Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 02:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe
- Size 512KB
- Sample240526-dc2zvsda99
- SHA256 1a4a8120a43923dadc67d277e315ac09ae1928830bf5a77d70374bb5b07a25a0
- MD5 741c69cb9dd55dd03baad28205229302
- SHA1 9f384441abda4be32df8479257355cd8ef78ff96
- SHA512 e684379486bde56fee2c87b48ccdb3fa06e8d0288a168e6e7bf6d2e3f302eb57565e2a0bfee8fcf35599685a93799ad4cea874fc9e2965fc4cd088cd9d644d4d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fihpbfcfyc.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fihpbfcfyc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fihpbfcfyc.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fihpbfcfyc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2232 fihpbfcfyc.exe 1704 dsmjhlrjwmtadot.exe 4788 pvyludfu.exe 4644 jyjhzrymnxwbt.exe 1748 pvyludfu.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fihpbfcfyc.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eywumyvf = "fihpbfcfyc.exe" dsmjhlrjwmtadot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\helyerpa = "dsmjhlrjwmtadot.exe" dsmjhlrjwmtadot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jyjhzrymnxwbt.exe" dsmjhlrjwmtadot.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: fihpbfcfyc.exe File opened (read-only) \??\x: fihpbfcfyc.exe File opened (read-only) \??\x: pvyludfu.exe File opened (read-only) \??\v: fihpbfcfyc.exe File opened (read-only) \??\b: pvyludfu.exe File opened (read-only) \??\q: pvyludfu.exe File opened (read-only) \??\l: pvyludfu.exe File opened (read-only) \??\h: pvyludfu.exe File opened (read-only) \??\u: fihpbfcfyc.exe File opened (read-only) \??\i: pvyludfu.exe File opened (read-only) \??\e: fihpbfcfyc.exe File opened (read-only) \??\q: fihpbfcfyc.exe File opened (read-only) \??\w: fihpbfcfyc.exe File opened (read-only) \??\e: pvyludfu.exe File opened (read-only) \??\a: pvyludfu.exe File opened (read-only) \??\n: pvyludfu.exe File opened (read-only) \??\p: pvyludfu.exe File opened (read-only) \??\y: fihpbfcfyc.exe File opened (read-only) \??\g: pvyludfu.exe File opened (read-only) \??\q: pvyludfu.exe File opened (read-only) \??\w: pvyludfu.exe File opened (read-only) \??\g: pvyludfu.exe File opened (read-only) \??\x: pvyludfu.exe File opened (read-only) \??\s: fihpbfcfyc.exe File opened (read-only) \??\p: pvyludfu.exe File opened (read-only) \??\h: fihpbfcfyc.exe File opened (read-only) \??\n: fihpbfcfyc.exe File opened (read-only) \??\j: pvyludfu.exe File opened (read-only) \??\k: pvyludfu.exe File opened (read-only) \??\m: pvyludfu.exe File opened (read-only) \??\t: pvyludfu.exe File opened (read-only) \??\j: pvyludfu.exe File opened (read-only) \??\l: pvyludfu.exe File opened (read-only) \??\t: fihpbfcfyc.exe File opened (read-only) \??\h: pvyludfu.exe File opened (read-only) \??\v: pvyludfu.exe File opened (read-only) \??\s: pvyludfu.exe File opened (read-only) \??\u: pvyludfu.exe File opened (read-only) \??\z: fihpbfcfyc.exe File opened (read-only) \??\i: pvyludfu.exe File opened (read-only) \??\b: fihpbfcfyc.exe File opened (read-only) \??\b: pvyludfu.exe File opened (read-only) \??\o: fihpbfcfyc.exe File opened (read-only) \??\n: pvyludfu.exe File opened (read-only) \??\y: pvyludfu.exe File opened (read-only) \??\z: pvyludfu.exe File opened (read-only) \??\m: pvyludfu.exe File opened (read-only) \??\t: pvyludfu.exe File opened (read-only) \??\w: pvyludfu.exe File opened (read-only) \??\j: fihpbfcfyc.exe File opened (read-only) \??\r: fihpbfcfyc.exe File opened (read-only) \??\a: pvyludfu.exe File opened (read-only) \??\k: pvyludfu.exe File opened (read-only) \??\u: pvyludfu.exe File opened (read-only) \??\r: pvyludfu.exe File opened (read-only) \??\y: pvyludfu.exe File opened (read-only) \??\i: fihpbfcfyc.exe File opened (read-only) \??\v: pvyludfu.exe File opened (read-only) \??\l: fihpbfcfyc.exe File opened (read-only) \??\o: pvyludfu.exe File opened (read-only) \??\r: pvyludfu.exe File opened (read-only) \??\s: pvyludfu.exe File opened (read-only) \??\a: fihpbfcfyc.exe File opened (read-only) \??\k: fihpbfcfyc.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fihpbfcfyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fihpbfcfyc.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2748-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023472-5.dat autoit_exe behavioral2/files/0x000a00000002346a-18.dat autoit_exe behavioral2/files/0x0007000000023473-26.dat autoit_exe behavioral2/files/0x0007000000023474-32.dat autoit_exe behavioral2/files/0x000a00000002345c-69.dat autoit_exe behavioral2/files/0x0007000000023480-75.dat autoit_exe behavioral2/files/0x0007000000023482-81.dat autoit_exe behavioral2/files/0x0013000000023489-576.dat autoit_exe behavioral2/files/0x0013000000023489-578.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fihpbfcfyc.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jyjhzrymnxwbt.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fihpbfcfyc.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe pvyludfu.exe File created C:\Windows\SysWOW64\fihpbfcfyc.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dsmjhlrjwmtadot.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File created C:\Windows\SysWOW64\pvyludfu.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\pvyludfu.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File created C:\Windows\SysWOW64\jyjhzrymnxwbt.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe pvyludfu.exe File created C:\Windows\SysWOW64\dsmjhlrjwmtadot.exe 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pvyludfu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pvyludfu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal pvyludfu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pvyludfu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal pvyludfu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pvyludfu.exe File opened for modification \??\c:\Program Files\SyncReceive.doc.exe pvyludfu.exe File opened for modification C:\Program Files\SyncReceive.doc.exe pvyludfu.exe File opened for modification C:\Program Files\SyncReceive.doc.exe pvyludfu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pvyludfu.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pvyludfu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal pvyludfu.exe File opened for modification \??\c:\Program Files\SyncReceive.doc.exe pvyludfu.exe File opened for modification C:\Program Files\SyncReceive.nal pvyludfu.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pvyludfu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pvyludfu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal pvyludfu.exe File created \??\c:\Program Files\SyncReceive.doc.exe pvyludfu.exe File opened for modification C:\Program Files\SyncReceive.nal pvyludfu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pvyludfu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pvyludfu.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe pvyludfu.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe pvyludfu.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe pvyludfu.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe pvyludfu.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe pvyludfu.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe pvyludfu.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe pvyludfu.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe pvyludfu.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe pvyludfu.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C6741597DBB2B8C17FE6EC9E34C8" 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fihpbfcfyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fihpbfcfyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" fihpbfcfyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452C089C2182246A3E76D670252CD87C8764DA" 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB02C44E739EE52CBBAD63293D4B8" 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat fihpbfcfyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" fihpbfcfyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc fihpbfcfyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fihpbfcfyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fihpbfcfyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" fihpbfcfyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf fihpbfcfyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fihpbfcfyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs fihpbfcfyc.