Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 13:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe
- Size 512KB
- Sample240527-qrdl2afc53
- SHA256 5c9dbf00a24b9351e5a2d4db6f6932379e499d4bc1abc420a1300933f80d1357
- MD5 794238e30b9c97c26c80973a97569d33
- SHA1 b7b9219ce303638e6acc1ee64ca4d420fb321e1a
- SHA512 5688cfcb7c4a47174bf3619267a543e061425116e848eccb6826767e8252794abf44317892c3cf099a572eb46cfa8f062475d4209589fa3c439c14dcc2a90835
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" dtzvmjufum.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dtzvmjufum.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dtzvmjufum.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dtzvmjufum.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 3888 dtzvmjufum.exe 3248 amxvstzywqgnwcw.exe 388 jsrrygtz.exe 1920 yixutujpylysx.exe 4192 jsrrygtz.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dtzvmjufum.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vidhexoy = "dtzvmjufum.exe" amxvstzywqgnwcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\guiheilp = "amxvstzywqgnwcw.exe" amxvstzywqgnwcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "yixutujpylysx.exe" amxvstzywqgnwcw.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: dtzvmjufum.exe File opened (read-only) \??\t: jsrrygtz.exe File opened (read-only) \??\o: dtzvmjufum.exe File opened (read-only) \??\v: dtzvmjufum.exe File opened (read-only) \??\k: jsrrygtz.exe File opened (read-only) \??\z: dtzvmjufum.exe File opened (read-only) \??\j: jsrrygtz.exe File opened (read-only) \??\j: jsrrygtz.exe File opened (read-only) \??\w: jsrrygtz.exe File opened (read-only) \??\n: dtzvmjufum.exe File opened (read-only) \??\b: jsrrygtz.exe File opened (read-only) \??\q: jsrrygtz.exe File opened (read-only) \??\s: jsrrygtz.exe File opened (read-only) \??\b: jsrrygtz.exe File opened (read-only) \??\e: jsrrygtz.exe File opened (read-only) \??\o: jsrrygtz.exe File opened (read-only) \??\y: jsrrygtz.exe File opened (read-only) \??\i: dtzvmjufum.exe File opened (read-only) \??\k: dtzvmjufum.exe File opened (read-only) \??\t: jsrrygtz.exe File opened (read-only) \??\y: dtzvmjufum.exe File opened (read-only) \??\e: jsrrygtz.exe File opened (read-only) \??\o: jsrrygtz.exe File opened (read-only) \??\v: jsrrygtz.exe File opened (read-only) \??\y: jsrrygtz.exe File opened (read-only) \??\a: jsrrygtz.exe File opened (read-only) \??\g: jsrrygtz.exe File opened (read-only) \??\s: jsrrygtz.exe File opened (read-only) \??\q: dtzvmjufum.exe File opened (read-only) \??\i: jsrrygtz.exe File opened (read-only) \??\m: jsrrygtz.exe File opened (read-only) \??\p: jsrrygtz.exe File opened (read-only) \??\b: dtzvmjufum.exe File opened (read-only) \??\t: dtzvmjufum.exe File opened (read-only) \??\h: jsrrygtz.exe File opened (read-only) \??\l: jsrrygtz.exe File opened (read-only) \??\m: jsrrygtz.exe File opened (read-only) \??\r: jsrrygtz.exe File opened (read-only) \??\u: jsrrygtz.exe File opened (read-only) \??\j: dtzvmjufum.exe File opened (read-only) \??\u: dtzvmjufum.exe File opened (read-only) \??\l: dtzvmjufum.exe File opened (read-only) \??\n: jsrrygtz.exe File opened (read-only) \??\a: dtzvmjufum.exe File opened (read-only) \??\e: dtzvmjufum.exe File opened (read-only) \??\g: dtzvmjufum.exe File opened (read-only) \??\v: jsrrygtz.exe File opened (read-only) \??\w: dtzvmjufum.exe File opened (read-only) \??\k: jsrrygtz.exe File opened (read-only) \??\h: dtzvmjufum.exe File opened (read-only) \??\s: dtzvmjufum.exe File opened (read-only) \??\n: jsrrygtz.exe File opened (read-only) \??\r: jsrrygtz.exe File opened (read-only) \??\x: jsrrygtz.exe File opened (read-only) \??\q: jsrrygtz.exe File opened (read-only) \??\m: dtzvmjufum.exe File opened (read-only) \??\l: jsrrygtz.exe File opened (read-only) \??\i: jsrrygtz.exe File opened (read-only) \??\z: jsrrygtz.exe File opened (read-only) \??\a: jsrrygtz.exe File opened (read-only) \??\z: jsrrygtz.exe File opened (read-only) \??\p: dtzvmjufum.exe File opened (read-only) \??\x: jsrrygtz.exe File opened (read-only) \??\w: jsrrygtz.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" dtzvmjufum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" dtzvmjufum.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/920-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233fd-6.dat autoit_exe behavioral2/files/0x00080000000233f9-18.dat autoit_exe behavioral2/files/0x00070000000233fe-28.dat autoit_exe behavioral2/files/0x00070000000233ff-32.dat autoit_exe behavioral2/files/0x00080000000233dc-66.dat autoit_exe behavioral2/files/0x000700000002340d-69.dat autoit_exe behavioral2/files/0x001600000002345e-540.dat autoit_exe behavioral2/files/0x001600000002345e-563.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jsrrygtz.exe File created C:\Windows\SysWOW64\dtzvmjufum.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File created C:\Windows\SysWOW64\amxvstzywqgnwcw.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll dtzvmjufum.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe jsrrygtz.exe File created C:\Windows\SysWOW64\yixutujpylysx.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yixutujpylysx.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dtzvmjufum.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\amxvstzywqgnwcw.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File created C:\Windows\SysWOW64\jsrrygtz.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jsrrygtz.exe 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jsrrygtz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jsrrygtz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jsrrygtz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jsrrygtz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jsrrygtz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jsrrygtz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jsrrygtz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jsrrygtz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jsrrygtz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jsrrygtz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jsrrygtz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jsrrygtz.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jsrrygtz.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jsrrygtz.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jsrrygtz.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe jsrrygtz.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe jsrrygtz.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe jsrrygtz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe jsrrygtz.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe jsrrygtz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe jsrrygtz.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification C:\Windows\mydoc.rtf 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe jsrrygtz.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe jsrrygtz.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe jsrrygtz.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F76BC3FE1B21D0D20CD1A68A0F9063" 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat dtzvmjufum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh dtzvmjufum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf dtzvmjufum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" dtzvmjufum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs dtzvmjufum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg dtzvmjufum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC1B0294497389952BEBAD533EAD4CC" 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC7741590DAB3B8C17C92ED9237C9" 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" dtzvmjufum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc dtzvmjufum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4FAB9FE65F2E484083A4581EA3E98B388038A4316034EE2C9429C09D4" 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF8FF8E4F28826D903CD65B7DE6BC94E640594B664E6246D69C" 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" dtzvmjufum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" dtzvmjufum.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472D7C9D2382596A3176A177232CD87CF464AF" 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" dtzvmjufum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" dtzvmjufum.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1452 WINWORD.EXE 1452 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 388 jsrrygtz.exe 388 jsrrygtz.exe 388 jsrrygtz.exe 3248 amxvstzywqgnwcw.exe 388 jsrrygtz.exe 3248 amxvstzywqgnwcw.exe 388 jsrrygtz.exe 388 jsrrygtz.exe 388 jsrrygtz.exe 388 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe 1920 yixutujpylysx.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 388 jsrrygtz.exe 1920 yixutujpylysx.exe 388 jsrrygtz.exe 1920 yixutujpylysx.exe 388 jsrrygtz.exe 1920 yixutujpylysx.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3888 dtzvmjufum.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 3248 amxvstzywqgnwcw.exe 388 jsrrygtz.exe 1920 yixutujpylysx.exe 388 jsrrygtz.exe 1920 yixutujpylysx.exe 388 jsrrygtz.exe 1920 yixutujpylysx.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe 4192 jsrrygtz.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1452 WINWORD.EXE 1452 WINWORD.EXE 1452 WINWORD.EXE 1452 WINWORD.EXE 1452 WINWORD.EXE 1452 WINWORD.EXE 1452 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 920 wrote to memory of 3888 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 83 PID 920 wrote to memory of 3888 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 83 PID 920 wrote to memory of 3888 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 83 PID 920 wrote to memory of 3248 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 84 PID 920 wrote to memory of 3248 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 84 PID 920 wrote to memory of 3248 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 84 PID 920 wrote to memory of 388 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 85 PID 920 wrote to memory of 388 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 85 PID 920 wrote to memory of 388 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 85 PID 920 wrote to memory of 1920 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 86 PID 920 wrote to memory of 1920 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 86 PID 920 wrote to memory of 1920 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 86 PID 3888 wrote to memory of 4192 3888 dtzvmjufum.exe 89 PID 3888 wrote to memory of 4192 3888 dtzvmjufum.exe 89 PID 3888 wrote to memory of 4192 3888 dtzvmjufum.exe 89 PID 920 wrote to memory of 1452 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 88 PID 920 wrote to memory of 1452 920 794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\794238e30b9c97c26c80973a97569d33_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\dtzvmjufum.exedtzvmjufum.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\jsrrygtz.exeC:\Windows\system32\jsrrygtz.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4192
-
-
-
C:\Windows\SysWOW64\amxvstzywqgnwcw.exeamxvstzywqgnwcw.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3248
-
-
C:\Windows\SysWOW64\jsrrygtz.exejsrrygtz.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:388
-
-
C:\Windows\SysWOW64\yixutujpylysx.exeyixutujpylysx.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1452
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 e2f84e2902d735d5f606fc2e9801b47dbff1c557975b5e12cd5f55db5fb65da0
- MD5 5317e13774193f19058808e5ba90a17f
- SHA1 59a7b7688203ba1416d8347f124862a6dcc250e2
- SHA512 f2a80488b5eb519afa42e3c1933b231fec8e59bf01ec96708f27ff7a2e6e4e7ef1dd0036edce3b8c688aaa34f191d387d2425c0e2fc6265e460d0575beb3ec7d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 806b42f26176eb3937716bb0a3c06fbb035497e8baebb7fd03573abe49402185
- MD5 f8b9b0be11f2cb466ddf598c1cc0a9a9
- SHA1 ae3873b3da610b7397bf663008cd4d9baf4d31e4
- SHA512 25864d6a9c41a7cfab44e3093077fbf9059f24b2cab8e702a618093022638b72815c1b95cba3f407d5ae5cc4c303ede9a52b5de3648eeac77ed0d54a889c4bd7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD9343.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 d72d7074d338c425e95ab938b674f45cf7afe1e96a1434d956df4bbd0ecdebf9
- MD5 f5f219efcf259c0c15a0521bf15fafcf
- SHA1 68b81f987dbe56b2c44e1c2b8ef4a9c078ea7a5c
- SHA512 d798ed0683b4bc7b025f5ebe96c8b557948bb7570a3ba7efe4d1844014e4415eead9c06db7454f2f5bc8a83fabea619173cea271cf12945b451c8f357c36ac54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 ae6fc94a280493bc46cac6f75288109ebaa791ec92da667325c96a1ca55a592c
- MD5 c53ea95c690a4569c21ac772012a4bd2
- SHA1 f90d6c896fe17392b353fb871e308bc8cbf176c2
- SHA512 162388f5e2a1a388e1a9702db055cc218c15fb0ea78f977bf6582f7e1c595c45ea0261ad8d7ef94624982ba7e50eb634e4c5f4745a1efd43ecb08a98e489534f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 097ab12100170f25b8be0b1248e52dc253a3b445808d57921606038f3ccff3d6
- MD5 69a834810a814ea344913cc5a8c7f11d
- SHA1 24d045c0aff6071a3692f1871635496ee105b9e4
- SHA512 98535762c2e2296e3248ef8b402025a3d8474cfebcd1785a6f89c115acac2f53909e41bdd91a3563d3ef3776275caaf482162d765a88a2a09b0fb68440f562ac
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\amxvstzywqgnwcw.exe
- Size 512KB
- SHA256 826b6ba0de5814c4529318b0a381e921863bb73a4d82daa0516d8ae679aecbe1
- MD5 002c3ab4091ad401af8d666713d49352
- SHA1 97df4701cbd4f7e40dbc0ba090f4ee38bdc93853
- SHA512 a985874ed5b3f66e8a7256492aa820ecb9fc926df112e209318bce122e7c019fce42b5f883873e97669228d4a401bad3382c9ebe71b33594f31d66b70ec3e401
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\dtzvmjufum.exe
- Size 512KB
- SHA256 65af56dded677162a77d2024d58b042782f8bc7ac3543a1df19acc5bca67e170
- MD5 6d7f43fc74e006900d26ef567e0f1f60
- SHA1 9c07b728930d0aa2f36f0c62940d50e1489b63fb
- SHA512 cc11118286263defb5ec536987633d2e16c7bfcc5564f9927b60848f6b2e88055e238f5b8f81dc83555c345102852109bd98486add15a0b4706b461e014bbda4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jsrrygtz.exe
- Size 512KB
- SHA256 f5facc4743b0ce8996ad5fd8407aefce06b2b1a224044c3b3f524f22270ade4c
- MD5 b67e859ccc54c226430f76c02dbdd5bd
- SHA1 e7cdb7ea3a6217fbedd04925bb816fe5e3c88270
- SHA512 429e19b42a1e4678f2f02228680b8889a36862446f186707c8d3058a5fd9c27c2f6e526ea4e8357a694a9c16f7b9631b0377ee7ff2d7872dc7b4747b9da87c78
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\yixutujpylysx.exe
- Size 512KB
- SHA256 abd96f40cafd2d0d01f0537d7f3852482a29224d985677ad9c4a42315db1a992
- MD5 181d3e6cab42bf60e052ac97c2d35899
- SHA1 e8d232a8152bc0d51db43f31b3590fc59914acd6
- SHA512 07390e61f383e6c17a7c61d560783502b8702da8ac08e1c4da1f554682cec0d13bb5cc50609fec0a10e576a9e58acffdeb10179623c60b44a16c3db9ddaa9628
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 bc6a3b71afb2720dc1f4d983763fdb91e0163da27ec791061cb3f9f89957a201
- MD5 27c42c61eac82092a37334bf6976b3fe
- SHA1 ba38abb5ee21a3090a00d030f6ba31fe813aac9e
- SHA512 3eb50a896c57726c37218d3ad1433981639118e9426de0414e35b76c936e7e124387004b088bf378563d88923636c71a7fd25f4e5793bf0ec4e70ddb428ba5b5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 d153a40e68bfdc48e008daf7b5f5d45e45c6fdf58e0086d47a7ed5aed56cac26
- MD5 e0944d57a8bcab66a2afdd9997c08503
- SHA1 2ac2c01b1585dae26cea2590adfaa6e26c56e899
- SHA512 95aabe05618db4e122edb89398120d75241d4cccb176568a3b1737c47e1fc810ccd5181c932fe4c5a3cf4add69a0ede8675dc2f9c31eaec4930172847e7e0ab1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V
- MD5 SHA1 SHA512 SSDEEP