Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 06:44
Static task
static1
Behavioral task
behavioral1
Sample
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe
-
Size
512KB
-
MD5
6a1377f2d670fe2c3632a6b485699d15
-
SHA1
f4329395a3d64238f615a44dbbe58bac93055015
-
SHA256
948bc15d0c5e50162870518c73fe06805de301354ba358f0c26d56ae26d38006
-
SHA512
cfb98935cb1f8aaac247eb3cc6006c9502ec1ada184c52a3f275d431c846c75b05815df465cb127d9dc28ac6ffee7c6fe16b2d5f0bc13779a979213f3416410f
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" rmrtuwvcaq.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rmrtuwvcaq.exe -
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rmrtuwvcaq.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rmrtuwvcaq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
Processes:
rmrtuwvcaq.exesqsxpwlcsjabgbt.exempqaituq.exenquicygbhuqni.exempqaituq.exepid process 1100 rmrtuwvcaq.exe 1512 sqsxpwlcsjabgbt.exe 1152 mpqaituq.exe 4200 nquicygbhuqni.exe 532 mpqaituq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rmrtuwvcaq.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
sqsxpwlcsjabgbt.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ktusudjw = "rmrtuwvcaq.exe" sqsxpwlcsjabgbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jkzcubsk = "sqsxpwlcsjabgbt.exe" sqsxpwlcsjabgbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nquicygbhuqni.exe" sqsxpwlcsjabgbt.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rmrtuwvcaq.exempqaituq.exempqaituq.exedescription ioc process File opened (read-only) \??\y: rmrtuwvcaq.exe File opened (read-only) \??\r: mpqaituq.exe File opened (read-only) \??\b: mpqaituq.exe File opened (read-only) \??\h: mpqaituq.exe File opened (read-only) \??\q: mpqaituq.exe File opened (read-only) \??\w: mpqaituq.exe File opened (read-only) \??\s: rmrtuwvcaq.exe File opened (read-only) \??\h: mpqaituq.exe File opened (read-only) \??\j: mpqaituq.exe File opened (read-only) \??\l: mpqaituq.exe File opened (read-only) \??\m: mpqaituq.exe File opened (read-only) \??\p: mpqaituq.exe File opened (read-only) \??\k: rmrtuwvcaq.exe File opened (read-only) \??\n: rmrtuwvcaq.exe File opened (read-only) \??\u: rmrtuwvcaq.exe File opened (read-only) \??\g: rmrtuwvcaq.exe File opened (read-only) \??\x: mpqaituq.exe File opened (read-only) \??\i: mpqaituq.exe File opened (read-only) \??\p: mpqaituq.exe File opened (read-only) \??\p: rmrtuwvcaq.exe File opened (read-only) \??\k: mpqaituq.exe File opened (read-only) \??\l: mpqaituq.exe File opened (read-only) \??\o: mpqaituq.exe File opened (read-only) \??\v: mpqaituq.exe File opened (read-only) \??\e: mpqaituq.exe File opened (read-only) \??\e: mpqaituq.exe File opened (read-only) \??\k: mpqaituq.exe File opened (read-only) \??\r: mpqaituq.exe File opened (read-only) \??\u: mpqaituq.exe File opened (read-only) \??\x: mpqaituq.exe File opened (read-only) \??\o: rmrtuwvcaq.exe File opened (read-only) \??\t: rmrtuwvcaq.exe File opened (read-only) \??\j: mpqaituq.exe File opened (read-only) \??\e: rmrtuwvcaq.exe File opened (read-only) \??\h: rmrtuwvcaq.exe File opened (read-only) \??\i: rmrtuwvcaq.exe File opened (read-only) \??\m: rmrtuwvcaq.exe File opened (read-only) \??\s: mpqaituq.exe File opened (read-only) \??\g: mpqaituq.exe File opened (read-only) \??\z: rmrtuwvcaq.exe File opened (read-only) \??\w: mpqaituq.exe File opened (read-only) \??\s: mpqaituq.exe File opened (read-only) \??\v: mpqaituq.exe File opened (read-only) \??\i: mpqaituq.exe File opened (read-only) \??\t: mpqaituq.exe File opened (read-only) \??\z: mpqaituq.exe File opened (read-only) \??\j: rmrtuwvcaq.exe File opened (read-only) \??\l: rmrtuwvcaq.exe File opened (read-only) \??\r: rmrtuwvcaq.exe File opened (read-only) \??\v: rmrtuwvcaq.exe File opened (read-only) \??\a: mpqaituq.exe File opened (read-only) \??\o: mpqaituq.exe File opened (read-only) \??\x: rmrtuwvcaq.exe File opened (read-only) \??\a: mpqaituq.exe File opened (read-only) \??\w: rmrtuwvcaq.exe File opened (read-only) \??\u: mpqaituq.exe File opened (read-only) \??\n: mpqaituq.exe File opened (read-only) \??\y: mpqaituq.exe File opened (read-only) \??\b: rmrtuwvcaq.exe File opened (read-only) \??\q: rmrtuwvcaq.exe File opened (read-only) \??\g: mpqaituq.exe File opened (read-only) \??\q: mpqaituq.exe File opened (read-only) \??\m: mpqaituq.exe File opened (read-only) \??\t: mpqaituq.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" rmrtuwvcaq.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1072-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exe autoit_exe C:\Windows\SysWOW64\rmrtuwvcaq.exe autoit_exe C:\Windows\SysWOW64\mpqaituq.exe autoit_exe C:\Windows\SysWOW64\nquicygbhuqni.exe autoit_exe C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe autoit_exe C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe autoit_exe C:\Users\Admin\Desktop\DisableRead.doc.exe autoit_exe C:\Users\Admin\Documents\UnlockStep.doc.exe autoit_exe \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe autoit_exe \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe autoit_exe -
Drops file in System32 directory 13 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exempqaituq.exempqaituq.exermrtuwvcaq.exedescription ioc process File created C:\Windows\SysWOW64\mpqaituq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nquicygbhuqni.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File created C:\Windows\SysWOW64\rmrtuwvcaq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File created C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification C:\Windows\SysWOW64\mpqaituq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File created C:\Windows\SysWOW64\nquicygbhuqni.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification C:\Windows\SysWOW64\rmrtuwvcaq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll rmrtuwvcaq.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mpqaituq.exe -
Drops file in Program Files directory 14 IoCs
Processes:
mpqaituq.exempqaituq.exedescription ioc process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mpqaituq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mpqaituq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mpqaituq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mpqaituq.exe -
Drops file in Windows directory 19 IoCs
Processes:
mpqaituq.exempqaituq.exe6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exeWINWORD.EXEdescription ioc process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mpqaituq.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mpqaituq.exe File opened for modification C:\Windows\mydoc.rtf 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCDF9CCFE11F29184093A4686973992B38C02FE4369033BE1C9429B09D5" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFCF94F5C85189142D62E7D92BDEFE143584266466330D79D" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC67A1491DAC3B9C17CE6ECE434BB" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78368B1FF1822DBD10CD0D18A089014" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32412C0C9D5282206D4277D777202CDD7D8F65D8" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B02A44EF39E353BEB9D633E9D4BC" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" rmrtuwvcaq.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1348 WINWORD.EXE 1348 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exesqsxpwlcsjabgbt.exenquicygbhuqni.exermrtuwvcaq.exempqaituq.exempqaituq.exepid process 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 4200 nquicygbhuqni.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1152 mpqaituq.exe 1152 mpqaituq.exe 1152 mpqaituq.exe 1152 mpqaituq.exe 1152 mpqaituq.exe 1152 mpqaituq.exe 1152 mpqaituq.exe 1152 mpqaituq.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 532 mpqaituq.exe 532 mpqaituq.exe 532 mpqaituq.exe 532 mpqaituq.exe 532 mpqaituq.exe 532 mpqaituq.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exesqsxpwlcsjabgbt.exermrtuwvcaq.exempqaituq.exenquicygbhuqni.exempqaituq.exepid process 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1152 mpqaituq.exe 4200 nquicygbhuqni.exe 1152 mpqaituq.exe 4200 nquicygbhuqni.exe 1152 mpqaituq.exe 4200 nquicygbhuqni.exe 532 mpqaituq.exe 532 mpqaituq.exe 532 mpqaituq.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exesqsxpwlcsjabgbt.exermrtuwvcaq.exempqaituq.exenquicygbhuqni.exempqaituq.exepid process 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1512 sqsxpwlcsjabgbt.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1100 rmrtuwvcaq.exe 1152 mpqaituq.exe 4200 nquicygbhuqni.exe 1152 mpqaituq.exe 4200 nquicygbhuqni.exe 1152 mpqaituq.exe 4200 nquicygbhuqni.exe 532 mpqaituq.exe 532 mpqaituq.exe 532 mpqaituq.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1348 WINWORD.EXE 1348 WINWORD.EXE 1348 WINWORD.EXE 1348 WINWORD.EXE 1348 WINWORD.EXE 1348 WINWORD.EXE 1348 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exedescription pid process target process PID 1072 wrote to memory of 1100 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe rmrtuwvcaq.exe PID 1072 wrote to memory of 1100 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe rmrtuwvcaq.exe PID 1072 wrote to memory of 1100 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe rmrtuwvcaq.exe PID 1072 wrote to memory of 1512 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe sqsxpwlcsjabgbt.exe PID 1072 wrote to memory of 1512 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe sqsxpwlcsjabgbt.exe PID 1072 wrote to memory of 1512 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe sqsxpwlcsjabgbt.exe PID 1072 wrote to memory of 1152 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe mpqaituq.exe PID 1072 wrote to memory of 1152 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe mpqaituq.exe PID 1072 wrote to memory of 1152 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe mpqaituq.exe PID 1072 wrote to memory of 4200 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe nquicygbhuqni.exe PID 1072 wrote to memory of 4200 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe nquicygbhuqni.exe PID 1072 wrote to memory of 4200 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe nquicygbhuqni.exe PID 1072 wrote to memory of 1348 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe WINWORD.EXE PID 1072 wrote to memory of 1348 1072 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe WINWORD.EXE PID 1100 wrote to memory of 532 1100 rmrtuwvcaq.exe mpqaituq.exe PID 1100 wrote to memory of 532 1100 rmrtuwvcaq.exe mpqaituq.exe PID 1100 wrote to memory of 532 1100 rmrtuwvcaq.exe mpqaituq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\rmrtuwvcaq.exermrtuwvcaq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\mpqaituq.exeC:\Windows\system32\mpqaituq.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:532 -
C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exesqsxpwlcsjabgbt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1512 -
C:\Windows\SysWOW64\mpqaituq.exempqaituq.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1152 -
C:\Windows\SysWOW64\nquicygbhuqni.exenquicygbhuqni.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4200 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1348
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
512KB
MD5d7e5c21eaab22f8ef06da4c2797cbacd
SHA18055938a49e790976f22226f6c73824cf24f700c
SHA2560639730fcdc75ae17a7dc6d07106742232e9c43d75bc7f70cbc6df43bf5907f3
SHA5124b08b93f03f059e8c3e5413d9638fd48fd3a7dc7b56639d3c488f04eebaa4b188615646abc11ac5f26fce2692e82ab188f4bea8eea304320f85e9a8d579f7a5c
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
512KB
MD5a1271529adc5be9f15a27dca3cb13956
SHA1772dd37be39ecdd6798473c4042d726ef9563114
SHA256fe27c4baa9b85f8669b4bb0994bb5a31a770449c2c0260ec7694b773f1bf5b0b
SHA512cd7d6f21777ebfab653de51cc5f4783589ce915f8c218fbc615c0972dac562a364a4a5449cf8d00962229ee99a8486f5f907959fa29d9170f74a04bc719f829a
-
C:\Users\Admin\AppData\Local\Temp\TCDC650.tmp\iso690.xslFilesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msFilesize
3KB
MD5315e1b0fde32ee0b7a0c36e87b3301cc
SHA1f7c3db0d71eebec22e4fc43f279458259a2722c4
SHA2561f8b77a4ca499562cc30d4a99cbed6f7b52b572b02b341f049f4eb325d486f09
SHA512956e6ae6bf934f19bc6bfa9c3a45b5d7e217b3c838493d3e2073315296ec58ce06a3637e98c1f95e6639e57db2f5307b723ed706ab1fba7a3b3cdc26331421eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msFilesize
3KB
MD5bf8e5054a7f75486ce54be500f207f92
SHA140fbd8f0a23e9c2a1eb56b0affb76bd4bdb1370c
SHA2565f7bbfe73624b558bff95b70f24e5c257bd6039049b7fb88cdd301bd6cfd151b
SHA51251b2c88ff34f07835d5f9cfab88dbb86e1560ad0dca2639a840538028ab5915c1fb292cf1248f7a27c903bfc7a1c32b06bfd2ec7086908978733c70eba363e8e
-
C:\Users\Admin\Desktop\DisableRead.doc.exeFilesize
512KB
MD5be7d9f85b5f3e1d1546da555f6140b37
SHA19f5e6344f648d8baedd5da7d4dd952fbbd6dc08f
SHA2567d63bc328c87e4132679430488a52d2d96b89923cd25bb2819ecaaacbc695a61
SHA512b6916286bfa1eeac76d9bc4941b3c914286e7548bf83a6363c9ae350a5b013ca1bc52b3f75eeaccd66842ceff4cbcd72fc0bdd0482420e7ae2f4df5d4c9e0789
-
C:\Users\Admin\Documents\UnlockStep.doc.exeFilesize
512KB
MD51a3a2f9eada51302974342e8fda9f68e
SHA1fe98c3595104d250d5258671e55e9f9bba1ccb48
SHA256a1896f26d4ff4dd2922f14c108dd1816a59c050fa4ff91ba42005a1655883f75
SHA512bcfb3c730fd92efc67797fd689485c47b84fb4613955e20b9eab5c4999bbab8a0aa37c2d9a85c519d6dffb578cf6cd5e559c5f79b6d3a29d71a73cc1e84bc029
-
C:\Windows\SysWOW64\mpqaituq.exeFilesize
512KB
MD5256b3dc16dab0907c2371c5c3866067a
SHA18089fa5c7876a5a32bb898669c166c1d9b52b4eb
SHA256d23d4ad379d0207e3c3e72996e8407242ac2a16c7b327df83d6f97e4092d3647
SHA512a0ab82ab10f8a00d3190e8f9a414ba05fbfd67d9bb137b217dde93a1af0044685d8cdab3c35d572d4e6f958edb5c6431238dcc5d1cb6373fb1f8a6bb80be99bf
-
C:\Windows\SysWOW64\nquicygbhuqni.exeFilesize
512KB
MD55cf1c64f88d40eac6f286a247cce58b0
SHA166546400c92fd4028d252bfb72c1515a536a6470
SHA256fc264c9db193de12f08ad07025808866f176e0a08999360b1d1dd82fb8aad383
SHA5125f42e51e236c7aff714b9002f5c382943da40415af08119a0c360fc94f9b781abd391f5135d77da9938bec8913560abe22112beec6d48583f8a1b0bfccb8d804
-
C:\Windows\SysWOW64\rmrtuwvcaq.exeFilesize
512KB
MD570398296aebec6bd2a025e99a4f37e06
SHA198eb1ba340bdde68c5b828f950c80db2a19c16c7
SHA2563b04a32b5b79b6dd7d9b6e5c8e6fb77749c660ce83c7a32320118972b20d2d4d
SHA512bf8ec6b7bd6168c080b69b9461d3857e8526d09910f211758080e41453062c29f05d381fc5fbad1d7b838d0b11e81f09f56a6c8bbd55e3fa45e29f3561b23be3
-
C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exeFilesize
512KB
MD539584665f677e358526784b148f88eca
SHA134069e776c281b31cab24f070d80a4af23204af5
SHA256307bf998caf8ad745f9dd9a9c6891bd75b3711355b4d1ae0e01afaf572d2a489
SHA51240feae8aa7d69fa7410271cf149731501b7d7af4529e56211891c33ef99911920058be72d57ccdfc9aa53b356959cdfee5958e827a72b8a1eea71004589dfa55
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
512KB
MD580bc2f5e5f85166e1b3180ff21cd0b19
SHA162b47c373a03c9a862129bbadb1729e66fe60529
SHA2569a1d81b5e1537cf33604338ee45bab08c8a038e7f8d94dec4268458c7b7478e1
SHA5128c0039da07cde84e6fdc3a83ba7e1bfd853d38173a2a7b320a619fb1d854c1b0b202d2cb92630641a8b1220caa0bf4045a0e5d5a0d8c631ff1572246b44d2bdd
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
512KB
MD50cab823d5a7990364ae51702d49d4b26
SHA1b62c3de2069226c6cb72ab09b2a3dad3eb0ce41a
SHA2568924dc041c4fdf158941c3fb7186bd173630540d1b6d00cdfe9916036800a46a
SHA512daed9f279785c3dffc1b9df6cf4d5a92bd4f247a2e3d16cb7bb6dbe54e94e66843515d3c83cb1416bc3e5a7948780ce35de05bd9ad4f59ce4ea5e46a83b8d0e0
-
memory/1072-0-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB
-
memory/1348-37-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-38-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-36-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-39-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-40-0x00007FFD37C10000-0x00007FFD37C20000-memory.dmpFilesize
64KB
-
memory/1348-43-0x00007FFD37C10000-0x00007FFD37C20000-memory.dmpFilesize
64KB
-
memory/1348-35-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-574-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-575-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-573-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB
-
memory/1348-576-0x00007FFD39DF0000-0x00007FFD39E00000-memory.dmpFilesize
64KB