Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 23:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe
-
Size
512KB
-
MD5
702f89b3c55f349302bfb16b85836ffd
-
SHA1
ad00ae46a14eb1dee828163e7b13325dc0396fba
-
SHA256
eb2691a49b8af744ea31c26084a7624d5384e7fb2f9357837cb88649a834f82d
-
SHA512
c83a48a4437ed8bbf70b16c458137a1f1074c6d10d351e7300d5d48c20b15e188fb0b7cd5ba33be999d645a74e195c3d3709d4af7fcc84cc9f06186c9db78381
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ykkvuyxffg.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ykkvuyxffg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ykkvuyxffg.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ykkvuyxffg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 3176 ykkvuyxffg.exe 2968 qymljuau.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 684 qymljuau.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ykkvuyxffg.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\niggnutn = "pbfatfgbmgbjrrc.exe" pbfatfgbmgbjrrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kwaqnyeayxqgu.exe" pbfatfgbmgbjrrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dfmqjyny = "ykkvuyxffg.exe" pbfatfgbmgbjrrc.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: qymljuau.exe File opened (read-only) \??\m: ykkvuyxffg.exe File opened (read-only) \??\r: ykkvuyxffg.exe File opened (read-only) \??\e: qymljuau.exe File opened (read-only) \??\q: qymljuau.exe File opened (read-only) \??\u: qymljuau.exe File opened (read-only) \??\x: qymljuau.exe File opened (read-only) \??\h: ykkvuyxffg.exe File opened (read-only) \??\j: ykkvuyxffg.exe File opened (read-only) \??\l: ykkvuyxffg.exe File opened (read-only) \??\j: qymljuau.exe File opened (read-only) \??\w: qymljuau.exe File opened (read-only) \??\p: qymljuau.exe File opened (read-only) \??\u: qymljuau.exe File opened (read-only) \??\i: qymljuau.exe File opened (read-only) \??\o: qymljuau.exe File opened (read-only) \??\a: ykkvuyxffg.exe File opened (read-only) \??\q: ykkvuyxffg.exe File opened (read-only) \??\i: qymljuau.exe File opened (read-only) \??\l: qymljuau.exe File opened (read-only) \??\y: qymljuau.exe File opened (read-only) \??\t: ykkvuyxffg.exe File opened (read-only) \??\g: qymljuau.exe File opened (read-only) \??\z: qymljuau.exe File opened (read-only) \??\q: qymljuau.exe File opened (read-only) \??\r: qymljuau.exe File opened (read-only) \??\w: qymljuau.exe File opened (read-only) \??\h: qymljuau.exe File opened (read-only) \??\t: qymljuau.exe File opened (read-only) \??\v: qymljuau.exe File opened (read-only) \??\v: qymljuau.exe File opened (read-only) \??\b: qymljuau.exe File opened (read-only) \??\n: qymljuau.exe File opened (read-only) \??\l: qymljuau.exe File opened (read-only) \??\n: qymljuau.exe File opened (read-only) \??\e: ykkvuyxffg.exe File opened (read-only) \??\v: ykkvuyxffg.exe File opened (read-only) \??\y: ykkvuyxffg.exe File opened (read-only) \??\k: qymljuau.exe File opened (read-only) \??\m: qymljuau.exe File opened (read-only) \??\p: qymljuau.exe File opened (read-only) \??\z: qymljuau.exe File opened (read-only) \??\g: ykkvuyxffg.exe File opened (read-only) \??\r: qymljuau.exe File opened (read-only) \??\b: qymljuau.exe File opened (read-only) \??\s: qymljuau.exe File opened (read-only) \??\m: qymljuau.exe File opened (read-only) \??\h: qymljuau.exe File opened (read-only) \??\i: ykkvuyxffg.exe File opened (read-only) \??\z: ykkvuyxffg.exe File opened (read-only) \??\p: ykkvuyxffg.exe File opened (read-only) \??\w: ykkvuyxffg.exe File opened (read-only) \??\x: ykkvuyxffg.exe File opened (read-only) \??\x: qymljuau.exe File opened (read-only) \??\e: qymljuau.exe File opened (read-only) \??\t: qymljuau.exe File opened (read-only) \??\b: ykkvuyxffg.exe File opened (read-only) \??\a: qymljuau.exe File opened (read-only) \??\s: qymljuau.exe File opened (read-only) \??\y: qymljuau.exe File opened (read-only) \??\a: qymljuau.exe File opened (read-only) \??\o: ykkvuyxffg.exe File opened (read-only) \??\o: qymljuau.exe File opened (read-only) \??\k: ykkvuyxffg.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ykkvuyxffg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ykkvuyxffg.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/996-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233c8-5.dat autoit_exe behavioral2/files/0x00080000000233c4-18.dat autoit_exe behavioral2/files/0x00070000000233c9-23.dat autoit_exe behavioral2/files/0x00070000000233ca-32.dat autoit_exe behavioral2/files/0x00020000000229c8-68.dat autoit_exe behavioral2/files/0x00080000000233b4-76.dat autoit_exe behavioral2/files/0x00070000000233e7-94.dat autoit_exe behavioral2/files/0x00070000000233e7-448.dat autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qymljuau.exe File created C:\Windows\SysWOW64\ykkvuyxffg.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ykkvuyxffg.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File created C:\Windows\SysWOW64\pbfatfgbmgbjrrc.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\qymljuau.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File created C:\Windows\SysWOW64\kwaqnyeayxqgu.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification C:\Windows\SysWOW64\pbfatfgbmgbjrrc.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File created C:\Windows\SysWOW64\qymljuau.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kwaqnyeayxqgu.exe 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ykkvuyxffg.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qymljuau.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qymljuau.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qymljuau.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qymljuau.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qymljuau.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qymljuau.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qymljuau.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qymljuau.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qymljuau.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qymljuau.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qymljuau.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qymljuau.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qymljuau.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qymljuau.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qymljuau.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qymljuau.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qymljuau.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qymljuau.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qymljuau.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qymljuau.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qymljuau.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qymljuau.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification C:\Windows\mydoc.rtf 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qymljuau.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qymljuau.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qymljuau.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ykkvuyxffg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ykkvuyxffg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ykkvuyxffg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ykkvuyxffg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ykkvuyxffg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFCFB485882699136D62E7D90BD97E640583066466342D691" 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ykkvuyxffg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ykkvuyxffg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ykkvuyxffg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ykkvuyxffg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ykkvuyxffg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ykkvuyxffg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32352C0A9C2282596D4277A0772E2CD87DF164DE" 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB5FACDF96BF19884743B47869C3993B0F9028843110333E2CC459B08A9" 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB05847E339EE53C4B9D732EDD4B8" 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BB3FE6922D9D27AD1A78A0C9063" 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184EC67815E5DAC7B8CA7FE1ECE534C7" 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ykkvuyxffg.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5048 WINWORD.EXE 5048 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 3176 ykkvuyxffg.exe 2968 qymljuau.exe 2968 qymljuau.exe 2968 qymljuau.exe 2968 qymljuau.exe 2968 qymljuau.exe 2968 qymljuau.exe 2968 qymljuau.exe 2968 qymljuau.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 400 kwaqnyeayxqgu.exe 4196 pbfatfgbmgbjrrc.exe 4196 pbfatfgbmgbjrrc.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 3176 ykkvuyxffg.exe 2968 qymljuau.exe 3176 ykkvuyxffg.exe 2968 qymljuau.exe 3176 ykkvuyxffg.exe 2968 qymljuau.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 3176 ykkvuyxffg.exe 2968 qymljuau.exe 3176 ykkvuyxffg.exe 2968 qymljuau.exe 3176 ykkvuyxffg.exe 2968 qymljuau.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 4196 pbfatfgbmgbjrrc.exe 400 kwaqnyeayxqgu.exe 684 qymljuau.exe 684 qymljuau.exe 684 qymljuau.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5048 WINWORD.EXE 5048 WINWORD.EXE 5048 WINWORD.EXE 5048 WINWORD.EXE 5048 WINWORD.EXE 5048 WINWORD.EXE 5048 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 996 wrote to memory of 3176 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 82 PID 996 wrote to memory of 3176 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 82 PID 996 wrote to memory of 3176 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 82 PID 996 wrote to memory of 4196 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 83 PID 996 wrote to memory of 4196 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 83 PID 996 wrote to memory of 4196 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 83 PID 996 wrote to memory of 2968 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 84 PID 996 wrote to memory of 2968 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 84 PID 996 wrote to memory of 2968 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 84 PID 996 wrote to memory of 400 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 85 PID 996 wrote to memory of 400 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 85 PID 996 wrote to memory of 400 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 85 PID 3176 wrote to memory of 684 3176 ykkvuyxffg.exe 87 PID 3176 wrote to memory of 684 3176 ykkvuyxffg.exe 87 PID 3176 wrote to memory of 684 3176 ykkvuyxffg.exe 87 PID 996 wrote to memory of 5048 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 86 PID 996 wrote to memory of 5048 996 702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\702f89b3c55f349302bfb16b85836ffd_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\ykkvuyxffg.exeykkvuyxffg.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\qymljuau.exeC:\Windows\system32\qymljuau.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:684
-
-
-
C:\Windows\SysWOW64\pbfatfgbmgbjrrc.exepbfatfgbmgbjrrc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4196
-
-
C:\Windows\SysWOW64\qymljuau.exeqymljuau.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2968
-
-
C:\Windows\SysWOW64\kwaqnyeayxqgu.exekwaqnyeayxqgu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:400
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5048
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5d0cd62455f9911bb49d88397a42bde00
SHA19b5712e939abec4001d0ca29e098e8c02e9f1e35
SHA256a806f6b4c3ac29f3a99cf17034f8bd69d0d827dc1cafdd457fb07060099141ff
SHA512d4fdc0c467753dbf3db6f01ed838c0f5b8bb209d313200e52a6a38d30d3c616ae5a90d759f645c71493926218e0857f09abe23e07f7a4a5b3792c5f113a0f762
-
Filesize
512KB
MD5dbbade768683861cbbd7a8192004454d
SHA1931653a0383dfdd70e3a67a79825725516ee97f2
SHA256e4008941cd02de80ae6d8a0800b84760175cfd679b6113068d5f6265b4947fe8
SHA51200a3202c2eed4378e387c950b607dbcc3ca00c9ebd8f7143f3a25a7904629886400a8931fe8e4d1d3930193d32d2027c056f2ca1b18a2b46fdbb92785e125fd2
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD547e341ed0261c11cecc9dcd7105aeb1b
SHA13a565f277b8b0e3e65b8961089ef16292596ad24
SHA25607a058dca73e15ec51bb6cf1f40ceac26cf5ef013a44591a9fc21a479c72167d
SHA512fd0d5d5d2a06d5a9b941612fa89288bdaa8b438e2df3d2a6ec37670e35bb3cf4c800fc0d4876e67573efa041fbee5b547d3392d1a8a29205d62258e81f1dfa9f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5a12d001a7198556f7569226a700549f5
SHA18a7a4e7d6efacb9bf4f2b30fd1bc1074b1785e6e
SHA256eda43b53e70dfba16fb0d6c8dea3a91001911581f8b38d6da7eb3938bfec4e08
SHA512cd90c34d2f77abbb57fd68f7f697a8659a7f85c862a9f023cd8399652cd40caffd9e09987c306fc11766d4c600add1b97421767e5fb4fa0fe4f507a1f0cd316d
-
Filesize
512KB
MD5dc4a010ea51df0e48ec6d42d6fbfc904
SHA1dc3ea9444db131f7c45f4854112e9cc35b705ef6
SHA25692ed0f949ada7b8dcef659f9e7f12f869ecbaca16394e0aac0987c27946e9073
SHA51262a9a4a74797eac1e6329b5d2b37290f2e5f647d7ffc08b53a0c7f21a21cf76a84c028320a271fe1a0390b04ebd5269014aed467a0b09d355f8b5d9a64bb2fce
-
Filesize
512KB
MD55fca2a891257ec514e5cd2633222a8b4
SHA162de770dd519d63893d0b7800a20e8bc7f0bca85
SHA256fcef55f6894736b268d8e614a6cde27d42dcbe97a3ff53269c4a289ac969432a
SHA512bc573a27f1208346c9f8bf00821a38e0bdc0fd62123bc2d811ac89f8936887693bfab1450f8f15ca83a5ea205c3ee00f0602c02206d78d08c5512a6ab67ba7b9
-
Filesize
512KB
MD5cdb3d0b02d262692563878cf235f707c
SHA1686aa4326fb74ccf48846d055f2b2fbd132a8ea7
SHA256827317af7856afa71d894ec2e57f38737117f9dcd760aac4de53d05f0c1d3489
SHA512078f54b6df8b42a7f44805cc39d04442b346828fc5e828a9cdb99cab87949b062e6b37cafceb7077c71c28cd8a685aa03fc0de789d9edec91587ad7e3bba0aa5
-
Filesize
512KB
MD55240291c9c11d080d6a1eabc274c1233
SHA1ec378a24a78e86e507fada79a91b366d267baf9e
SHA2568de1562edf7104ff2182c5231517896e53b1937d9584532165e51240dc584dce
SHA512b26def33a107ad032432757a24ffe7706b121686e9156e8cc728a3e69790824d35fc7e030149c61004261dd7ba7bc7717aa139b8ecfe1df1559f3747a9e45e38
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5dca3802beb85444a7fd4cd9d156d8061
SHA1893b15d8bfaafdba891c0333e2d5424359e46aa2
SHA256bffb74c92f4c85f941f2b2ce980eee86d178b63debe96053b92b0888dbf08599
SHA51260c47b0a0c2f77d01cca08515d4eed34864a3ba4f18f3f7c6ed507877e8315be0dbce65f3a52ca14ab18d54e632170d20f8d8f87a532295667476342de22a353
-
Filesize
512KB
MD54b47e7b31bea805f8636609be4152a6e
SHA1f41bebc974a8d47107f90ee5e2790dd490e7bb41
SHA25658bdd590e24ba91a7cade0c77504ae0b33a345f6d9704ee2e0e42180fdfb09cb
SHA512de281496507123fd5569943aa68ca85e04bdd297ad9a5effe0269a137ffa221a68c20f8592d3fa6cd48f809e1f55c898f869c3f4f6032f4464ac7cbd89c0a53a