Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 06:48
Static task
static1
Behavioral task
behavioral1
Sample
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe
-
Size
512KB
-
MD5
783fd152ef4fb11f362a90431f597393
-
SHA1
7b7e29803b5f8e235bf4078b58e815eae184e5d4
-
SHA256
602882ca8e8bc2c7a1f0da904a3a603fabb27a24a1f133f02cef82068d66ee4b
-
SHA512
7775037728ad59bea6bb7706f5963c9754f988f07298fa6f4b0cb7e106942f7aa2dfbc87b062b942aebc7674c5b3926f3acb2af30f8fc0c0d32afc5a325b2831
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
odfcpvdlkp.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" odfcpvdlkp.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
odfcpvdlkp.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" odfcpvdlkp.exe -
Processes:
odfcpvdlkp.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" odfcpvdlkp.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
odfcpvdlkp.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" odfcpvdlkp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
Processes:
odfcpvdlkp.exeoyaopmiuqhsvhue.exeeyfhqddp.exehkciazgcxbsqb.exeeyfhqddp.exepid process 2432 odfcpvdlkp.exe 2232 oyaopmiuqhsvhue.exe 4932 eyfhqddp.exe 5064 hkciazgcxbsqb.exe 64 eyfhqddp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
odfcpvdlkp.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" odfcpvdlkp.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
oyaopmiuqhsvhue.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lzkjybwx = "oyaopmiuqhsvhue.exe" oyaopmiuqhsvhue.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hkciazgcxbsqb.exe" oyaopmiuqhsvhue.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\opszbfcx = "odfcpvdlkp.exe" oyaopmiuqhsvhue.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
eyfhqddp.exeeyfhqddp.exeodfcpvdlkp.exedescription ioc process File opened (read-only) \??\g: eyfhqddp.exe File opened (read-only) \??\j: eyfhqddp.exe File opened (read-only) \??\b: eyfhqddp.exe File opened (read-only) \??\n: eyfhqddp.exe File opened (read-only) \??\x: odfcpvdlkp.exe File opened (read-only) \??\x: eyfhqddp.exe File opened (read-only) \??\z: eyfhqddp.exe File opened (read-only) \??\w: odfcpvdlkp.exe File opened (read-only) \??\k: eyfhqddp.exe File opened (read-only) \??\o: eyfhqddp.exe File opened (read-only) \??\y: eyfhqddp.exe File opened (read-only) \??\e: eyfhqddp.exe File opened (read-only) \??\y: eyfhqddp.exe File opened (read-only) \??\l: eyfhqddp.exe File opened (read-only) \??\m: eyfhqddp.exe File opened (read-only) \??\t: eyfhqddp.exe File opened (read-only) \??\h: odfcpvdlkp.exe File opened (read-only) \??\v: eyfhqddp.exe File opened (read-only) \??\j: eyfhqddp.exe File opened (read-only) \??\o: eyfhqddp.exe File opened (read-only) \??\q: eyfhqddp.exe File opened (read-only) \??\v: odfcpvdlkp.exe File opened (read-only) \??\i: eyfhqddp.exe File opened (read-only) \??\w: eyfhqddp.exe File opened (read-only) \??\w: eyfhqddp.exe File opened (read-only) \??\e: odfcpvdlkp.exe File opened (read-only) \??\u: eyfhqddp.exe File opened (read-only) \??\h: eyfhqddp.exe File opened (read-only) \??\t: eyfhqddp.exe File opened (read-only) \??\u: eyfhqddp.exe File opened (read-only) \??\i: odfcpvdlkp.exe File opened (read-only) \??\j: odfcpvdlkp.exe File opened (read-only) \??\b: eyfhqddp.exe File opened (read-only) \??\l: eyfhqddp.exe File opened (read-only) \??\m: odfcpvdlkp.exe File opened (read-only) \??\r: odfcpvdlkp.exe File opened (read-only) \??\u: odfcpvdlkp.exe File opened (read-only) \??\p: eyfhqddp.exe File opened (read-only) \??\l: odfcpvdlkp.exe File opened (read-only) \??\o: odfcpvdlkp.exe File opened (read-only) \??\s: odfcpvdlkp.exe File opened (read-only) \??\p: eyfhqddp.exe File opened (read-only) \??\a: eyfhqddp.exe File opened (read-only) \??\a: eyfhqddp.exe File opened (read-only) \??\z: eyfhqddp.exe File opened (read-only) \??\q: odfcpvdlkp.exe File opened (read-only) \??\x: eyfhqddp.exe File opened (read-only) \??\n: odfcpvdlkp.exe File opened (read-only) \??\t: odfcpvdlkp.exe File opened (read-only) \??\m: eyfhqddp.exe File opened (read-only) \??\n: eyfhqddp.exe File opened (read-only) \??\h: eyfhqddp.exe File opened (read-only) \??\r: eyfhqddp.exe File opened (read-only) \??\s: eyfhqddp.exe File opened (read-only) \??\r: eyfhqddp.exe File opened (read-only) \??\s: eyfhqddp.exe File opened (read-only) \??\k: eyfhqddp.exe File opened (read-only) \??\z: odfcpvdlkp.exe File opened (read-only) \??\q: eyfhqddp.exe File opened (read-only) \??\p: odfcpvdlkp.exe File opened (read-only) \??\y: odfcpvdlkp.exe File opened (read-only) \??\g: eyfhqddp.exe File opened (read-only) \??\i: eyfhqddp.exe File opened (read-only) \??\v: eyfhqddp.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
