Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 01:32
Static task
static1
Behavioral task
behavioral1
Sample
88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe
-
Size
512KB
-
MD5
88fd17b1aa4a3e3b207fe2d4847ec4f5
-
SHA1
103089c5157c5c95726c36e132246ce5957b405d
-
SHA256
c9e9982543a468ec2505b213c1699f110fbce01333d3d0c8f3885f786d8f417e
-
SHA512
fce12722ce513dad14fecba2c69fbf85a632b66bba848fe64dd6e32577e3b84802f9378f05247bcc9bc049caee470049afc929d26c6e2eaa89ae3b0b195ce5fd
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hhhaumwtdb.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hhhaumwtdb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hhhaumwtdb.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hhhaumwtdb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 4592 hhhaumwtdb.exe 2548 mnuctxbcaotatla.exe 1920 erqfiowg.exe 3496 uzapoeyvhmyfp.exe 2392 erqfiowg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hhhaumwtdb.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bnfkskty = "hhhaumwtdb.exe" mnuctxbcaotatla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdpnwxkb = "mnuctxbcaotatla.exe" mnuctxbcaotatla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "uzapoeyvhmyfp.exe" mnuctxbcaotatla.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: hhhaumwtdb.exe File opened (read-only) \??\w: erqfiowg.exe File opened (read-only) \??\k: erqfiowg.exe File opened (read-only) \??\m: erqfiowg.exe File opened (read-only) \??\n: erqfiowg.exe File opened (read-only) \??\x: erqfiowg.exe File opened (read-only) \??\u: erqfiowg.exe File opened (read-only) \??\h: erqfiowg.exe File opened (read-only) \??\e: hhhaumwtdb.exe File opened (read-only) \??\h: hhhaumwtdb.exe File opened (read-only) \??\o: hhhaumwtdb.exe File opened (read-only) \??\v: hhhaumwtdb.exe File opened (read-only) \??\j: erqfiowg.exe File opened (read-only) \??\p: erqfiowg.exe File opened (read-only) \??\q: erqfiowg.exe File opened (read-only) \??\v: erqfiowg.exe File opened (read-only) \??\b: hhhaumwtdb.exe File opened (read-only) \??\m: hhhaumwtdb.exe File opened (read-only) \??\k: erqfiowg.exe File opened (read-only) \??\o: erqfiowg.exe File opened (read-only) \??\s: erqfiowg.exe File opened (read-only) \??\o: erqfiowg.exe File opened (read-only) \??\t: erqfiowg.exe File opened (read-only) \??\z: erqfiowg.exe File opened (read-only) \??\b: erqfiowg.exe File opened (read-only) \??\y: erqfiowg.exe File opened (read-only) \??\e: erqfiowg.exe File opened (read-only) \??\g: erqfiowg.exe File opened (read-only) \??\l: erqfiowg.exe File opened (read-only) \??\r: erqfiowg.exe File opened (read-only) \??\u: erqfiowg.exe File opened (read-only) \??\l: hhhaumwtdb.exe File opened (read-only) \??\r: hhhaumwtdb.exe File opened (read-only) \??\t: hhhaumwtdb.exe File opened (read-only) \??\u: hhhaumwtdb.exe File opened (read-only) \??\n: erqfiowg.exe File opened (read-only) \??\z: erqfiowg.exe File opened (read-only) \??\i: erqfiowg.exe File opened (read-only) \??\w: erqfiowg.exe File opened (read-only) \??\a: erqfiowg.exe File opened (read-only) \??\e: erqfiowg.exe File opened (read-only) \??\a: erqfiowg.exe File opened (read-only) \??\p: erqfiowg.exe File opened (read-only) \??\v: erqfiowg.exe File opened (read-only) \??\j: erqfiowg.exe File opened (read-only) \??\g: hhhaumwtdb.exe File opened (read-only) \??\k: hhhaumwtdb.exe File opened (read-only) \??\q: hhhaumwtdb.exe File opened (read-only) \??\t: erqfiowg.exe File opened (read-only) \??\i: erqfiowg.exe File opened (read-only) \??\x: erqfiowg.exe File opened (read-only) \??\a: hhhaumwtdb.exe File opened (read-only) \??\i: hhhaumwtdb.exe File opened (read-only) \??\s: hhhaumwtdb.exe File opened (read-only) \??\w: hhhaumwtdb.exe File opened (read-only) \??\y: erqfiowg.exe File opened (read-only) \??\x: hhhaumwtdb.exe File opened (read-only) \??\b: erqfiowg.exe File opened (read-only) \??\s: erqfiowg.exe File opened (read-only) \??\r: erqfiowg.exe File opened (read-only) \??\j: hhhaumwtdb.exe File opened (read-only) \??\z: hhhaumwtdb.exe File opened (read-only) \??\g: erqfiowg.exe File opened (read-only) \??\y: hhhaumwtdb.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" hhhaumwtdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" hhhaumwtdb.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4664-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000700000002360e-5.dat autoit_exe behavioral2/files/0x0009000000023607-18.dat autoit_exe behavioral2/files/0x000700000002360f-26.dat autoit_exe behavioral2/files/0x0007000000023610-31.dat autoit_exe behavioral2/files/0x000800000002342f-73.dat autoit_exe behavioral2/files/0x0009000000023303-79.dat autoit_exe behavioral2/files/0x0006000000022975-547.dat autoit_exe behavioral2/files/0x0006000000022975-570.dat autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\hhhaumwtdb.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hhhaumwtdb.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File created C:\Windows\SysWOW64\mnuctxbcaotatla.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mnuctxbcaotatla.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll hhhaumwtdb.exe File created C:\Windows\SysWOW64\erqfiowg.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\erqfiowg.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File created C:\Windows\SysWOW64\uzapoeyvhmyfp.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\uzapoeyvhmyfp.exe 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe erqfiowg.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal erqfiowg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe erqfiowg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal erqfiowg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe erqfiowg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe erqfiowg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe erqfiowg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe erqfiowg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe erqfiowg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal erqfiowg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe erqfiowg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal erqfiowg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe erqfiowg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe erqfiowg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe erqfiowg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe erqfiowg.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe erqfiowg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe erqfiowg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe erqfiowg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification C:\Windows\mydoc.rtf 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe erqfiowg.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe erqfiowg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe erqfiowg.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe erqfiowg.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe erqfiowg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C0B9C2183276D4276DD77212DDA7DF364DB" 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB8FABAFE13F1E384743A3286993992B08E02FB42130338E2CA42EC08D2" 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat hhhaumwtdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf hhhaumwtdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" hhhaumwtdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF4FC8D4858826A9137D75B7E9CBC92E143594A664E6341D6EB" 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F36BC2FE1D21AAD173D0A58B7D9063" 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" hhhaumwtdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh hhhaumwtdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" hhhaumwtdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" hhhaumwtdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs hhhaumwtdb.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B02844EF399D53BEBADD3392D7BE" 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC67514E2DAB5B9BA7F95ED9534CB" 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc hhhaumwtdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" hhhaumwtdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg hhhaumwtdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" hhhaumwtdb.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 536 WINWORD.EXE 536 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2392 erqfiowg.exe 2392 erqfiowg.exe 2392 erqfiowg.exe 2392 erqfiowg.exe 2392 erqfiowg.exe 2392 erqfiowg.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 2392 erqfiowg.exe 2392 erqfiowg.exe 2392 erqfiowg.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 4592 hhhaumwtdb.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 2548 mnuctxbcaotatla.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 1920 erqfiowg.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 3496 uzapoeyvhmyfp.exe 2392 erqfiowg.exe 2392 erqfiowg.exe 2392 erqfiowg.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 536 WINWORD.EXE 536 WINWORD.EXE 536 WINWORD.EXE 536 WINWORD.EXE 536 WINWORD.EXE 536 WINWORD.EXE 536 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4664 wrote to memory of 4592 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 90 PID 4664 wrote to memory of 4592 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 90 PID 4664 wrote to memory of 4592 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 90 PID 4664 wrote to memory of 2548 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 91 PID 4664 wrote to memory of 2548 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 91 PID 4664 wrote to memory of 2548 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 91 PID 4664 wrote to memory of 1920 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 92 PID 4664 wrote to memory of 1920 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 92 PID 4664 wrote to memory of 1920 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 92 PID 4664 wrote to memory of 3496 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 93 PID 4664 wrote to memory of 3496 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 93 PID 4664 wrote to memory of 3496 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 93 PID 4664 wrote to memory of 536 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 94 PID 4664 wrote to memory of 536 4664 88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe 94 PID 4592 wrote to memory of 2392 4592 hhhaumwtdb.exe 96 PID 4592 wrote to memory of 2392 4592 hhhaumwtdb.exe 96 PID 4592 wrote to memory of 2392 4592 hhhaumwtdb.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88fd17b1aa4a3e3b207fe2d4847ec4f5_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\hhhaumwtdb.exehhhaumwtdb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\erqfiowg.exeC:\Windows\system32\erqfiowg.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2392
-
-
-
C:\Windows\SysWOW64\mnuctxbcaotatla.exemnuctxbcaotatla.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548
-
-
C:\Windows\SysWOW64\erqfiowg.exeerqfiowg.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920
-
-
C:\Windows\SysWOW64\uzapoeyvhmyfp.exeuzapoeyvhmyfp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3496
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4064,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:81⤵PID:1600
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5819b45ad7b46f60f8580a878edde7bb4
SHA18d88eef365c3209d24288d15397b9d8d2c56d7d9
SHA25628097d9311647e00220344e10a895d46f29cd7ac76d81de35b5b901ed4ad9ffd
SHA5125db6031dea1bb4450bcb3275bc228b3e548aba3932a4093e5e02df5373f44afaf868442896f545ab53c07294dc25f0c00df89e8a5d23d00852b28e748ead901b
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
239B
MD52fae0fe44fb67ed515b21a2b6fba40e3
SHA1d39c4cb134c596851c157406149129a69844613b
SHA256bd528b67c4e7b5924426cb6edc6bd85896db3a43e596bc76d32632d33eccc2b1
SHA5129902e514810847d11b83ceb64209c7a363f3b482f5444474673988fa0729295d8612ae6aa0d81a09d9adeb958f7e0251b414ef808f82f279df504bc04a347087
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5bb988cb17933f3df72cfa125182f90f6
SHA1889afeaa295f22fe35404e31e8e2dfb906543d3f
SHA256326245426c4cb7dac6fb0bf9937767a04a84b2d309f096036b16bac8f006f0cd
SHA51266a116d9d540782f5995d4961733f029496c44973f796c74a27ef19dc009392aa70d3e212a04e02cea5e1da0db40344a5126b8fda051d36a8d5e44e7aa4a5d00
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD53fb3e8b21d35e09d8685d8bf1d48cb84
SHA110b95af7e4b49b5b927bc7761ddbad8f637f4c59
SHA25602f50ffabae6d30dab3eda5e8914a8feae23d2f3c9465879f481d3144567c3aa
SHA512d220f08ba2912c5372c565c278714e9c1a1a81a79aca712afad21aaaeaed6f0dc213a59a62e563e53b64b684c6b9da69b91379511f8efb488af372aecb571af0
-
Filesize
512KB
MD5f252addd0b32125e481a183a01885e43
SHA1320c6fad5c9c9f06f6e528ff0c76634f865c9106
SHA256a28595a9f58bfa16b2b14658dbbb0b0d222ca442d3bdc4ba2da70152e1299a15
SHA512f7539b20b65369c08b244b9f2a40a2f8e21a26e50931e72a6d18bc905bc3b9c223f1a78c24901ef9376f5513bcf4ce3f35f5d642403fd7d341551ec301df2cba
-
Filesize
512KB
MD5e712c54a32c9cac50f64f0d946f73280
SHA1521b70ef02c2893510d1e3259c8df79985d48563
SHA256f05d2802046a67abf746f62a6e5fc71771444fab6c91b2fd6daef1e79f5f0e1e
SHA51226dcf450fc7e5e5c96ae197509b0a2de2f2c3364525d96403b8439a3b1c13b37e9081171399795520f227aa364fd707ffcc9013692ec05d3f5e386e9d1e3d2fb
-
Filesize
512KB
MD583e2a706612210148a04ab2e6b68d247
SHA1ad5af9d48ad6a474d44ee60973374aac49fad604
SHA256c254e14109529de0e7699d25dfec774a91a256373ea3307b79b1cd3c5b73dfbb
SHA51232db70d0e3e01a5986db14bd5d74e801ad1014869e84edfa4c851bfbdd5bbc3797eeb6231b2328986f26e6134d6a27b5dfb3154659829ce4e26bedd95ecb1096
-
Filesize
512KB
MD5d81b3d0287e363e3f6bc1fba63d96013
SHA1a48cefc58699451cde847b912906a5b44e86a300
SHA2568e909955fb3e0d5d7ccb7e369b6cc555704978db87fcc6de0a99b86d85d006ae
SHA5126f14fd570f0389c08f1eb7db93e442a5e645833b7f901d2967e30eedcb5f3aa2bd99b7e3d42bb7a98b96b10cc54e9f41ac29958713123dd9512012f1cda7a404
-
Filesize
512KB
MD5e58ae6fdc94df36ed2249a15aa990773
SHA19817caac4cf93a171e1ebb0eff90e856f74a936e
SHA2565a2ae94aa931f4b8204c9e1a9274de3fa98539e6cc7e257d51174d0f91078f6f
SHA51200460ed0f71d5bb2c3fc492a66f37ffa5746aea113dec761501d638876e5e5800a6800567032e8b06d33b286da19c7d4d643ffe863579cb93efad6135e0dc1d4
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5f0a4adc49d1d61382d1b956c95241ade
SHA1fbbb1abeee669362666a1730f139cdffdba912af
SHA256cfa38d0aa074e3e12859116d8931e89fc5097ee989ded11e6c094c7a1fa4be14
SHA512f2095ac2ca668829199a93dc1b5eec2163b571361dfe4643931948930fa675a0199345d44afef3da4f3f1992fe58f6c478c3969b56914f53c892623de75d4434
-
Filesize
512KB
MD53be444781049a43b5cc253c57d94a9a9
SHA1dae2d69dfd3a0d7a3f77b2b1001a303eb00ee1b6
SHA25641cf1a0f564e58f8b67eca85b8f8f1405345805191ed1c75b4fd7c58ddd3949c
SHA5127fc73d14140ec3aef965a0999efbc055af30459c8f5804734a24b4b7738fd3aed8a9818122b646682175f92abe20f3ad2e57911a951f1fd1d66b4958d7dded67