memory of 2800 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 31 PID 2952 wrote to memory of 2800 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 31 PID 2152 wrote to memory of 2760 2152 iooblqauqt.exe 32 PID 2152 wrote to memory of 2760 2152 iooblqauqt.exe 32 PID 2152 wrote to memory of 2760 2152 iooblqauqt.exe 32 PID 2152 wrote to memory of 2760 2152 iooblqauqt.exe 32 PID 2952 wrote to memory of 2696 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 33 PID 2952 wrote to memory of 2696 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 33 PID 2952 wrote to memory of 2696 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 33 PID 2952 wrote to memory of 2696 2952 4606ac894da9657c311fe457556622e9_JaffaCakes118.exe 33 PID 2696 wrote to memory of 2824 2696 WINWORD.EXE 37 PID 2696 wrote to memory of 2824 2696 WINWORD.EXE 37 PID 2696 wrote to memory of 2824 2696 WINWORD.EXE 37 PID 2696 wrote to memory of 2824 2696 WINWORD.EXE 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\4606ac894da9657c311fe457556622e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4606ac894da9657c311fe457556622e9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\iooblqauqt.exeiooblqauqt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\pxibhcin.exeC:\Windows\system32\pxibhcin.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760
-
-
-
C:\Windows\SysWOW64\kxcrowhfrhhjvdr.exekxcrowhfrhhjvdr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2664
-
-
C:\Windows\SysWOW64\pxibhcin.exepxibhcin.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2736
-
-
C:\Windows\SysWOW64\ejtpleezkycno.exeejtpleezkycno.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2800
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2824
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5deba801fee7be42c763417822337a567
SHA166d33569e25e7a6633c477a9f1bdb552cb28db07
SHA256960cd46f0de4b27133e460806ae95e7ab5292a8497c04e70badea0f74334f7ea
SHA512efa1d1af8409dc0965651d01af2e1bce31453c9f8222d7142d028a89b530d54746f756ed2eea2985c2ae3fb1b37f4beaa847ef71e07834d77e7c2dfd38bbc4ed
-
Filesize
64B
MD5c9e81acd17feb30a4c137327317d7daa
SHA17e84772e3ec783441fb5af61218ca70cf3e1b8ef
SHA256eed82b7f169dd6d4b4f054159e6c0a31600c6b173e275d6390ae65520095543d
SHA512122266da7760c0ce0a80c6b26f1584a8eb4c7571bab3e39704dd76c06896aec5a14068fbd91b65dcd00af47d9b4ce1245dd5c7e82c2524cda0cb48fad8ca5bf9
-
Filesize
20KB
MD576f58038f5c1514182d8b1b987c2e200
SHA1a0fd4267249b4593a7d434e6a81002f04b0b8f51
SHA2566bc36748948fcc6abedc5fffb384f8c5d8405491b8253f5d17ec116417ce7273
SHA5125e6246936903e6331234cc3d55dfcda1273ff22d947c40d590c73809d1e588819c03885e7270fa1e7995e43093d5708e89fdf97ddef80471bf6998a76b782a64
-
Filesize
512KB
MD5a61294f7dfd9270cbcaea003c6c02ad9
SHA1f62e89a17a0ef4100b946bc829ee773ef06426a4
SHA256b7e79a51e65f3dd44b1f9497c529f73fa43eca4c76703ebb32a24ed124a56157
SHA5126a5119fa4b5197180e7cc3e22927ff38be20df291b07301ba4a476044afd21f803ecf067196030afa751c49f9630d33a54f82bd443d2ee5966b5fb7a71533b5c
-
Filesize
512KB
MD508683f8d1f552e4a9c403657e5620323
SHA10fef3e6ec09278b47f8e52bb442f178d79f8a75d
SHA2561a2165cd42ad362b7b5e2146d1f975150718ef532730135abd36a30279b39902
SHA512375ea88f4c28060e6e25e1e59e992e8371e85324963137e7560ce10de471479157ba5ee73865fc1b223858ce4ba3737d79c7e92fca1a735e3f225160981e71aa
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD57b24df04010b898d7b71474724c24191
SHA119edc6c1d597f6e94a11c0c73149a365bce8383a
SHA2565e5417aa379cd6b20c23d6ec34be39f6b5b354c4c8663a6c47dce55d8082a540
SHA512d588a8fc56f3061e935e11d257827f72ef38105fb2316104e64928be306c75fab841ec598aea80b8a112f3beff69ecef306e10da0211a01aea072d22422940e2
-
Filesize
512KB
MD50bd1a52b207de0762d7569d8a4b5af47
SHA18a5a75c46ab29366038b4d0422d70037a1b26317
SHA256ad378c104803e3756687e367b9f651dc47cbcfa1e283fe5c5642f6d6bbbbef9e
SHA512ee1c8c10b5b4083d98b19cc00692ca0b73431d5ee713fb138e4c6a3ae13abc45bac765cf02e30e42b3e44d0372b2e2cf6b68c3440fea34b00bebe7869282d28b