Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 04:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe
- Size 512KB
- Sample240526-e33vhseh9v
- SHA256 88b5c8246593252474365a7150aa36617bc3c811cca1835f1633a1912de8cac5
- MD5 745381dc837ff743a42f8777e10e0be6
- SHA1 060b53662e220968ed949d6a66a10fc86c310527
- SHA512 c2d5ed4c5a73fdbf0da5898abbcbab946f98905d01c4f1855f4d8a40f7a34c8d00b7727e6607fa6aca6ceceaba6df97589d0c14ab6f87151162c1fdea8298e84
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kriraoiwme.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kriraoiwme.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kriraoiwme.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kriraoiwme.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1212 kriraoiwme.exe 2560 xpxdwpqvpjlshbe.exe 3408 rojltxcd.exe 4340 zesjwzmuhymwm.exe 3472 rojltxcd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kriraoiwme.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mwkofceq = "kriraoiwme.exe" xpxdwpqvpjlshbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uqavbzxg = "xpxdwpqvpjlshbe.exe" xpxdwpqvpjlshbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "zesjwzmuhymwm.exe" xpxdwpqvpjlshbe.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: kriraoiwme.exe File opened (read-only) \??\i: rojltxcd.exe File opened (read-only) \??\b: rojltxcd.exe File opened (read-only) \??\h: kriraoiwme.exe File opened (read-only) \??\z: rojltxcd.exe File opened (read-only) \??\l: kriraoiwme.exe File opened (read-only) \??\g: rojltxcd.exe File opened (read-only) \??\l: rojltxcd.exe File opened (read-only) \??\o: rojltxcd.exe File opened (read-only) \??\i: kriraoiwme.exe File opened (read-only) \??\p: kriraoiwme.exe File opened (read-only) \??\t: rojltxcd.exe File opened (read-only) \??\u: rojltxcd.exe File opened (read-only) \??\w: rojltxcd.exe File opened (read-only) \??\y: rojltxcd.exe File opened (read-only) \??\z: rojltxcd.exe File opened (read-only) \??\s: rojltxcd.exe File opened (read-only) \??\q: rojltxcd.exe File opened (read-only) \??\t: rojltxcd.exe File opened (read-only) \??\k: kriraoiwme.exe File opened (read-only) \??\x: kriraoiwme.exe File opened (read-only) \??\b: rojltxcd.exe File opened (read-only) \??\j: rojltxcd.exe File opened (read-only) \??\v: rojltxcd.exe File opened (read-only) \??\m: rojltxcd.exe File opened (read-only) \??\e: kriraoiwme.exe File opened (read-only) \??\n: kriraoiwme.exe File opened (read-only) \??\o: kriraoiwme.exe File opened (read-only) \??\w: rojltxcd.exe File opened (read-only) \??\b: kriraoiwme.exe File opened (read-only) \??\e: rojltxcd.exe File opened (read-only) \??\h: rojltxcd.exe File opened (read-only) \??\p: rojltxcd.exe File opened (read-only) \??\i: rojltxcd.exe File opened (read-only) \??\a: rojltxcd.exe File opened (read-only) \??\y: rojltxcd.exe File opened (read-only) \??\u: rojltxcd.exe File opened (read-only) \??\r: kriraoiwme.exe File opened (read-only) \??\l: rojltxcd.exe File opened (read-only) \??\s: rojltxcd.exe File opened (read-only) \??\u: kriraoiwme.exe File opened (read-only) \??\r: rojltxcd.exe File opened (read-only) \??\t: kriraoiwme.exe File opened (read-only) \??\n: rojltxcd.exe File opened (read-only) \??\x: rojltxcd.exe File opened (read-only) \??\a: rojltxcd.exe File opened (read-only) \??\k: rojltxcd.exe File opened (read-only) \??\p: rojltxcd.exe File opened (read-only) \??\m: kriraoiwme.exe File opened (read-only) \??\v: kriraoiwme.exe File opened (read-only) \??\m: rojltxcd.exe File opened (read-only) \??\q: rojltxcd.exe File opened (read-only) \??\r: rojltxcd.exe File opened (read-only) \??\q: kriraoiwme.exe File opened (read-only) \??\s: kriraoiwme.exe File opened (read-only) \??\z: kriraoiwme.exe File opened (read-only) \??\k: rojltxcd.exe File opened (read-only) \??\e: rojltxcd.exe File opened (read-only) \??\x: rojltxcd.exe File opened (read-only) \??\g: kriraoiwme.exe File opened (read-only) \??\w: kriraoiwme.exe File opened (read-only) \??\g: rojltxcd.exe File opened (read-only) \??\h: rojltxcd.exe File opened (read-only) \??\v: rojltxcd.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kriraoiwme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kriraoiwme.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1480-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000700000002340a-5.dat autoit_exe behavioral2/files/0x0008000000023406-18.dat autoit_exe behavioral2/files/0x000700000002340b-29.dat autoit_exe behavioral2/files/0x000700000002340c-32.dat autoit_exe behavioral2/files/0x000700000002341a-70.dat autoit_exe behavioral2/files/0x000800000002331b-75.dat autoit_exe behavioral2/files/0x0007000000023420-97.dat autoit_exe behavioral2/files/0x0007000000023420-475.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\rojltxcd.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification C:\Windows\SysWOW64\zesjwzmuhymwm.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File created C:\Windows\SysWOW64\xpxdwpqvpjlshbe.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rojltxcd.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File created C:\Windows\SysWOW64\zesjwzmuhymwm.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kriraoiwme.exe File created C:\Windows\SysWOW64\kriraoiwme.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xpxdwpqvpjlshbe.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification C:\Windows\SysWOW64\kriraoiwme.exe 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rojltxcd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rojltxcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rojltxcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rojltxcd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rojltxcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rojltxcd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rojltxcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rojltxcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rojltxcd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rojltxcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rojltxcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rojltxcd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rojltxcd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rojltxcd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rojltxcd.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rojltxcd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rojltxcd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rojltxcd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification C:\Windows\mydoc.rtf 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rojltxcd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rojltxcd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rojltxcd.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rojltxcd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDF9CBFE65F1E2840C3A41819A3E97B38F02FE4364023AE1BD429B08D6" 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kriraoiwme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kriraoiwme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kriraoiwme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kriraoiwme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FFBFF824F5A851B9046D62D7DE7BC93E143583767336242D799" 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FC68B2FE6F21AED209D0D48A7C906B" 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1945C70915E3DBC4B8BD7F97EC9634CE" 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kriraoiwme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kriraoiwme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kriraoiwme.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332D7A9C2082226A4676A6702F2DD97D8364DC" 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kriraoiwme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kriraoiwme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kriraoiwme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB2B15A47E439EE52CAB9A132EFD7BB" 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kriraoiwme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kriraoiwme.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 436 WINWORD.EXE 436 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 1212 kriraoiwme.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 3408 rojltxcd.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 2560 xpxdwpqvpjlshbe.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 4340 zesjwzmuhymwm.exe 3472 rojltxcd.exe 3472 rojltxcd.exe 3472 rojltxcd.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 436 WINWORD.EXE 436 WINWORD.EXE 436 WINWORD.EXE 436 WINWORD.EXE 436 WINWORD.EXE 436 WINWORD.EXE 436 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1480 wrote to memory of 1212 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 83 PID 1480 wrote to memory of 1212 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 83 PID 1480 wrote to memory of 1212 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 83 PID 1480 wrote to memory of 2560 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 84 PID 1480 wrote to memory of 2560 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 84 PID 1480 wrote to memory of 2560 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 84 PID 1480 wrote to memory of 3408 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 85 PID 1480 wrote to memory of 3408 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 85 PID 1480 wrote to memory of 3408 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 85 PID 1480 wrote to memory of 4340 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 86 PID 1480 wrote to memory of 4340 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 86 PID 1480 wrote to memory of 4340 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 86 PID 1480 wrote to memory of 436 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 87 PID 1480 wrote to memory of 436 1480 745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe 87 PID 1212 wrote to memory of 3472 1212 kriraoiwme.exe 89 PID 1212 wrote to memory of 3472 1212 kriraoiwme.exe 89 PID 1212 wrote to memory of 3472 1212 kriraoiwme.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\745381dc837ff743a42f8777e10e0be6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\kriraoiwme.exekriraoiwme.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\rojltxcd.exeC:\Windows\system32\rojltxcd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3472
-
-
-
C:\Windows\SysWOW64\xpxdwpqvpjlshbe.exexpxdwpqvpjlshbe.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2560
-
-
C:\Windows\SysWOW64\rojltxcd.exerojltxcd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3408
-
-
C:\Windows\SysWOW64\zesjwzmuhymwm.exezesjwzmuhymwm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4340
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:436
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 0f64ba4ab2648f3d45765261e99904b38891594f9d0a31f411314e19f647b50a
- MD5 3e5f26b3479dcc6bdfc9f039533500fb
- SHA1 6f756ee3b1f07ec19e2fd080bbec837e8ca1bf31
- SHA512 6dd61cbf616b091daf533d0e868388c13fa501f7ec152a14295ca9c97d98a1f6c9047049d094cb02e2cd35b08da5060287ce16930b6b75603e1fdbd1fe18809f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD955A.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 507143acb38e64408d03a0dd98e16bd34ca557294c466ae8ec9c7c763eb3a2a5
- MD5 361ba5cdfe246f4303b0a1638e0daf43
- SHA1 eced7199b1af3c8e92209a68cb9a925ff3f369a3
- SHA512 81b9d124396d138717aea4dc71cec59426a3b65b47eaa0d13523adf030c5e3df9fa670ed48f7634d0301812d4b546dd43bc5bf863b58112570a2ab049bc7ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 109d346e174faf27f297198262377c3be058387ad760d0ab0889b3def3f0d0a2
- MD5 028340fa441b27487f89f6e4913fb320
- SHA1 9b6bcc2c2a078ff276ff7db0442d974e9053f8e1
- SHA512 d0ef4e32edbb845c0a6bc7b719a49482c92c4acccf6a39cf31c36899b91a72e95b6cefda15ccfedd84563c832c8860f0c9ef786b2d880e771f1858313ef10eaf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 2dff4f13e76951101e54b2f3d6b1df2a3a75ebaa9216157ad9bf6b15aab9b28e
- MD5 33dbe66161f56dea3dca81e4de734d2a
- SHA1 dc025c45841dd040aa906d211fd43d6c1a73d342
- SHA512 0e219222cac5ac1e3afaf45864a18a861af04f17c98cfd10b72b78183a33dcef90822b3741ffac2c25f3cc2fee6705fc9f10297121262add8087618c6afd884d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\ResetFind.doc.exe
- Size 512KB
- SHA256 12149e8aebb334a07003824dcf990fb23f5755d9ba7508d18e4c1fceb93b5d87
- MD5 66d0848702037c96eab8a60166b6ff5e
- SHA1 2217c6325b700ea8a6cf62ee8945b00eb288fed0
- SHA512 189839bab565442b9b5ce3628b8d4e4921c1420376a0bc9f318511649a8f2ca3de19664a090fb802f8bef069c83407be2ea161a2b9e47e0bbe81824ec9a9a813
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj64:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kriraoiwme.exe
- Size 512KB
- SHA256 697d08ba22bd284d710410a13c662ecabb26956f59bda7f3b2a7e0209d1d3033
- MD5 abc7ef66982efd08fd9d10b3e54efccb
- SHA1 61c074f67917ca76552cc55a8c7684feaf669a20
- SHA512 661832dfc09ed79446b72d1e4c34c971cc2387d46f6c4f5cfaf421ef9e51e2a7eb450b6b56ed3a00a4dc1ed2e7ce8a8374be4bc37418c8eb204708169f4a8423
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rojltxcd.exe
- Size 512KB
- SHA256 ed4bfa9c4c7195147818fdbabf3473192249ac3248a82eb76e0149017ba8139a
- MD5 06c4132a2a4012a5a4f0d0c4d8fbbe70
- SHA1 c2ce941652de3faed3b5262008d8f9824438e7c8
- SHA512 2ddfafc6b8633df6dbd19bba5643c818ca778bbf75408384cba5c74b2d1e3a924264535746a4fa7a94333dc5fa98721d677bba0cbe19e2da1866f653c1223b07
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xpxdwpqvpjlshbe.exe
- Size 512KB
- SHA256 91bb83a27926341d8647ccae2cd2e8ab843d42c2f4dbd2e0056c9fb37dd9a478
- MD5 ac63fb91079064ccf332107b82d17b26
- SHA1 32d5ae9237f4ebb07cc4eaa5f19a0ae67958085b
- SHA512 7886fb4e2b990f16858803899d9836d11f31a87b45499b947fe69de14d57777e2dcdf6a51652526a62066745205ea7620db55cae89e17336a21651d984a318d2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\zesjwzmuhymwm.exe
- Size 512KB
- SHA256 037e3ba865490c1fcc2c1728a217e227ce2711aee7363d128fb0cababe4567cd
- MD5 38771c239f63eb40bb9958614ee8f7b3
- SHA1 b6878fdace2d8e6081e6ab2caab604d420130594
- SHA512 d7ca7b6454a81deb1e78bea1566fef5d17d8e07462cf1c62c10c4ea6614635a8c326fa49531fb181cab4305b0d068b62e490d82f167f5b7e36416928c3b49abc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 9474f673e9079f505e114f8a4af7bb78653dd121fac9139a587ae05f33b399bc
- MD5 b1fbba3e5144d33249a62e4c89f5b520
- SHA1 f6739f54a76f573b7e9185580a0708c1c26f3499
- SHA512 5d3cf65a4f4f7baf4d1256d0c4fce213217e8f44b400dc11fdffac14e91676e5bc7486ff30588c31eb659d8d3add6da46da294cb4b60f530678a0bfa7230f7e3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 11792cbb63238792175f68bf5512b756abbd0f058a485b20ab2654a7ba8aab0e
- MD5 1a29b32ff521d1c0e86cf7d90769e0e4
- SHA1 3d978bfe490741a66b7f8e76fb6d9e728336fc31
- SHA512 5dd3863a6d206060459706c982199ef40466a78b1cceccdee77436f2ea598b0cb3240fdc7ba7f2c2f233ce40d6eeba2aad1148655c4e423216037f076daf4e8c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP