Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe
-
Size
512KB
-
MD5
6f91d104958a5ca488ef235eec0c5cb4
-
SHA1
da2b08f41effa470dc52346de414c245ecd7a464
-
SHA256
b6f0f81ecbef63b78f96402aea3b00e8443acaa76c130d9ba685c517cdae21ee
-
SHA512
d267842ff5fd158fe1700cfa7be1c6b086e9cb12a86f836e068adddc1574793a5a08f1b8d299c188ca597a036bd191612df3f32c0a9f360a99eb3f183be6527d
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kbtsvkuycz.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kbtsvkuycz.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kbtsvkuycz.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kbtsvkuycz.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 2240 kbtsvkuycz.exe 3628 yawyydhogbztgse.exe 216 llpehlwm.exe 464 xfkqvalnokcbj.exe 3476 llpehlwm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kbtsvkuycz.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbyhteuu = "yawyydhogbztgse.exe" yawyydhogbztgse.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xfkqvalnokcbj.exe" yawyydhogbztgse.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aqegxpuv = "kbtsvkuycz.exe" yawyydhogbztgse.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: llpehlwm.exe File opened (read-only) \??\n: llpehlwm.exe File opened (read-only) \??\p: llpehlwm.exe File opened (read-only) \??\o: llpehlwm.exe File opened (read-only) \??\h: llpehlwm.exe File opened (read-only) \??\k: kbtsvkuycz.exe File opened (read-only) \??\u: kbtsvkuycz.exe File opened (read-only) \??\s: llpehlwm.exe File opened (read-only) \??\p: kbtsvkuycz.exe File opened (read-only) \??\r: kbtsvkuycz.exe File opened (read-only) \??\i: llpehlwm.exe File opened (read-only) \??\s: kbtsvkuycz.exe File opened (read-only) \??\a: llpehlwm.exe File opened (read-only) \??\i: llpehlwm.exe File opened (read-only) \??\k: llpehlwm.exe File opened (read-only) \??\v: llpehlwm.exe File opened (read-only) \??\j: llpehlwm.exe File opened (read-only) \??\u: llpehlwm.exe File opened (read-only) \??\g: kbtsvkuycz.exe File opened (read-only) \??\l: kbtsvkuycz.exe File opened (read-only) \??\z: kbtsvkuycz.exe File opened (read-only) \??\x: llpehlwm.exe File opened (read-only) \??\q: llpehlwm.exe File opened (read-only) \??\s: llpehlwm.exe File opened (read-only) \??\x: llpehlwm.exe File opened (read-only) \??\n: kbtsvkuycz.exe File opened (read-only) \??\o: kbtsvkuycz.exe File opened (read-only) \??\q: llpehlwm.exe File opened (read-only) \??\w: llpehlwm.exe File opened (read-only) \??\z: llpehlwm.exe File opened (read-only) \??\i: kbtsvkuycz.exe File opened (read-only) \??\a: kbtsvkuycz.exe File opened (read-only) \??\y: kbtsvkuycz.exe File opened (read-only) \??\z: llpehlwm.exe File opened (read-only) \??\w: kbtsvkuycz.exe File opened (read-only) \??\x: kbtsvkuycz.exe File opened (read-only) \??\r: llpehlwm.exe File opened (read-only) \??\e: kbtsvkuycz.exe File opened (read-only) \??\q: kbtsvkuycz.exe File opened (read-only) \??\l: llpehlwm.exe File opened (read-only) \??\v: kbtsvkuycz.exe File opened (read-only) \??\u: llpehlwm.exe File opened (read-only) \??\m: llpehlwm.exe File opened (read-only) \??\n: llpehlwm.exe File opened (read-only) \??\h: kbtsvkuycz.exe File opened (read-only) \??\j: kbtsvkuycz.exe File opened (read-only) \??\m: kbtsvkuycz.exe File opened (read-only) \??\h: llpehlwm.exe File opened (read-only) \??\r: llpehlwm.exe File opened (read-only) \??\v: llpehlwm.exe File opened (read-only) \??\e: llpehlwm.exe File opened (read-only) \??\b: kbtsvkuycz.exe File opened (read-only) \??\b: llpehlwm.exe File opened (read-only) \??\e: llpehlwm.exe File opened (read-only) \??\t: llpehlwm.exe File opened (read-only) \??\w: llpehlwm.exe File opened (read-only) \??\a: llpehlwm.exe File opened (read-only) \??\m: llpehlwm.exe File opened (read-only) \??\t: kbtsvkuycz.exe File opened (read-only) \??\y: llpehlwm.exe File opened (read-only) \??\g: llpehlwm.exe File opened (read-only) \??\l: llpehlwm.exe File opened (read-only) \??\k: llpehlwm.exe File opened (read-only) \??\y: llpehlwm.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kbtsvkuycz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kbtsvkuycz.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2332-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0008000000023254-5.dat autoit_exe behavioral2/files/0x0008000000023252-18.dat autoit_exe behavioral2/files/0x0008000000023256-26.dat autoit_exe behavioral2/files/0x0008000000023257-32.dat autoit_exe behavioral2/files/0x000800000002310a-52.dat autoit_exe behavioral2/files/0x000800000002325a-55.dat autoit_exe behavioral2/files/0x0003000000000733-109.dat autoit_exe behavioral2/files/0x0003000000000733-115.dat autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\yawyydhogbztgse.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kbtsvkuycz.exe File opened for modification C:\Windows\SysWOW64\kbtsvkuycz.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe llpehlwm.exe File opened for modification C:\Windows\SysWOW64\llpehlwm.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File created C:\Windows\SysWOW64\yawyydhogbztgse.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File created C:\Windows\SysWOW64\llpehlwm.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe llpehlwm.exe File created C:\Windows\SysWOW64\kbtsvkuycz.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xfkqvalnokcbj.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe llpehlwm.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe llpehlwm.exe File created C:\Windows\SysWOW64\xfkqvalnokcbj.exe 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe llpehlwm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe llpehlwm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal llpehlwm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe llpehlwm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe llpehlwm.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe llpehlwm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal llpehlwm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal llpehlwm.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe llpehlwm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe llpehlwm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe llpehlwm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal llpehlwm.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe llpehlwm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe llpehlwm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe llpehlwm.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332C7A9D2D82256D4376A277232DD77DF665AA" 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kbtsvkuycz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kbtsvkuycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kbtsvkuycz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kbtsvkuycz.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FFF8482B82699045D75F7DE0BDE3E13D593567446345D79E" 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kbtsvkuycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kbtsvkuycz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kbtsvkuycz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F068B4FE1821DFD178D1D58B7C9017" 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kbtsvkuycz.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCFACCFE6AF29084793B4586EC39E5B088028F4262023DE1C9459C08D6" 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B15F44EE399853BDBAA53392D7CB" 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC6081490DAB3B9C07CE1ECE237CC" 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kbtsvkuycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kbtsvkuycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kbtsvkuycz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kbtsvkuycz.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1796 WINWORD.EXE 1796 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 3476 llpehlwm.exe 3476 llpehlwm.exe 3476 llpehlwm.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 2240 kbtsvkuycz.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 3628 yawyydhogbztgse.exe 216 llpehlwm.exe 216 llpehlwm.exe 216 llpehlwm.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 464 xfkqvalnokcbj.exe 3476 llpehlwm.exe 3476 llpehlwm.exe 3476 llpehlwm.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2240 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 92 PID 2332 wrote to memory of 2240 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 92 PID 2332 wrote to memory of 2240 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 92 PID 2332 wrote to memory of 3628 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 93 PID 2332 wrote to memory of 3628 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 93 PID 2332 wrote to memory of 3628 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 93 PID 2332 wrote to memory of 216 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 94 PID 2332 wrote to memory of 216 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 94 PID 2332 wrote to memory of 216 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 94 PID 2332 wrote to memory of 464 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 95 PID 2332 wrote to memory of 464 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 95 PID 2332 wrote to memory of 464 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 95 PID 2240 wrote to memory of 3476 2240 kbtsvkuycz.exe 96 PID 2240 wrote to memory of 3476 2240 kbtsvkuycz.exe 96 PID 2240 wrote to memory of 3476 2240 kbtsvkuycz.exe 96 PID 2332 wrote to memory of 1796 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 97 PID 2332 wrote to memory of 1796 2332 6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f91d104958a5ca488ef235eec0c5cb4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\kbtsvkuycz.exekbtsvkuycz.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\llpehlwm.exeC:\Windows\system32\llpehlwm.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3476
-
-
-
C:\Windows\SysWOW64\yawyydhogbztgse.exeyawyydhogbztgse.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3628
-
-
C:\Windows\SysWOW64\llpehlwm.exellpehlwm.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:216
-
-
C:\Windows\SysWOW64\xfkqvalnokcbj.exexfkqvalnokcbj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:464
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:1228
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5b74c65235a5ad496a5d24e255dd0aa63
SHA1b3d3c577b773a6aac7f399aec5e2d8eb14600876
SHA25696de1ff8612e3dbca68b863241cbcf96a0f718bc2e8f4b5406f0f7de5dd0a490
SHA512a09f9a2db9dd18dc606c63c2aafdf44c2ed8df88b07374f5ac885facdad5e1404992c417957e70a64c376f97008be9e109f23cb0a75e4c0f7ef70c76906eed6f
-
Filesize
512KB
MD5887ee727ac138e4743c3fe8bd95c2bc0
SHA19d5c1ed37c11c4f27d383572fd80c17f0eae9c13
SHA256bc238389d983758efc7589c2ef13c94fe4fd15f5edc08d72dcbdd0eb26efbef5
SHA5123740ad39993919f0003667fbbe56277d7038bd76f36a05a127298181367452223fa41e88243a021cf88d0f4d1200f828284a7b9083a1229ad9eb2826449a5766
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5df3dba635252e4218d12604b3925d81b
SHA1c6789288ab5ede2cc344354a5ac6b832a3dcd977
SHA256c5d325dda34aafdda9dcb289609fdc11fd75761c2d354e01eeaaccb57303d9ef
SHA5125d03531f03dbc5e9fee5186095b9a30542a80724c94291db01eee386699cc0b5bbaeff56ab436ffbc5baecd4aaed3ea6501f798ea241006b1f3e9188a44e4c68
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD58ee444ae95c3b8c4d4f6dd43e9874810
SHA188c91f7eb3d427fa24cb57be19ea4878cd1bdc85
SHA256a847c68fd32b9887eec8a9f0b4e32299059c3d6363e50e811379fc88ecdb6312
SHA5120fa8e9b52396cac7a76e705f4f01cc4cd2d18681cf7f0217c93de54d6f70574aee804cdffcec1e90795e57fc8d7cfa60d062a832bbe540d606c720d64c4a5596
-
Filesize
512KB
MD562561148aa140f8a9f6d44c6c7d8e66c
SHA1f466e9e359c2f11dd0f1c7d64a025a2ae89e6252
SHA25639a0dd5592070671034440b2a86d0a64328f4858e6e82a3ce9681293453db63d
SHA512ac227755690271b9edf5a5a4bafe37cdcc490ff59823b5af5ed7736af0f07e121e287558706f87a339378d5802018ab439bdba140496fa4eaddfafe4f2e1a86b
-
Filesize
512KB
MD561533a1efcdbb7339413c91053202708
SHA1877efc8b624afcfd5550800359997c4f3e7d9969
SHA256f94464fbc611fbc24f2d5de0836e34ee1f19bdc3887d928f485c96f75fa3ca56
SHA51265eb46086a411a507b18cdbab2df2bce287176aa8b6db5fb190e5e50b8ee712dc546a22c66928d622fd9ee985f680ba40f12aef044c180fc1b20543a475495a8
-
Filesize
512KB
MD521c431cb7d981e0eb23116a39cfa84f8
SHA1b1392ce814a17a2c229c2bc255e8a04cca7f655d
SHA256b198e95352112e735c2f68190a4e4f9020c5c37e5881fcf77a5f81709f709aa8
SHA5121389940db529fad6d4604f9e4b4661f92762feb6b2e3935da858e66e76dff920171147f5600dd11a8f8b8ab19741cfcc73437e693ff87e591ed4d5440fa346d3
-
Filesize
512KB
MD5a57949e43c37a19fa03b7c914d23c653
SHA1ed8d6a69ed3030ebb4fbd7084eb44e613a742033
SHA256dbf353bcbd7ae9768a7e83f317d098190ad56ae9f1a8b0ff9adfb22f9b5e9572
SHA5127e15e5eef4f2df81972b8d30f024969474e317e1495429f916b5200a889e7ebdd54ca1ea5d5737f638bb226a11eb948b456ce758f17e7270b22f54ff5b007fb7
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD52788ccc3823995f95a318b64fab33f6f
SHA12ee4fd3a135ce5ca6e78f3b7a81960fb99f8ad92
SHA256faa17f29300936a73fdfb58209264f85d25dba9ceb79ca5cef9bd894ec8da421
SHA512fe497efcb38d7357ddd670dbeda91b236d52d8730a36b8d57ac10a0288001114ce23bae759d3b41e62e85e54f023bfc9b39ff6d8cd698eb1c30844443625f9f0
-
Filesize
512KB
MD58992bb7e17bb5b6c2057b7af7319762c
SHA14eebaa3a01a4d7102594a50daefa81e081352f1b
SHA256d7cd960b84806c492d1b8efefdb704134beec1e8dc97d39be00a7c83e7804223
SHA512fef8edfb6ded56c9f6ef4d50d20a3c4573042458c8de6bbe346593b793f310455e696d0faa5d6a382ee0036661c5cc14203e1b5c789c9a1d97ade189c8f3a9bd