odfcpvdlkp.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" odfcpvdlkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" odfcpvdlkp.exe -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3760-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe C:\Windows\SysWOW64\oyaopmiuqhsvhue.exe autoit_exe C:\Windows\SysWOW64\odfcpvdlkp.exe autoit_exe C:\Windows\SysWOW64\eyfhqddp.exe autoit_exe C:\Windows\SysWOW64\hkciazgcxbsqb.exe autoit_exe C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe autoit_exe C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe autoit_exe C:\Users\Admin\AppData\Roaming\AddClear.doc.exe autoit_exe \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe autoit_exe \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe autoit_exe -
Drops file in System32 directory 12 IoCs
Processes:
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exeodfcpvdlkp.exeeyfhqddp.exeeyfhqddp.exedescription ioc process File opened for modification C:\Windows\SysWOW64\odfcpvdlkp.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File created C:\Windows\SysWOW64\oyaopmiuqhsvhue.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\oyaopmiuqhsvhue.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eyfhqddp.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File created C:\Windows\SysWOW64\hkciazgcxbsqb.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll odfcpvdlkp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe eyfhqddp.exe File created C:\Windows\SysWOW64\odfcpvdlkp.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hkciazgcxbsqb.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe eyfhqddp.exe File created C:\Windows\SysWOW64\eyfhqddp.exe 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
Processes:
eyfhqddp.exeeyfhqddp.exedescription ioc process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eyfhqddp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal eyfhqddp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eyfhqddp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eyfhqddp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eyfhqddp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eyfhqddp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal eyfhqddp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eyfhqddp.exe -
Drops file in Windows directory 19 IoCs
Processes:
eyfhqddp.exeeyfhqddp.exeWINWORD.EXE783fd152ef4fb11f362a90431f597393_JaffaCakes118.exedescription ioc process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eyfhqddp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eyfhqddp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eyfhqddp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification C:\Windows\mydoc.rtf 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eyfhqddp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eyfhqddp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eyfhqddp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eyfhqddp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eyfhqddp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
odfcpvdlkp.exe783fd152ef4fb11f362a90431f597393_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" odfcpvdlkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" odfcpvdlkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B058479339EA52CFBAD632EAD4BF" 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat odfcpvdlkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" odfcpvdlkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FF8C485A85189140D62D7D92BDEEE64359456644623FD7ED" 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC77B1596DAB1B9CD7CE6ECE037BA" 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" odfcpvdlkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" odfcpvdlkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc odfcpvdlkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" odfcpvdlkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs odfcpvdlkp.