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8F9CEF960F19383783B36819939E2B38802F942130338E1CA42EF09D5" 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFC8E482A85199032D65A7E9CBDE0E13C583066406345D690" 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F468C3FF1A22DDD27DD1A78B7F9117" 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1524 WINWORD.EXE 1524 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2232 fihpbfcfyc.exe 1704 dsmjhlrjwmtadot.exe 2232 fihpbfcfyc.exe 1704 dsmjhlrjwmtadot.exe 2232 fihpbfcfyc.exe 2232 fihpbfcfyc.exe 1704 dsmjhlrjwmtadot.exe 1704 dsmjhlrjwmtadot.exe 1704 dsmjhlrjwmtadot.exe 1704 dsmjhlrjwmtadot.exe 1704 dsmjhlrjwmtadot.exe 1704 dsmjhlrjwmtadot.exe 2232 fihpbfcfyc.exe 2232 fihpbfcfyc.exe 2232 fihpbfcfyc.exe 2232 fihpbfcfyc.exe 2232 fihpbfcfyc.exe 2232 fihpbfcfyc.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 4644 jyjhzrymnxwbt.exe 1704 dsmjhlrjwmtadot.exe 1704 dsmjhlrjwmtadot.exe 4788 pvyludfu.exe 4788 pvyludfu.exe 4788 pvyludfu.exe 4788 pvyludfu.exe 4788 pvyludfu.exe 4788 pvyludfu.exe 4788 pvyludfu.exe 4788 pvyludfu.exe 1704 dsmjhlrjwmtadot.exe 1704 dsmjhlrjwmtadot.exe 1748 pvyludfu.exe 1748 pvyludfu.exe 1748 pvyludfu.exe 1748 pvyludfu.exe 1748 pvyludfu.exe 1748 pvyludfu.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2232 fihpbfcfyc.exe 4788 pvyludfu.exe 1704 dsmjhlrjwmtadot.exe 4644 jyjhzrymnxwbt.exe 2232 fihpbfcfyc.exe 4788 pvyludfu.exe 1704 dsmjhlrjwmtadot.exe 4644 jyjhzrymnxwbt.exe 2232 fihpbfcfyc.exe 4788 pvyludfu.exe 1704 dsmjhlrjwmtadot.exe 4644 jyjhzrymnxwbt.exe 1748 pvyludfu.exe 1748 pvyludfu.exe 1748 pvyludfu.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 2232 fihpbfcfyc.exe 4788 pvyludfu.exe 1704 dsmjhlrjwmtadot.exe 4644 jyjhzrymnxwbt.exe 2232 fihpbfcfyc.exe 4788 pvyludfu.exe 1704 dsmjhlrjwmtadot.exe 4644 jyjhzrymnxwbt.exe 2232 fihpbfcfyc.exe 4788 pvyludfu.exe 1704 dsmjhlrjwmtadot.exe 4644 jyjhzrymnxwbt.exe 1748 pvyludfu.exe 1748 pvyludfu.exe 1748 pvyludfu.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1524 WINWORD.EXE 1524 WINWORD.EXE 1524 WINWORD.EXE 1524 WINWORD.EXE 1524 WINWORD.EXE 1524 WINWORD.EXE 1524 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2232 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 83 PID 2748 wrote to memory of 2232 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 83 PID 2748 wrote to memory of 2232 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 83 PID 2748 wrote to memory of 1704 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 84 PID 2748 wrote to memory of 1704 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 84 PID 2748 wrote to memory of 1704 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 84 PID 2748 wrote to memory of 4788 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 85 PID 2748 wrote to memory of 4788 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 85 PID 2748 wrote to memory of 4788 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 85 PID 2748 wrote to memory of 4644 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 86 PID 2748 wrote to memory of 4644 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 86 PID 2748 wrote to memory of 4644 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 86 PID 2748 wrote to memory of 1524 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 87 PID 2748 wrote to memory of 1524 2748 741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe 87 PID 2232 wrote to memory of 1748 2232 fihpbfcfyc.exe 89 PID 2232 wrote to memory of 1748 2232 fihpbfcfyc.exe 89 PID 2232 wrote to memory of 1748 2232 fihpbfcfyc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\741c69cb9dd55dd03baad28205229302_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\fihpbfcfyc.exefihpbfcfyc.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\pvyludfu.exeC:\Windows\system32\pvyludfu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1748
-
-
-
C:\Windows\SysWOW64\dsmjhlrjwmtadot.exedsmjhlrjwmtadot.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1704
-
-
C:\Windows\SysWOW64\pvyludfu.exepvyludfu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4788
-
-
