Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 12:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe
- Size 512KB
- Sample240530-psep2sha3s
- SHA256 846b3b358f2a30e60568fb992305c65e7839470d1e521f08a2810a90819f40ff
- MD5 842f1e5ce5d86f2d884c367ab969788d
- SHA1 1b43250c18c670b7a1f566ea76571624649a56b2
- SHA512 f5e0de23ea7dc4ee311da2738dab717384bfd47ac32e5b0ce8648b9f966d41e98cb026aec0fe1fdecd22b6fbbfb6e653988af63a476886bb976ba6cb69f562f4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jwfnfqoamp.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jwfnfqoamp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jwfnfqoamp.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jwfnfqoamp.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1420 jwfnfqoamp.exe 2792 mtkhwhas.exe 4952 ewrnbzlpxsqxkiz.exe 552 tsqcdlgytsvxl.exe 3536 mtkhwhas.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" jwfnfqoamp.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bbdciasy = "jwfnfqoamp.exe" ewrnbzlpxsqxkiz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kikddodx = "ewrnbzlpxsqxkiz.exe" ewrnbzlpxsqxkiz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tsqcdlgytsvxl.exe" ewrnbzlpxsqxkiz.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: mtkhwhas.exe File opened (read-only) \??\j: mtkhwhas.exe File opened (read-only) \??\z: jwfnfqoamp.exe File opened (read-only) \??\l: mtkhwhas.exe File opened (read-only) \??\t: mtkhwhas.exe File opened (read-only) \??\l: mtkhwhas.exe File opened (read-only) \??\r: mtkhwhas.exe File opened (read-only) \??\n: jwfnfqoamp.exe File opened (read-only) \??\g: mtkhwhas.exe File opened (read-only) \??\w: jwfnfqoamp.exe File opened (read-only) \??\k: mtkhwhas.exe File opened (read-only) \??\m: mtkhwhas.exe File opened (read-only) \??\o: jwfnfqoamp.exe File opened (read-only) \??\b: mtkhwhas.exe File opened (read-only) \??\e: jwfnfqoamp.exe File opened (read-only) \??\s: jwfnfqoamp.exe File opened (read-only) \??\y: jwfnfqoamp.exe File opened (read-only) \??\h: mtkhwhas.exe File opened (read-only) \??\q: mtkhwhas.exe File opened (read-only) \??\u: mtkhwhas.exe File opened (read-only) \??\u: jwfnfqoamp.exe File opened (read-only) \??\j: jwfnfqoamp.exe File opened (read-only) \??\p: jwfnfqoamp.exe File opened (read-only) \??\g: mtkhwhas.exe File opened (read-only) \??\r: mtkhwhas.exe File opened (read-only) \??\v: mtkhwhas.exe File opened (read-only) \??\o: mtkhwhas.exe File opened (read-only) \??\s: mtkhwhas.exe File opened (read-only) \??\y: mtkhwhas.exe File opened (read-only) \??\p: mtkhwhas.exe File opened (read-only) \??\w: mtkhwhas.exe File opened (read-only) \??\n: mtkhwhas.exe File opened (read-only) \??\a: jwfnfqoamp.exe File opened (read-only) \??\h: mtkhwhas.exe File opened (read-only) \??\l: jwfnfqoamp.exe File opened (read-only) \??\m: jwfnfqoamp.exe File opened (read-only) \??\r: jwfnfqoamp.exe File opened (read-only) \??\a: mtkhwhas.exe File opened (read-only) \??\w: mtkhwhas.exe File opened (read-only) \??\b: jwfnfqoamp.exe File opened (read-only) \??\v: jwfnfqoamp.exe File opened (read-only) \??\p: mtkhwhas.exe File opened (read-only) \??\h: jwfnfqoamp.exe File opened (read-only) \??\i: jwfnfqoamp.exe File opened (read-only) \??\b: mtkhwhas.exe File opened (read-only) \??\v: mtkhwhas.exe File opened (read-only) \??\n: mtkhwhas.exe File opened (read-only) \??\t: jwfnfqoamp.exe File opened (read-only) \??\x: jwfnfqoamp.exe File opened (read-only) \??\i: mtkhwhas.exe File opened (read-only) \??\q: mtkhwhas.exe File opened (read-only) \??\u: mtkhwhas.exe File opened (read-only) \??\i: mtkhwhas.exe File opened (read-only) \??\t: mtkhwhas.exe File opened (read-only) \??\q: jwfnfqoamp.exe File opened (read-only) \??\y: mtkhwhas.exe File opened (read-only) \??\j: mtkhwhas.exe File opened (read-only) \??\z: mtkhwhas.exe File opened (read-only) \??\e: mtkhwhas.exe File opened (read-only) \??\k: mtkhwhas.exe File opened (read-only) \??\s: mtkhwhas.exe File opened (read-only) \??\x: mtkhwhas.exe File opened (read-only) \??\x: mtkhwhas.exe File opened (read-only) \??\k: jwfnfqoamp.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" jwfnfqoamp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" jwfnfqoamp.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233ee-5.dat autoit_exe behavioral2/files/0x00080000000233ea-18.dat autoit_exe behavioral2/files/0x00070000000233ef-23.dat autoit_exe behavioral2/files/0x00070000000233f0-31.dat autoit_exe behavioral2/files/0x00090000000233cf-66.dat autoit_exe behavioral2/files/0x00070000000233fc-69.dat autoit_exe behavioral2/files/0x000700000002341b-91.dat autoit_exe behavioral2/files/0x000700000002341b-519.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mtkhwhas.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification C:\Windows\SysWOW64\jwfnfqoamp.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ewrnbzlpxsqxkiz.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File created C:\Windows\SysWOW64\tsqcdlgytsvxl.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mtkhwhas.exe File created C:\Windows\SysWOW64\jwfnfqoamp.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tsqcdlgytsvxl.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll jwfnfqoamp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mtkhwhas.exe File created C:\Windows\SysWOW64\ewrnbzlpxsqxkiz.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File created C:\Windows\SysWOW64\mtkhwhas.exe 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mtkhwhas.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mtkhwhas.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mtkhwhas.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mtkhwhas.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mtkhwhas.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mtkhwhas.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mtkhwhas.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mtkhwhas.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mtkhwhas.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mtkhwhas.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mtkhwhas.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mtkhwhas.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mtkhwhas.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mtkhwhas.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mtkhwhas.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mtkhwhas.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mtkhwhas.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mtkhwhas.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mtkhwhas.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mtkhwhas.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mtkhwhas.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification C:\Windows\mydoc.rtf 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mtkhwhas.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mtkhwhas.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe mtkhwhas.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mtkhwhas.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe mtkhwhas.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACFF9CAFE16F197830B3A4B86973E91B3FE038C42690248E1C542E909A0" 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" jwfnfqoamp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" jwfnfqoamp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg jwfnfqoamp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC6781596DABFB8C07C90EDE537BA" 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" jwfnfqoamp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf jwfnfqoamp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" jwfnfqoamp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" jwfnfqoamp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302D7F9C5683516A4377D170522CDF7D8365D9" 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B02E47E539EA52C9BAA132EDD4C5" 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FCFF4F588512913CD72B7D92BCE4E636584466416236D798" 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh jwfnfqoamp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs jwfnfqoamp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F36BB7FE1B21DBD279D0D68B7A9063" 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat jwfnfqoamp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc jwfnfqoamp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" jwfnfqoamp.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3248 WINWORD.EXE 3248 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 1420 jwfnfqoamp.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 1420 jwfnfqoamp.exe 2792 mtkhwhas.exe 1420 jwfnfqoamp.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 1420 jwfnfqoamp.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 1420 jwfnfqoamp.exe 2792 mtkhwhas.exe 1420 jwfnfqoamp.exe 2792 mtkhwhas.exe 2792 mtkhwhas.exe 1420 jwfnfqoamp.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 4952 ewrnbzlpxsqxkiz.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 552 tsqcdlgytsvxl.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe 3536 mtkhwhas.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3248 WINWORD.EXE 3248 WINWORD.EXE 3248 WINWORD.EXE 3248 WINWORD.EXE 3248 WINWORD.EXE 3248 WINWORD.EXE 3248 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4928 wrote to memory of 1420 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 83 PID 4928 wrote to memory of 1420 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 83 PID 4928 wrote to memory of 1420 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 83 PID 4928 wrote to memory of 4952 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 84 PID 4928 wrote to memory of 4952 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 84 PID 4928 wrote to memory of 4952 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 84 PID 4928 wrote to memory of 2792 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 85 PID 4928 wrote to memory of 2792 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 85 PID 4928 wrote to memory of 2792 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 85 PID 4928 wrote to memory of 552 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 86 PID 4928 wrote to memory of 552 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 86 PID 4928 wrote to memory of 552 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 86 PID 4928 wrote to memory of 3248 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 87 PID 4928 wrote to memory of 3248 4928 842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe 87 PID 1420 wrote to memory of 3536 1420 jwfnfqoamp.exe 89 PID 1420 wrote to memory of 3536 1420 jwfnfqoamp.exe 89 PID 1420 wrote to memory of 3536 1420 jwfnfqoamp.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\842f1e5ce5d86f2d884c367ab969788d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\jwfnfqoamp.exejwfnfqoamp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\mtkhwhas.exeC:\Windows\system32\mtkhwhas.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3536
-
-
-
C:\Windows\SysWOW64\ewrnbzlpxsqxkiz.exeewrnbzlpxsqxkiz.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4952
-
-
C:\Windows\SysWOW64\mtkhwhas.exemtkhwhas.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2792
-
-
C:\Windows\SysWOW64\tsqcdlgytsvxl.exetsqcdlgytsvxl.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:552
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3248
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 1a1d9c8eb22e5d195f2665161d170df51a11e8773a96cb11a25d0642f076d72a
- MD5 9e8cb80c38648dc7d23e0cc9711bf130
- SHA1 8235d220d600672684d7d42151eada0cc048323a
- SHA512 ec3e9754826e0a6234a8b7aa6d994cc6e4543b17bf9536564a254fbe29dae548dc7dd5f2f9072bf4ffa9e7dd331394b8d69cc1f32a5d439fb0abac4cc59bbfa2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 596069f7c5d4c9cea8266af60fcc730fbaec42eb5dd0c6f4203e463b742fb598
- MD5 602dad6ee0e60cde6698692534ef100b
- SHA1 c3e20be4cf62746964ff865964f4f354d412bfac
- SHA512 bc1fdcc479d9d46977847557985ca1744f1d4f135da27d82dd2f131419c16fbc70968eb27458a1769e59a9a166847be39aa81b82936e39e753d578ee13df8669
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 76b51f2a4b6d376b285b43d40a48080d8af669fbbc4e595565085bfcd3c8f5c9
- MD5 28f763b3625f91b1570a92114d2de381
- SHA1 41a0473b00e806bc019d878f16506f08c283fcce
- SHA512 629d3152c14a1de686bdef1f1f414ba96b4715e2339740ae34e9d88ff084e978c53b86a40c420fcf317c3e8d347fbd8798f12277d2c0180d6b48756fd310b515
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 4a50e0ea20fab2d6565d3a8025abb8a63932e59a0a252981ac1adeaaab98756b
- MD5 ba3ed8f383a6579924c3d4d2bafeb37f
- SHA1 6006cbd0287475c169cbed42e456532ca0337d0e
- SHA512 45307b8578cba22d1ae850c5f44685814c75fdfe81e9ad7cab2f25cc0b0280301e5420949d52c96184595cd9ad0ab4e75464ca7530efd9a6fb2044344f277093
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\ewrnbzlpxsqxkiz.exe
- Size 512KB
- SHA256 ccf6d3748ad63979cb155890e7fd217463a578decb360143cb7280d18f6e1e78
- MD5 1525c519a6a7cdb8f22f9349bc46df07
- SHA1 8e676bbb4052971c08cda3d2aa360caefb60b771
- SHA512 8b6b8aa0802ec2a94eac531f7e3ba9dcae7836ff04fe403a64ad825346528ab7f11fde1b0c0781ab6c91f91a1285b28943fa04c1d90c0005660accd3ae1fbd2a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jwfnfqoamp.exe
- Size 512KB
- SHA256 23bd4d9a0c01a0ec8314c0290bd0c5935839c2343b4559bfdccde9f04c16dfa3
- MD5 4dcf5694d5876bec5d5fb37a76f986cf
- SHA1 5cb74d163e367c1ec344a032251d8b533a42cbb3
- SHA512 47cddee744395cefd0ebf8d9f81e3d16e9cf0c869fafba3e08debe69c8f7d8af93754080e7da36dbc14b7fade3618b3f054bc2e49f6cccbccc3bc3e1e1244fc2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mtkhwhas.exe
- Size 512KB
- SHA256 4f9d41bff97d274f704197824b04430d504462efd9086fdff8ae2c6d93819845
- MD5 26f0e8028c4cb0e968596d4da71b06f9
- SHA1 aecc1fb5719686cf1194a30ecee4397c3e81ec53
- SHA512 4d20a2d3080e06600afcdb7e819e5938a4b5ca6ab146719414cb49517b5637fc183b74096911851e7f0965c258e3ebcecf49b6daeb9c540f799532a1463f505b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tsqcdlgytsvxl.exe
- Size 512KB
- SHA256 866de1a3e777b41c3a6a47105fc16c16a69b91f859b48b128018609b47442e75
- MD5 98e1f72c67695c2a8bfaf5f8ef4671ab
- SHA1 d54a91115d79d54263648b6255f64ef2ebbb1221
- SHA512 147b951a493e5645cbda4402f0d20ea6cf250f5cbcdb35c9d38368d63f5544cb1e3896b257939068e90ebfeeb37866c9d2317b00b40862d47a3c8bca0342428e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 284009232e1c36067dda2ab5e6be4018f85b4c098eb1283250e417e62fde9729
- MD5 dd6ee1054c2e06b2a41a16455a530abc
- SHA1 c74ca07b58b4e6a0e107338b4230f69577cd6e37
- SHA512 912f71606dca5dce958c89582f134021d5ec05edb1417556c0693ea0e7425b21e011f14fc0e5b11c6dd28ea7b260d02525fc6214367eddcc82073d965a24f898
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 e1c4368170a5f13bdd9a1cd621b819c2f16c44a0a3bf25fce53d418f30c8d197
- MD5 e01df607c2162f85a3a56075d7c265ee
- SHA1 9fc32db6b4c5fccec2a7bab185b7b48488775ebb
- SHA512 8bf3e271fa03dd7bc01e3190e0f27a235f7ba1279b8449b7617f6793e7f7488318b92eceab411963b54b6c3da1307d7a8480a41e0b027812615637637ef25d53
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 fc9c48ec832c7aec5426ff23398f3a9251d3169a2f4c295456baf38840290c3b
- MD5 b4c463247c1b8de970b9570168f89144
- SHA1 7920dca8df9622482f12d7fdff7801d18613ee73
- SHA512 8048966e0360386900e399fb96cebfd3198092c43b3ef6c0234732d163c25888ff673e5b43da402c22bfafc0149623e7dcf5a13ee03d985006ec5fd117c98d16
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP