Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 19:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe
- Size 512KB
- Sample240526-x46a5sha7w
- SHA256 d50b8e8de689052eba093321af242e165554597e3082bac4f505341103a459ee
- MD5 768fe20e7043da11b4bf95876e6cbec0
- SHA1 6365c4d725c721bd1163518f4562b3dc11aca781
- SHA512 8e80278640b425b3eda161fa5b4e197b1882984a648588afba16594a28c3b626203b6df35b027b94fc22566a257d3a494370ed74a398bc0a38736e632c1990a7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj63:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ncxeidtsaj.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ncxeidtsaj.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ncxeidtsaj.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ncxeidtsaj.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 4544 ncxeidtsaj.exe 4900 ijcnxmlmwajsngv.exe 760 okflmdex.exe 2916 hjcklvijyocca.exe 1836 okflmdex.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ncxeidtsaj.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\auesknsi = "ncxeidtsaj.exe" ijcnxmlmwajsngv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhzkidam = "ijcnxmlmwajsngv.exe" ijcnxmlmwajsngv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hjcklvijyocca.exe" ijcnxmlmwajsngv.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: okflmdex.exe File opened (read-only) \??\m: ncxeidtsaj.exe File opened (read-only) \??\j: ncxeidtsaj.exe File opened (read-only) \??\a: okflmdex.exe File opened (read-only) \??\k: okflmdex.exe File opened (read-only) \??\n: okflmdex.exe File opened (read-only) \??\o: ncxeidtsaj.exe File opened (read-only) \??\t: okflmdex.exe File opened (read-only) \??\v: okflmdex.exe File opened (read-only) \??\b: okflmdex.exe File opened (read-only) \??\s: okflmdex.exe File opened (read-only) \??\u: ncxeidtsaj.exe File opened (read-only) \??\h: okflmdex.exe File opened (read-only) \??\y: okflmdex.exe File opened (read-only) \??\o: okflmdex.exe File opened (read-only) \??\z: okflmdex.exe File opened (read-only) \??\g: okflmdex.exe File opened (read-only) \??\l: okflmdex.exe File opened (read-only) \??\g: okflmdex.exe File opened (read-only) \??\l: okflmdex.exe File opened (read-only) \??\g: ncxeidtsaj.exe File opened (read-only) \??\p: okflmdex.exe File opened (read-only) \??\e: ncxeidtsaj.exe File opened (read-only) \??\l: ncxeidtsaj.exe File opened (read-only) \??\s: ncxeidtsaj.exe File opened (read-only) \??\t: okflmdex.exe File opened (read-only) \??\y: okflmdex.exe File opened (read-only) \??\x: okflmdex.exe File opened (read-only) \??\a: okflmdex.exe File opened (read-only) \??\h: okflmdex.exe File opened (read-only) \??\i: okflmdex.exe File opened (read-only) \??\k: okflmdex.exe File opened (read-only) \??\r: ncxeidtsaj.exe File opened (read-only) \??\x: ncxeidtsaj.exe File opened (read-only) \??\r: okflmdex.exe File opened (read-only) \??\m: okflmdex.exe File opened (read-only) \??\r: okflmdex.exe File opened (read-only) \??\v: okflmdex.exe File opened (read-only) \??\a: ncxeidtsaj.exe File opened (read-only) \??\b: ncxeidtsaj.exe File opened (read-only) \??\v: ncxeidtsaj.exe File opened (read-only) \??\z: ncxeidtsaj.exe File opened (read-only) \??\n: okflmdex.exe File opened (read-only) \??\h: ncxeidtsaj.exe File opened (read-only) \??\i: ncxeidtsaj.exe File opened (read-only) \??\k: ncxeidtsaj.exe File opened (read-only) \??\q: ncxeidtsaj.exe File opened (read-only) \??\y: ncxeidtsaj.exe File opened (read-only) \??\u: okflmdex.exe File opened (read-only) \??\n: ncxeidtsaj.exe File opened (read-only) \??\b: okflmdex.exe File opened (read-only) \??\i: okflmdex.exe File opened (read-only) \??\m: okflmdex.exe File opened (read-only) \??\e: okflmdex.exe File opened (read-only) \??\x: okflmdex.exe File opened (read-only) \??\w: okflmdex.exe File opened (read-only) \??\t: ncxeidtsaj.exe File opened (read-only) \??\e: okflmdex.exe File opened (read-only) \??\j: okflmdex.exe File opened (read-only) \??\o: okflmdex.exe File opened (read-only) \??\p: okflmdex.exe File opened (read-only) \??\q: okflmdex.exe File opened (read-only) \??\w: okflmdex.exe File opened (read-only) \??\p: ncxeidtsaj.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ncxeidtsaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ncxeidtsaj.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/508-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000700000002340b-5.dat autoit_exe behavioral2/files/0x0008000000023407-18.dat autoit_exe behavioral2/files/0x000700000002340c-29.dat autoit_exe behavioral2/files/0x000700000002340d-32.dat autoit_exe behavioral2/files/0x0003000000022950-71.dat autoit_exe behavioral2/files/0x00020000000229c3-74.dat autoit_exe behavioral2/files/0x0009000000023399-92.dat autoit_exe behavioral2/files/0x0009000000023399-436.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\ijcnxmlmwajsngv.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ijcnxmlmwajsngv.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File created C:\Windows\SysWOW64\hjcklvijyocca.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe okflmdex.exe File created C:\Windows\SysWOW64\ncxeidtsaj.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ncxeidtsaj.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File created C:\Windows\SysWOW64\okflmdex.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\okflmdex.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hjcklvijyocca.exe 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ncxeidtsaj.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe okflmdex.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal okflmdex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe okflmdex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe okflmdex.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal okflmdex.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe okflmdex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe okflmdex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal okflmdex.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe okflmdex.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe okflmdex.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe okflmdex.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe okflmdex.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe okflmdex.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe okflmdex.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe okflmdex.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe okflmdex.exe File opened for modification C:\Windows\mydoc.rtf 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe okflmdex.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ncxeidtsaj.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC4B121479339EE53BABAD632E9D4CE" 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F068B0FE1822DBD27BD0A08B7A9163" 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ncxeidtsaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ncxeidtsaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ncxeidtsaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ncxeidtsaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342C7B9D2183236A3576D477222DDD7D8F64AA" 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABCFABEF911F19784783B35869739E3B388028A4362023AE1BF42E709D3" 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FF8D485A851A9134D6217D9CBDE7E640593167446346D7EC" 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ncxeidtsaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ncxeidtsaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ncxeidtsaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ncxeidtsaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ncxeidtsaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193DC6791491DAB0B8CD7CE0ED9F34BD" 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ncxeidtsaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ncxeidtsaj.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2272 WINWORD.EXE 2272 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4544 ncxeidtsaj.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 4900 ijcnxmlmwajsngv.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 2916 hjcklvijyocca.exe 760 okflmdex.exe 760 okflmdex.exe 760 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe 1836 okflmdex.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2272 WINWORD.EXE 2272 WINWORD.EXE 2272 WINWORD.EXE 2272 WINWORD.EXE 2272 WINWORD.EXE 2272 WINWORD.EXE 2272 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 508 wrote to memory of 4544 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 82 PID 508 wrote to memory of 4544 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 82 PID 508 wrote to memory of 4544 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 82 PID 508 wrote to memory of 4900 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 83 PID 508 wrote to memory of 4900 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 83 PID 508 wrote to memory of 4900 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 83 PID 508 wrote to memory of 760 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 84 PID 508 wrote to memory of 760 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 84 PID 508 wrote to memory of 760 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 84 PID 508 wrote to memory of 2916 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 85 PID 508 wrote to memory of 2916 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 85 PID 508 wrote to memory of 2916 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 85 PID 508 wrote to memory of 2272 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 86 PID 508 wrote to memory of 2272 508 768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe 86 PID 4544 wrote to memory of 1836 4544 ncxeidtsaj.exe 88 PID 4544 wrote to memory of 1836 4544 ncxeidtsaj.exe 88 PID 4544 wrote to memory of 1836 4544 ncxeidtsaj.