C:\Windows\SysWOW64\jyjhzrymnxwbt.exejyjhzrymnxwbt.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4644
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1524
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 f0773482d7fae7b8f6f76ce398a6277e089a148479b02fe7f27079e57fe9384f
- MD5 53360733e6a890b06935410b8e17dccc
- SHA1 d351591e61a5be07e9503330bd707a9fe4753e51
- SHA512 ff5088add0b937e23dc4c4ccaafe6b86f087cdea8e70378f83ff1ee39941cfd319e7a5fdb876f741177f8ff147138f6bcae8495a394b488fa01fece9d69a8249
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 25ce15e8e93f40ef2d30235310e337130b087020fe15055bf3884119b6b1ef94
- MD5 0b62b6688edd3db23b2258b509c6e42f
- SHA1 7c749a7568b5455b7142d52af2cce988b55df06d
- SHA512 2312654b0ff6d8f41080ad616192247cecfaf55f1b683dc3f6e9c2b4957e8990ed9ed4ed3ef5fd1f8ae1e71518ac4f786bc080b3854d76069922963c674aed06
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\SyncReceive.doc.exe
- Size 512KB
- SHA256 841c82f180a685d79c38610429faf3fa5dd9bf8e2fab9471c0e5c8e1add77235
- MD5 c5071adc27e12af55bcfc419ece2e1a9
- SHA1 c8d163d76e31be958543ead56e07acf57d1488f5
- SHA512 600bc84044540e72c3a99722f77dae2844cc7dcd1bc70ba50573a7226e1bd084e45ae326cc4d918d83cd59ef40df6cb02c6d5b616122b6a4d906074ae6d24887
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD93AB.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 87f30b1bc18cfdd0e546eda3e967597f14082ca277a379e8fbe4a1a85f3a7e1a
- MD5 d24685c3826e43cfc5ffd6c00d7d9cfa
- SHA1 2023e492a11f1b2c68d40eb1aa385eed42fdec34
- SHA512 ecfbc12e90026afe5bbbfe034e22804a4c61aaa26e711b784b05b0644196d2e8735132d43578da3f597cd0c64ae24d7fe126c996e5e1e179b60759771821339b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 a42ddbff3eb71331625c66e55ff5c1431f724df98fc2c8b6aac96c0f82f032af
- MD5 db935b9d3826ff541bd2a036882fbe40
- SHA1 204764a5e737c767066bb19d4fe63cff7354901f
- SHA512 e65a968e02fa62874e4c25746d0028f1d2ff5a41594dd8ce2df213aed4ae943ed0465ebf86861c0397b730990d5900ea7768696f1a928be7da789198f499b072
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\dsmjhlrjwmtadot.exe
- Size 512KB
- SHA256 ab254fc5ac90bafa03be1d87aa75c73463eeaf42e5bc56a67cc6dcd388e51737
- MD5 d1e145ff10b40dedaa79980e45d32a57
- SHA1 5e5169bc383da319b3e62ba738c302fc465fb8f1
- SHA512 efbd1f608e849e0918bef469382eaf044a19fc4c722706290a33aeef56ada8deda230bea19de4f17c01adc38d8dd4506f52c4aa2b454273d329d8c9221ef4af1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\fihpbfcfyc.exe
- Size 512KB
- SHA256 2d7b81c61047c83524d8d1f0c1a19a73185ccb7991454ed8ea81b581589040eb
- MD5 2df0159fa993a1775ba8d7fedcb80e5b
- SHA1 0e621ce4f3e92c912815933f274628f0d48b6c81
- SHA512 2c7df4dc56fb187ecde0dd57dfb35b0fa00af224706fcbfa42b424437bcd61e448bed1228a22a94a211e0a366eeca23541867fad23e964d5ec0cca5994b1708e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jyjhzrymnxwbt.exe
- Size 512KB
- SHA256 d60393b23a05dae9d1e6e05c8cca662b26bb4af918ffebf3c46a8a7ca00e443a
- MD5 2857157b52926df5470e35b5957880d6
- SHA1 957f79dd876ed785f60cada6e293da83bba7a9d1
- SHA512 e6bf7dcffd2e21deebfe617fbada4f7799c848dd5b0dd35903ce2ca756062baee30a543c871532196eae169ce508b11ef3b54cc95fd29c5e36e2ae22fa108598
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pvyludfu.exe
- Size 512KB
- SHA256 e38a8147fa624a18c581ef19f1728da2cb91289eba27d732d4f34b60c4b29b70
- MD5 6b62727723384f7c474ccf9be1625767
- SHA1 1d03e57d37011fdbdc066fca4c04ac5e338acf80
- SHA512 69c2d46fae7613b6672f7e1f5f77aaae225631e42d7eaaf10912219d7167e43670d9333b06fcea1edd7842065ae547a37c9000c5e2d5fb0c9510280436f19121
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 f3af7791ec68a70d9e23c8dffd8d7c56204f25154ad3a5239eac96a0f5c02a32
- MD5 468993f259ed89d9d6c433e3553723a5
- SHA1 309113d33a690a3ee61e8491d52e881f6d5b6f1a
- SHA512 e48240b17f0d5c2229698a92c6e6f9a74588010060bc4def344cfe8b57caf8493040aff2933e37d24199888392dd19a620435de1bf02a2553649ed0d5d341720
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 32e2338e3bdbe490898b05c7f5fe66604abbfc88131f742dd78d26e6f1705545
- MD5 37d03da694698e265ed8b059de920351
- SHA1 2a34355baa054f6f55cb73502afa70ab44a6ce3e
- SHA512 2f41820591b1082160f3d481317903079482881f547970005aadd6d1182340bc02124a9a614e1751113c3722ebf8a824252911643fca71830652328309a63321
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- MD5 SHA1 SHA512 SSDEEP