Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 06:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe
-
Size
512KB
-
MD5
7bfa56364080e9b1f129d572f3f3a1d2
-
SHA1
8df9637881bb587a37c9ad30a24767f8f716d090
-
SHA256
de4f53cfe8c5bdc09b9869a231e520ccd28ec4440ddbfa43dddebbc79f08e6c2
-
SHA512
c73bc82a1bf88624d3e15fac7fbbda5a99aa6b06bf7d3cb7e3f422639b25611bfc70c1b2af22b6591c9811cef6ba07303f50522625616fe60620a0f14fb184de
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bltibgrmlr.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bltibgrmlr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bltibgrmlr.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bltibgrmlr.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 4172 bltibgrmlr.exe 3500 lnkikejvkggthqg.exe 3580 manszjae.exe 824 uftbdphkenkav.exe 3112 manszjae.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bltibgrmlr.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qldtivwq = "bltibgrmlr.exe" lnkikejvkggthqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\azachejf = "lnkikejvkggthqg.exe" lnkikejvkggthqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "uftbdphkenkav.exe" lnkikejvkggthqg.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: bltibgrmlr.exe File opened (read-only) \??\b: manszjae.exe File opened (read-only) \??\e: manszjae.exe File opened (read-only) \??\b: manszjae.exe File opened (read-only) \??\e: manszjae.exe File opened (read-only) \??\w: manszjae.exe File opened (read-only) \??\h: manszjae.exe File opened (read-only) \??\h: manszjae.exe File opened (read-only) \??\v: bltibgrmlr.exe File opened (read-only) \??\a: manszjae.exe File opened (read-only) \??\b: bltibgrmlr.exe File opened (read-only) \??\y: manszjae.exe File opened (read-only) \??\o: manszjae.exe File opened (read-only) \??\s: manszjae.exe File opened (read-only) \??\i: bltibgrmlr.exe File opened (read-only) \??\g: bltibgrmlr.exe File opened (read-only) \??\j: bltibgrmlr.exe File opened (read-only) \??\w: manszjae.exe File opened (read-only) \??\s: bltibgrmlr.exe File opened (read-only) \??\u: bltibgrmlr.exe File opened (read-only) \??\y: bltibgrmlr.exe File opened (read-only) \??\v: manszjae.exe File opened (read-only) \??\k: manszjae.exe File opened (read-only) \??\q: manszjae.exe File opened (read-only) \??\r: manszjae.exe File opened (read-only) \??\m: bltibgrmlr.exe File opened (read-only) \??\o: bltibgrmlr.exe File opened (read-only) \??\w: bltibgrmlr.exe File opened (read-only) \??\o: manszjae.exe File opened (read-only) \??\s: manszjae.exe File opened (read-only) \??\v: manszjae.exe File opened (read-only) \??\a: bltibgrmlr.exe File opened (read-only) \??\l: bltibgrmlr.exe File opened (read-only) \??\p: bltibgrmlr.exe File opened (read-only) \??\z: bltibgrmlr.exe File opened (read-only) \??\g: manszjae.exe File opened (read-only) \??\q: manszjae.exe File opened (read-only) \??\r: manszjae.exe File opened (read-only) \??\a: manszjae.exe File opened (read-only) \??\i: manszjae.exe File opened (read-only) \??\t: bltibgrmlr.exe File opened (read-only) \??\m: manszjae.exe File opened (read-only) \??\t: manszjae.exe File opened (read-only) \??\g: manszjae.exe File opened (read-only) \??\t: manszjae.exe File opened (read-only) \??\j: manszjae.exe File opened (read-only) \??\i: manszjae.exe File opened (read-only) \??\k: manszjae.exe File opened (read-only) \??\l: manszjae.exe File opened (read-only) \??\u: manszjae.exe File opened (read-only) \??\h: bltibgrmlr.exe File opened (read-only) \??\r: bltibgrmlr.exe File opened (read-only) \??\x: bltibgrmlr.exe File opened (read-only) \??\z: manszjae.exe File opened (read-only) \??\e: bltibgrmlr.exe File opened (read-only) \??\n: bltibgrmlr.exe File opened (read-only) \??\n: manszjae.exe File opened (read-only) \??\j: manszjae.exe File opened (read-only) \??\p: manszjae.exe File opened (read-only) \??\u: manszjae.exe File opened (read-only) \??\x: manszjae.exe File opened (read-only) \??\y: manszjae.exe File opened (read-only) \??\q: bltibgrmlr.exe File opened (read-only) \??\p: manszjae.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" bltibgrmlr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" bltibgrmlr.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1708-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000a000000023407-5.dat autoit_exe behavioral2/files/0x000d0000000233c6-18.dat autoit_exe behavioral2/files/0x0008000000023408-29.dat autoit_exe behavioral2/files/0x0008000000023409-32.dat autoit_exe behavioral2/files/0x000500000001696d-77.dat autoit_exe behavioral2/files/0x000500000001695b-69.dat autoit_exe behavioral2/files/0x000d00000001da2e-81.dat autoit_exe behavioral2/files/0x001400000001da34-89.dat autoit_exe behavioral2/files/0x0007000000023294-104.dat autoit_exe behavioral2/files/0x0007000000023294-496.dat autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll bltibgrmlr.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe manszjae.exe File opened for modification C:\Windows\SysWOW64\manszjae.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\uftbdphkenkav.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\uftbdphkenkav.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe manszjae.exe File created C:\Windows\SysWOW64\bltibgrmlr.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lnkikejvkggthqg.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\lnkikejvkggthqg.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\manszjae.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bltibgrmlr.exe 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe manszjae.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe manszjae.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe manszjae.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe manszjae.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal manszjae.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe manszjae.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal manszjae.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe manszjae.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe manszjae.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe manszjae.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe manszjae.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe manszjae.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe manszjae.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe manszjae.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe manszjae.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe manszjae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bltibgrmlr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB9FABAF966F190837B3B4486EA3E97B0FB02884316023DE1BD459A08D4" 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B12B47E0389A52C4BAA732EDD7B8" 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bltibgrmlr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" bltibgrmlr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF4FFF84F5F8513913CD65C7D9DBDE6E13759326735633FD6E9" 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F06BB9FE1B22DCD279D1A88B7E906B" 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" bltibgrmlr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc bltibgrmlr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" bltibgrmlr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf bltibgrmlr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs bltibgrmlr.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412C0F9D2D83566A3E76D777242CAC7D8265DB" 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat bltibgrmlr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg bltibgrmlr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bltibgrmlr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1838C77B15E3DAC3B8CC7CE1ED9434CF" 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh bltibgrmlr.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1836 WINWORD.EXE 1836 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 4172 bltibgrmlr.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 3580 manszjae.exe 3580 manszjae.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 3580 manszjae.exe 3580 manszjae.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 3580 manszjae.exe 3580 manszjae.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 3580 manszjae.exe 3580 manszjae.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 3580 manszjae.exe 3580 manszjae.exe 3580 manszjae.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 4172 bltibgrmlr.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 3500 lnkikejvkggthqg.exe 3580 manszjae.exe 3580 manszjae.exe 3580 manszjae.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 824 uftbdphkenkav.exe 3112 manszjae.exe 3112 manszjae.exe 3112 manszjae.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1836 WINWORD.EXE 1836 WINWORD.EXE 1836 WINWORD.EXE 1836 WINWORD.EXE 1836 WINWORD.EXE 1836 WINWORD.EXE 1836 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1708 wrote to memory of 4172 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 83 PID 1708 wrote to memory of 4172 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 83 PID 1708 wrote to memory of 4172 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 83 PID 1708 wrote to memory of 3500 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 84 PID 1708 wrote to memory of 3500 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 84 PID 1708 wrote to memory of 3500 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 84 PID 1708 wrote to memory of 3580 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 85 PID 1708 wrote to memory of 3580 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 85 PID 1708 wrote to memory of 3580 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 85 PID 1708 wrote to memory of 824 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 86 PID 1708 wrote to memory of 824 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 86 PID 1708 wrote to memory of 824 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 86 PID 1708 wrote to memory of 1836 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 87 PID 1708 wrote to memory of 1836 1708 7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe 87 PID 4172 wrote to memory of 3112 4172 bltibgrmlr.exe 89 PID 4172 wrote to memory of 3112 4172 bltibgrmlr.exe 89 PID 4172 wrote to memory of 3112 4172 bltibgrmlr.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7bfa56364080e9b1f129d572f3f3a1d2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\bltibgrmlr.exebltibgrmlr.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\manszjae.exeC:\Windows\system32\manszjae.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3112
-
-
-
C:\Windows\SysWOW64\lnkikejvkggthqg.exelnkikejvkggthqg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3500
-
-
C:\Windows\SysWOW64\manszjae.exemanszjae.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3580
-
-
C:\Windows\SysWOW64\uftbdphkenkav.exeuftbdphkenkav.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:824
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1836
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD55b1387bd9e6a257bff23e49907eb4cba
SHA1d97f02e117ff9f870a5d0d3e1f4c9dcf5351bc98
SHA25678eddd1c0b1d6142680e0facd81d0e20d31f1ee2991016664d91dd64a807f1a5
SHA51271039d54e3336552a2e97129ef3edf80b52fda92f637554e9dd7c6c7f30f57228df2e6113635b458651fa223ace0fb5ff72cdee241d63e1f42a7cbdb52ed8aac
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5e21655acc750a45242c86008fb993b19
SHA1c9fba69c38b0db807e137d3251af23496c5bf7c3
SHA2565637602cce46278c047a9c51ce1906bdfd74587c088f1bdfb99a8e02c47f3222
SHA5129f7f8331879df8c5fe836096ffd27da7b3505417ca020528288ecde5f55ca0d59cf1bc52c6222e7bf71daf3e512c48bcbfae6d9b3ad60fa6320bb25dae79b3a4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD53484ad45f60abea5d8494db6633a40cb
SHA12dfa9ba76befd6b19b8b9c5d06076a6553bef320
SHA256e6ac5fdffc6c1086f2308c99aab55a60ad8eb22a03c51fe56de481c2c5565253
SHA5125cdab326a6a2fbddc44b7d83b663ee4b74abc253f3f63aa3eb18404d50c3018084569186ba1e6bfa94ed1c6a5dcda4326e6a4a1c40a9db55c4396a86e0e52385
-
Filesize
512KB
MD53d348190d58aee4afba658a6cd56e579
SHA1bdf3506e9bf3d2eba9801d2c11a9c221c9453a6b
SHA256fc9464a90f3a8874522411b0e1a1fe71508c8d4db6e0d2fa8adcbe0e96f8344c
SHA5126c2b4bb058fd254453ff49f5b7efbfcaeb7b3ad765108a31f760c8ee05401b8c7325168ce521450fb000f92db373063c16b2c3fbeab96671f6f489534df0fddf
-
Filesize
512KB
MD5c1359cb0faa69deb03c2db91ff776e52
SHA1e3c1e37f8c0beffc8068c12d18be32b400962f0f
SHA256b7d6f97229fcce87e03e3d37aa92caf15442324fc041be36eb106b6881a7392c
SHA51268fd498ebd674551340b4936603ab8cc4ea90b77f8b26046ca777039f86ad99f671fcb6ff35e89ed1c654d344f5dca3fd9dd0c6b8ef07e980bddbe665d214dc0
-
Filesize
512KB
MD5d2d360d243323f2ea8d5201848fd04db
SHA1a5186486f74b9f58d5ff71a040a824e4f5a2c668
SHA256ecb855dc282ea39916892ceed4c97bcc7f23dfeaa8728b29b1d84a5d4be2e1fc
SHA512ace7acddf2511ae504b64c4c1eafa7772b3db26f33101fe44562df855749f236698024e20b1bf7fee30138188472885101a9a6c9376200f968125cd9ab74d916
-
Filesize
512KB
MD516e2d747c54ce1b2f1637a295fcef5c9
SHA175ae9dfb25ef96c20a4cfde6f577109cb5bee0d3
SHA256b3d7bd00c76f07665e292e2c5bfd5b2ef2d324bd3ee865119918c5047a51a4ea
SHA512613ed675070619137b51cb775dcb8c88b3f344a514abd713668a8b79f6dd49075b0ade0b6158685c552e1ae4083de254702653708db69b8954fda6171dab7d5e
-
Filesize
512KB
MD562f5c8c09b404902f8d46e0a17f7ce9b
SHA1f4e89a70e650ca45be639cbe2501c80d4d282e4c
SHA256737ce1c77e94778bc39f3a9e23dba7b14371670f6809294293116709287c2717
SHA51291e43f52e6b77189c13e82381f8cb8dc94cbfc7d93b716e52ab2e1a0787006b743e7d3bccaed087ef10d4672ec225c2d3b847651a2d0070303944a9becf5b285
-
Filesize
512KB
MD5866a5d25c539a74ac2867a2a035f9725
SHA1122cf38e223e871068130863d917e64720777555
SHA25625e856765e30b21e5021865dfa1ecd9c6c152cad0f2d447adf79b63c1099a408
SHA5123d13ad7028e22f50d2d1faff7c990519216119d9c12ab274d1971b15d48111dc0ee38d13c1698b394be90eb5e486a24e5cffc7fea91b7624827649ab989bc4e1
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD594e3383726fd03522f5b6b9f9afa88f6
SHA17ead30f5fd0bc487c00cc2ec0eac01dbd9c96531
SHA256beedcfde6a24abf1a2506ec1ae8bc7667bf632f7ba415fe48dcca8156c77346d
SHA5128f6db9b8635957568c42f9b41be2f65fa1c47eebf119d792f38bf57482ed290f8153622f7d51746e743d3edaf3e54759b7c81732e9bd7a66934034c37962bae4
-
Filesize
512KB
MD5f0b35667a5914828f268b47699cf684f
SHA1290ba8a6fe86b46b06eaebb7e29fa38ee6bfc53b
SHA2561084aced654d4bf9ca4820dca87ea4520fd54cdd6fb487362625152b856a3ae1
SHA512513c7f29bc39c703660e9fa3ddddeb18e7921e0cf55c78541cfe663144e69e896ac0fa7a74634a8d34b1319f1e3fc30568de7c505ec05465c966fd8710c3eb08
-
Filesize
512KB
MD54d1993da99508519992f6fce15b743d3
SHA1bae37430af8b7c537fa6cf80a190f145497fbe73
SHA256e69f84c2a42dd8fd869cf9dcfd8053959c3131026f741fdc428281c55c0c5d13
SHA5125ec3e73ba769b529641fee6cb423d5b159ca9129fbf7288fd59f100ba693534a064608ff79e81a135182ffc6a102580a13a2e16d56179b2a0f24c58ac2b7d434