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\768fe20e7043da11b4bf95876e6cbec0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\ncxeidtsaj.exencxeidtsaj.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\okflmdex.exeC:\Windows\system32\okflmdex.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1836
-
-
-
C:\Windows\SysWOW64\ijcnxmlmwajsngv.exeijcnxmlmwajsngv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4900
-
-
C:\Windows\SysWOW64\okflmdex.exeokflmdex.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:760
-
-
C:\Windows\SysWOW64\hjcklvijyocca.exehjcklvijyocca.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2916
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 b95e70a02ef082a3aa7ac5696892a8f8b67caf90b41dd8f0aa67148995a83e12
- MD5 4c49ac0c95f68fc6cb526d66a13fffef
- SHA1 b56a5d3cbcf5c3642ff08f75cd0291ff62078ed4
- SHA512 c2d999bf417ed27d197f2697986f99b5bbd1d100514a2a704da1be3f85d3405e9abbd5286e5909c3a52ec0e1835e2cd1a3bf3cf809cec89bb23c225869438823
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 5fc1e32153af139e8fc1e10eb72c365803216b142d9eb59a5c200ad1f003e8a4
- MD5 0e44a439aa80abba69dfbeb00b4900c5
- SHA1 c4ea52b609ef022a56c83aace4d67082c5cc3506
- SHA512 dceb21a7fedb5aa370f5987cea81533ed2f3b0ecfd0b30ca0fe4662b48f7b19a044db7454fee65860aa6fd2a996b707ddd8c524c4c5b525eadba5154eb61a9c4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD8445.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 ff88dc8c32ef72088935998d69c4fc343b3c8fa9f1343bb182aba473405927e1
- MD5 44b20d2fa011bedf01be6ec5cb5a1f44
- SHA1 7d1fb536bea895d1ce959577fb9b6cde3d144905
- SHA512 c046bb7e1f3aa4948cef97e18fcae6965780ace79a04bfc35352c81249698bd2f2f01cf28a1bdb019ebb3ecd664e28aa3a9f4e7679027a4165918ebd9e493796
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 1903fe04529a001932447552af433bcc0039df4b7ebce9e4297e8b8ad1264560
- MD5 0fa8ca6e818ab333add4c42c2d99deae
- SHA1 9f25f031b4586fee9f4389a625d47ed34ae01cae
- SHA512 c0e39e496f7b565b484bdb1a6773a514b27fbd1412802ecaffc33ecb0899e0e6c672bc8387812708f60152395fbf264ed090f7ef783760358b311f516796bc11
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\hjcklvijyocca.exe
- Size 512KB
- SHA256 045658837b0046df3acb161f2cfd8d88bb1d29dc0d2a89e59960cbaad16e2bbf
- MD5 e501897b6f1080d647617e38f326e562
- SHA1 4692ea6bb3bddc7b8e92ab175b331ded31364a17
- SHA512 91914ad62251704f8d76058db7900e9ce4359bbd76adf340142f517440b6dcf641a721cdd93c9f2803f36d829da4ac96243fa3e54dab129b15bf02b98a36d257
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ijcnxmlmwajsngv.exe
- Size 512KB
- SHA256 e798e7ff3a06b83fc8df7ef3057c417cae140c8b933bcd18a5f928f1267ff7d8
- MD5 ee6b28216b6d9b4d51f18d4748ff19c7
- SHA1 668e6367ea09cd5c03cae63430218b88264b673e
- SHA512 4ca2aba0292c29017dfcef52893d4c1036f7e634524ce36e992151c9577e80518d4864defe118691e1c3d5c5a9b1ebfb7e205b92e89ba960d3e4ca7783216d6d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ncxeidtsaj.exe
- Size 512KB
- SHA256 f9a47acdff232949ba35718dda943a081d0785e50fc28ffd69086214ae4e195b
- MD5 654fe88580d06d716089323606289b96
- SHA1 71b105faff036b52aa8f1c5ad95abd5794687acb
- SHA512 10b924e118f49272bf265a45bc7799c5cdf6d082dc1e83e2b03d0053c8bb49413216408e8f0b874cc958d7a216d2a5b3b81c33384e8714e15df3b7965781e616
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\okflmdex.exe
- Size 512KB
- SHA256 7c0cea60e10ba52ea078be6c2d61bc007f747e5f006527970cbf665cb8501378
- MD5 4ff05b75d324aab46f394111fe58c849
- SHA1 9f3086a56db1227263ee8d01a311988097e069f4
- SHA512 7ffb39a20740ac2986bc00cab43a229fd7324f7b6f459e34bc5f2906183907735a2efaaa1a41e220c2b6ee4ced1136f445924c942fab7b0aa6d52a98a74c0197
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 42dc3c6a52e4c5adebe7d090098e70047bf2cce821e44766fa9120c6ea405517
- MD5 d89b9c4207daeb46740c5ba68ca9d148
- SHA1 ffcb0afd957490a8279d93f909665c711d294d98
- SHA512 fe68cdcab061c2ca135f45f92100212bfe1925fe47181009afdb54af9803c755eb1da0f28720694021ea55d4591bc662f3b1bd3a2b9d8a74e50978c50b4472b8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 1a70eb2b693c5143fcfbe5db7af979f76f382a3b99bf25bc4b465a9e6da08062
- MD5 a698f537897824e95dbfc441dc1cc394
- SHA1 da3ae42ba0defae71cbaee267cd418d08f256ed0
- SHA512 51002bf23468f3bb7c382f04ffd3d08c478eacf48512725b832fdc3bab307b0b6d2ad728aa8d3018ded2a46fd0c99795701365e8e41e560caa8f2db650ac506e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP