Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 17:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe
- Size 512KB
- Sample240527-wcbf1sda82
- SHA256 f8f67615b1e7ef71be2342a3a87e9c3070c51ffd248dc6d05a9e454d8d99a0fe
- MD5 79f828d5c3344ea90435c5a844e5dcaa
- SHA1 d9a2f22ff9daf989132e2bc98fc5aec6b9c4eea9
- SHA512 d28e03fd737824ff5907161b5b8a836a38291268092b0e7a0a3f2fb6e11433649892c433500e09534df7e71cb070ee0dce22876d120bf98ec1eb7fb26b5f7d9f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" purdtztmts.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" purdtztmts.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" purdtztmts.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" purdtztmts.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 3372 purdtztmts.exe 3960 ieifjyhnfathzui.exe 4576 plueealw.exe 4176 qiezrigrqggku.exe 4984 plueealw.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" purdtztmts.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "qiezrigrqggku.exe" ieifjyhnfathzui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\habxtwfx = "purdtztmts.exe" ieifjyhnfathzui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taiylokw = "ieifjyhnfathzui.exe" ieifjyhnfathzui.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: purdtztmts.exe File opened (read-only) \??\l: plueealw.exe File opened (read-only) \??\p: plueealw.exe File opened (read-only) \??\k: plueealw.exe File opened (read-only) \??\k: plueealw.exe File opened (read-only) \??\z: plueealw.exe File opened (read-only) \??\g: purdtztmts.exe File opened (read-only) \??\n: purdtztmts.exe File opened (read-only) \??\m: plueealw.exe File opened (read-only) \??\r: purdtztmts.exe File opened (read-only) \??\w: plueealw.exe File opened (read-only) \??\u: plueealw.exe File opened (read-only) \??\w: plueealw.exe File opened (read-only) \??\l: purdtztmts.exe File opened (read-only) \??\q: purdtztmts.exe File opened (read-only) \??\h: plueealw.exe File opened (read-only) \??\b: purdtztmts.exe File opened (read-only) \??\t: purdtztmts.exe File opened (read-only) \??\t: plueealw.exe File opened (read-only) \??\v: purdtztmts.exe File opened (read-only) \??\m: plueealw.exe File opened (read-only) \??\s: plueealw.exe File opened (read-only) \??\u: plueealw.exe File opened (read-only) \??\a: plueealw.exe File opened (read-only) \??\g: plueealw.exe File opened (read-only) \??\n: plueealw.exe File opened (read-only) \??\m: purdtztmts.exe File opened (read-only) \??\a: plueealw.exe File opened (read-only) \??\o: plueealw.exe File opened (read-only) \??\v: plueealw.exe File opened (read-only) \??\y: plueealw.exe File opened (read-only) \??\e: plueealw.exe File opened (read-only) \??\p: purdtztmts.exe File opened (read-only) \??\s: purdtztmts.exe File opened (read-only) \??\w: purdtztmts.exe File opened (read-only) \??\z: plueealw.exe File opened (read-only) \??\i: purdtztmts.exe File opened (read-only) \??\o: purdtztmts.exe File opened (read-only) \??\n: plueealw.exe File opened (read-only) \??\b: plueealw.exe File opened (read-only) \??\h: plueealw.exe File opened (read-only) \??\j: plueealw.exe File opened (read-only) \??\q: plueealw.exe File opened (read-only) \??\o: plueealw.exe File opened (read-only) \??\s: plueealw.exe File opened (read-only) \??\h: purdtztmts.exe File opened (read-only) \??\x: purdtztmts.exe File opened (read-only) \??\a: purdtztmts.exe File opened (read-only) \??\j: purdtztmts.exe File opened (read-only) \??\e: plueealw.exe File opened (read-only) \??\g: plueealw.exe File opened (read-only) \??\j: plueealw.exe File opened (read-only) \??\l: plueealw.exe File opened (read-only) \??\u: purdtztmts.exe File opened (read-only) \??\z: purdtztmts.exe File opened (read-only) \??\q: plueealw.exe File opened (read-only) \??\t: plueealw.exe File opened (read-only) \??\v: plueealw.exe File opened (read-only) \??\r: plueealw.exe File opened (read-only) \??\x: plueealw.exe File opened (read-only) \??\i: plueealw.exe File opened (read-only) \??\b: plueealw.exe File opened (read-only) \??\i: plueealw.exe File opened (read-only) \??\r: plueealw.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" purdtztmts.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" purdtztmts.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1184-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000800000002325f-5.dat autoit_exe behavioral2/files/0x000800000002325d-18.dat autoit_exe behavioral2/files/0x0008000000023261-27.dat autoit_exe behavioral2/files/0x0008000000023262-32.dat autoit_exe behavioral2/files/0x0008000000023115-54.dat autoit_exe behavioral2/files/0x000700000002326c-57.dat autoit_exe behavioral2/files/0x000200000001eb0e-87.dat autoit_exe behavioral2/files/0x000200000001e2d3-95.dat autoit_exe behavioral2/files/0x000200000001e2d3-103.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\plueealw.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe plueealw.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe plueealw.exe File created C:\Windows\SysWOW64\purdtztmts.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File created C:\Windows\SysWOW64\ieifjyhnfathzui.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\purdtztmts.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File created C:\Windows\SysWOW64\plueealw.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\qiezrigrqggku.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe plueealw.exe File opened for modification C:\Windows\SysWOW64\ieifjyhnfathzui.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File created C:\Windows\SysWOW64\qiezrigrqggku.exe 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll purdtztmts.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe plueealw.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe plueealw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe plueealw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal plueealw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal plueealw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe plueealw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe plueealw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal plueealw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe plueealw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe plueealw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe plueealw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe plueealw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe plueealw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe plueealw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe plueealw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal plueealw.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh purdtztmts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" purdtztmts.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc purdtztmts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" purdtztmts.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg purdtztmts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABCFAB1F964F1E4837A3A3186EC39E6B089028A42130348E2C4459E08A3" 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432D7D9D5283206D4177A177222CAC7CF365DA" 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7866BB4FE6622D0D10FD1A98A7F9062" 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat purdtztmts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" purdtztmts.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf purdtztmts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" purdtztmts.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs purdtztmts.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" purdtztmts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C6091590DBB2B8C87C90ED9537CE" 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB15F4492399853CBBAD33299D4BE" 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" purdtztmts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F89FF8E485C821B9041D72E7D92BCEFE633594067406335D691" 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4404 WINWORD.EXE 4404 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 4576 plueealw.exe 4576 plueealw.exe 4576 plueealw.exe 4576 plueealw.exe 4576 plueealw.exe 4576 plueealw.exe 4576 plueealw.exe 4576 plueealw.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3960 ieifjyhnfathzui.exe 4576 plueealw.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 4576 plueealw.exe 4576 plueealw.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4984 plueealw.exe 4984 plueealw.exe 4984 plueealw.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3372 purdtztmts.exe 3960 ieifjyhnfathzui.exe 3960 ieifjyhnfathzui.exe 4576 plueealw.exe 3960 ieifjyhnfathzui.exe 4576 plueealw.exe 4576 plueealw.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4176 qiezrigrqggku.exe 4984 plueealw.exe 4984 plueealw.exe 4984 plueealw.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4404 WINWORD.EXE 4404 WINWORD.EXE 4404 WINWORD.EXE 4404 WINWORD.EXE 4404 WINWORD.EXE 4404 WINWORD.EXE 4404 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1184 wrote to memory of 3372 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 90 PID 1184 wrote to memory of 3372 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 90 PID 1184 wrote to memory of 3372 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 90 PID 1184 wrote to memory of 3960 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 91 PID 1184 wrote to memory of 3960 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 91 PID 1184 wrote to memory of 3960 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 91 PID 1184 wrote to memory of 4576 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 92 PID 1184 wrote to memory of 4576 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 92 PID 1184 wrote to memory of 4576 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 92 PID 1184 wrote to memory of 4176 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 93 PID 1184 wrote to memory of 4176 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 93 PID 1184 wrote to memory of 4176 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 93 PID 3372 wrote to memory of 4984 3372 purdtztmts.exe 94 PID 3372 wrote to memory of 4984 3372 purdtztmts.exe 94 PID 3372 wrote to memory of 4984 3372 purdtztmts.exe 94 PID 1184 wrote to memory of 4404 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 95 PID 1184 wrote to memory of 4404 1184 79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\79f828d5c3344ea90435c5a844e5dcaa_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\purdtztmts.exepurdtztmts.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\plueealw.exeC:\Windows\system32\plueealw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4984
-
-
-
C:\Windows\SysWOW64\ieifjyhnfathzui.exeieifjyhnfathzui.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3960
-
-
C:\Windows\SysWOW64\plueealw.exeplueealw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4576
-
-
C:\Windows\SysWOW64\qiezrigrqggku.exeqiezrigrqggku.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4176
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:4344
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 63d07d6a6734d6b401417d0513f7024637f452460b071f6fc510ad417833d4b7
- MD5 c3f5c06524ef022296906dea948cd912
- SHA1 de2a96e559017a28e3354598310161e4b1f7c3da
- SHA512 bec311d9c3aaaf33800e6c51cf726714d727150c8f67ef51135cf7f0f6f27c4606f2b4a1607c4e211e8b4a47cc16f4732ab5fee0c0187381b28af0f764d89fb0
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 641a829a867a1987f580805f0925da5eb707bb4d891b9131bdf0e7c718497d9c
- MD5 342b195d6001bfce186f6d1544a1b1f9
- SHA1 aabb903c727fbfb09b9afe2f8dc8ba7b2d6a1a3c
- SHA512 54da32a50bdebca1e5f1177daa08304778996cc79fd7e04e80ab389794f4d26a12f094d117bd517fa87c9173681253b71a0d261877837c868128930ba86009fe
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 717d442d1c6ceee825f4ce3a173b871f5ca00ccbd020a743e29b63945adfae31
- MD5 37995b619baa8013265ef55e2a595b10
- SHA1 845f30c0a45f64fe8c7d32ad182b283878597e9f
- SHA512 c526c7955b2f8bf5791e34f631ad2b087dd4a636167c527b553c98aecbe0df946d6f8437b6d3458c1d65a18593519037c4417d1ec5d071169a998dfb193b1a4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 18f76c0445ce2589cf42c839a3101aef00bd8120a8244fe091bd2bd7ef7ad507
- MD5 f36dca8e18802e05b82093cea92fd52e
- SHA1 b655984c1ab0a72fee137a8201a7181b8e56d3e0
- SHA512 9b459e67e4d09ced52bb4a3563e760f93752d71ee795c60a7884dfd08aae6f7916dc65031882b6bc719028aeb60724dc11922c4fc331e882dd5828fa2e25e99d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 863cebb8e91341b14b4e4e39ca7a84f662a7c8a2dbf6be038ee8a6cbe9a3737e
- MD5 087a4e4dfbeb846b951dde989ca23136
- SHA1 e8a401296b119279faa1afac8827723b32cc141a
- SHA512 f885f2724ee10937420dc44711b751f1aaed9c89f2803f3efd9e2873c702fac9e57c9b5d62ea1fbf71d0268c6002172d2afa2b2db8cb8027c7f9fed18efe9dba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Music\PublishStop.doc.exe
- Size 512KB
- SHA256 8bcb7a0a9964941aa742c6c83d4367bf38d3d0013ea4c9fbb5b35fb30ad81b50
- MD5 d0b503c3a9043336f89063151e8b14cc
- SHA1 c1e41447b19e880d0adeb952f85911e0fad9ba19
- SHA512 b84a70c6e7c9efb7176fcdf44261474343afabb5134b862a7ff55418568e5ed6bb92f45007335f2148757375c864611bd4d7db679c6f4b6bc680e20b10ef0e68
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ieifjyhnfathzui.exe
- Size 512KB
- SHA256 bfbcd6e8c29c61c266390e5e3311c3d4423ea9979725b9208d647e0505ae910c
- MD5 4ac40955b48fd38ddc42d3d8e0b64c06
- SHA1 eac7b571f9ce9323cfc69337690f90446e8209e4
- SHA512 5c5a6e36a1e605c23eb0db079f730d65cd452444743cd3f02321f7a12adf0a593e3e591814c695fe0bfdefda72b20918dd37d26815b4413144993654f849694d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\plueealw.exe
- Size 512KB
- SHA256 e428818229860780af6d67b898d2f84229e4b9f812a6ac0b506017e187d3f4c8
- MD5 cb9e0e63a28bf74245c00652e7ec74d5
- SHA1 eaac9c9844e9400e0e00f552cf22bee7efa7f92c
- SHA512 2cbd5a5ae806de25d8a4aef5a1d954d736fd9c91a51b1d0a9103e64de339e107d37c6cb8858ee7cd4c16ed685ea94b6517b13f29c6d708524522a42a629a61f6
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\purdtztmts.exe
- Size 512KB
- SHA256 2010a5144ffb221c86508bd49c5b47ca9e22edf32892232a1fa379ad53d5a276
- MD5 1519c65102571f047c67264bd1dcf8dd
- SHA1 5d0483ef08997181b7d2cfb78314e9833a437b6a
- SHA512 85763c380586065d515458a6af9ea526d8f415328b4289e5ad3c119f9eaba006d76ecddab0caec81b5aa8bd4251c89b99bc244081032721b06980521c860c768
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\qiezrigrqggku.exe
- Size 512KB
- SHA256 de3f67bfc425d490433b8a61617afa37a99a08e4e66fdc9dafd7f77aa4b5c601
- MD5 1527638bf711025d1743a73c963262a4
- SHA1 7ce1dbd721c686102cc19cf7a87204df1b40ac80
- SHA512 0538aeaee65d0cfb6ad10a014b6de3f298c3a06b2e81f356ffb7305efc638450f1b2f7897a75517d50cf1da67593deeb5513f7184a93e34c744da0279b4c9aa1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 519f4276e0d4223c2671afcad7787b76bbc0a0ad57ef8d2793ebb029b49df971
- MD5 1064e677b3940606b9272eae78e57476
- SHA1 d00436cec57c05fc2726547af67147726051acce
- SHA512 a64fcceba329d11c8d16dada288774b1c3435372835a8c0bf79d8fea2e6a0d30af13a7dcd59140c6dc9aa6286f7d074634b7aa9ea80f6597ab448591939db3a0
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 d2cbbfff85eaabd68af385fa313dd5296abf5d8390b32a4b83c5d5d1486ff050
- MD5 0ed40bb0363abb00424e6ed8da77e39c
- SHA1 49877435a5f4c4783bdf323fbd93c588efa9cae3
- SHA512 a2e9305f40a4d8b6ba33c02c242829dc07940ac8b7a6ac087ee8f48938b6481fc24109484b54f33e7676dd8edd6819f1f3d76990a22f093c445f2529fffa0489
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y
- MD5 SHA1 SHA512 SSDEEP