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAF9BDF917F19684093B3586EB3E94B38E02FC4212023FE1BD459E08D6" 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78768B5FF6722A9D272D0A88A7A9062" 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh odfcpvdlkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33372C7C9C5683256D4577D670222CAB7D8565D9" 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf odfcpvdlkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg odfcpvdlkp.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2204 WINWORD.EXE 2204 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exeodfcpvdlkp.exeoyaopmiuqhsvhue.exeeyfhqddp.exehkciazgcxbsqb.exeeyfhqddp.exepid process 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exeodfcpvdlkp.exeoyaopmiuqhsvhue.exeeyfhqddp.exehkciazgcxbsqb.exeeyfhqddp.exepid process 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exeodfcpvdlkp.exeoyaopmiuqhsvhue.exeeyfhqddp.exehkciazgcxbsqb.exeeyfhqddp.exepid process 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2432 odfcpvdlkp.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 2232 oyaopmiuqhsvhue.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 4932 eyfhqddp.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 5064 hkciazgcxbsqb.exe 64 eyfhqddp.exe 64 eyfhqddp.exe 64 eyfhqddp.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2204 WINWORD.EXE 2204 WINWORD.EXE 2204 WINWORD.EXE 2204 WINWORD.EXE 2204 WINWORD.EXE 2204 WINWORD.EXE 2204 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
783fd152ef4fb11f362a90431f597393_JaffaCakes118.exeodfcpvdlkp.exedescription pid process target process PID 3760 wrote to memory of 2432 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe odfcpvdlkp.exe PID 3760 wrote to memory of 2432 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe odfcpvdlkp.exe PID 3760 wrote to memory of 2432 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe odfcpvdlkp.exe PID 3760 wrote to memory of 2232 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe oyaopmiuqhsvhue.exe PID 3760 wrote to memory of 2232 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe oyaopmiuqhsvhue.exe PID 3760 wrote to memory of 2232 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe oyaopmiuqhsvhue.exe PID 3760 wrote to memory of 4932 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe eyfhqddp.exe PID 3760 wrote to memory of 4932 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe eyfhqddp.exe PID 3760 wrote to memory of 4932 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe eyfhqddp.exe PID 3760 wrote to memory of 5064 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe hkciazgcxbsqb.exe PID 3760 wrote to memory of 5064 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe hkciazgcxbsqb.exe PID 3760 wrote to memory of 5064 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe hkciazgcxbsqb.exe PID 3760 wrote to memory of 2204 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe WINWORD.EXE PID 3760 wrote to memory of 2204 3760 783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe WINWORD.EXE PID 2432 wrote to memory of 64 2432 odfcpvdlkp.exe eyfhqddp.exe PID 2432 wrote to memory of 64 2432 odfcpvdlkp.exe eyfhqddp.exe PID 2432 wrote to memory of 64 2432 odfcpvdlkp.exe eyfhqddp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\783fd152ef4fb11f362a90431f597393_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\odfcpvdlkp.exeodfcpvdlkp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\eyfhqddp.exeC:\Windows\system32\eyfhqddp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\oyaopmiuqhsvhue.exeoyaopmiuqhsvhue.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\eyfhqddp.exeeyfhqddp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\hkciazgcxbsqb.exehkciazgcxbsqb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
6Impair Defenses
2Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
512KB
MD5efc31545d40d5be83a028c5ed80f3cf5
SHA1b5269d52a4eac8cd98f5b8802b797a3f4b828963
SHA256de8d69073cb7cdc00a9ac5e3edd54499be90f5b8a83208eb57d645f78b2b6f5a
SHA512c1c71ee96a149909e08099c45a8fa625175b05de6b3d755abdcfc31ccd0b987210a1b520fe65863a8c1e8945c9cdd45064b37d8d51a565711b713df0cd587537
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
512KB
MD5043b0185a4eeca2378bb823cee386d78
SHA10c745fc3b26977156e10d1d72b6856444dd90cd0
SHA25629e9d09c83f4d3a5f6b934f9119df6dd72cdfc1d5b75e260ef991136b1453f29
SHA51233e7b6eb11dcef4d1bc3f5e3c1ffcbcfe636eb52d5ca03b1f56ebefb6b0f8143c654fc1b4e5c4749bd2b9c0d4242e8752082948f875787de01396e1cb3d97872
-
C:\Users\Admin\AppData\Local\Temp\TCDD098.tmp\iso690.xslFilesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
C:\Users\Admin\AppData\Roaming\AddClear.doc.exeFilesize
512KB
MD5615d4d8a93b40e8f3fd249888beccf9b
SHA19fb09fa50c7238d3b330b76cd1197a74bcb1d6a1
SHA2565fcd2b1c71f0c0c2f90989a28693c6c72005b414b518ffd837e207af274b3a01
SHA5129863cded6d86f87c1de40d6d5936c2b946a72356b4ba2a0cc334f62d708a32e6f9c01e309a341288154f01fe611ad3c86e949321b35c130cc74f2891348aec00
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msFilesize
3KB
MD504cd73b007e9d84f9f45f07205e6a7fc
SHA1bf79a170e70f49b185eb5b91fcc8310e5366b6a7
SHA25608964209f7eefd7c7ef378fe2c4df3427b36aef75a1d7882278daa6b2d329c64
SHA5129a53d536a4b441d7c4f3b0999516f6ddc213ec259e8afa2dc4b30f8a67858dda297d9488248f9f4750ed58b421e586224ff6bd7a881cca4a2d05d99b56792a22
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msFilesize
3KB
MD5719d90df9891ffe0717477ec6f18ade7
SHA172b0270f23aba88009b36c8e87f55e85d1eb3218
SHA2567c381d9f68a3bc852db936f5a7b732ce1b2dd3e05a118a69b39a32e914cfe91d
SHA5127ce628816f033fc67dc86cbea15304112c51420e36d070ace91ad1a4a8ad36306a32a4ad3b1ef8777b9db911f2044736a07aaa4f9b19b937e8f40fcb329f4128
-
C:\Windows\SysWOW64\eyfhqddp.exeFilesize
512KB
MD5396b9542b2e4ba5a7d6ee2538c84767e
SHA17a992661b7dc767974f4ecd85c69417818467294
SHA256cc9c78531ac3f141556e999701346ae99a729063c7e5cad46405274b2a190c04
SHA5121dabab3388517c6416c89ce4c3837b175881c6d290839b0651d21538b2c682531fbaf254f7c82c23f48a2efe0f02606cf25b2816b25c09e68ae201a5aacffe97
-
C:\Windows\SysWOW64\hkciazgcxbsqb.exeFilesize
512KB
MD5ca791ec8036a7bb8bccef3c2bb3bed22
SHA1c6283f97ba3dcd14c30b6ecfaa4b3b33445f279d
SHA256a73476d63f2f003b7563f038fd800d07da7445881a1711b0e523f8871a389b44
SHA51211e79855aea6e368e3cd516d2e4d89b98e9b18e413fcfb8c230940eded32ed16f56b069d659b0b459420d919fa3065db2a38b92968086099c05aa561bc9bee3e
-
C:\Windows\SysWOW64\odfcpvdlkp.exeFilesize
512KB
MD5921fb67164c30d56c9c780a0661eb744
SHA1177165a9766c717184f84bc0e3e90a15f849e219
SHA256eab75cff22870cd12b35e8e2fb125962ec89ef602e268c8f5f302d90ea61e500
SHA512175b14ac907a0c42770d0cc1d7b09f54a6be6d0547f2cb203204ac11764d58a5ecc497de7406a5a1d900f8403389c475f65615a5557291b429f5a0a9de863ab6
-
C:\Windows\SysWOW64\oyaopmiuqhsvhue.exeFilesize
512KB
MD5ee45f8bc8a18286ac698f46349576881
SHA14af6dd0a680ec1407beb6611bd073af65ef811e9
SHA2564ae6366655878591b79abde6b3cf6df83d09a48bd47ab71b4465b7f1a730a7e3
SHA512358436a31256be5414b619e2c912e5298824a7f75bab479387d6cdee5c2f4a1ecba400a22f6a140c53344b1b3127bde441845bd64c2ef43949a7953240d19689
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
512KB
MD5a55a7052c743750e70423ab4ba3992ef
SHA1908a753290825df77eff33001e4c8595dfe7b762
SHA2565e1a9e6a6b88062067ea90541d9504127a6aed208815eb4938cbc1b477418e2a
SHA512d4d1588c66dd7b6109c273264f3a2f96721dc0043c12ede8710d491a5852b03d700797ae073d4e2b9966d52e52cb5cf9c89016ae084bc1b7555a90cad56e4ab9
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
512KB
MD58bb8f21cd7773b0bcc89e0703471365b
SHA1cf187685fbb48dcf93c8dcec3c72adc9a260aa10
SHA256386915b3c5b355bc4e3be1b257f5fa92bc73624fac2b6987a064c5dfe9c4396b
SHA512f9fbc382ecbde06243cc4e487b7116fd7efdb244f7f8bf1548cb31d1c590203f4c05ccb493473ced72c4ed6795878ae26b77bdd3e7b8731545591c882501598b
-
memory/2204-39-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-38-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-37-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-36-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-35-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-40-0x00007FF7DCAB0000-0x00007FF7DCAC0000-memory.dmpFilesize
64KB
-
memory/2204-41-0x00007FF7DCAB0000-0x00007FF7DCAC0000-memory.dmpFilesize
64KB
-
memory/2204-606-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-607-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-608-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/2204-605-0x00007FF7DF150000-0x00007FF7DF160000-memory.dmpFilesize
64KB
-
memory/3760-0-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB