Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 02:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe
- Size 512KB
- Sample240601-cf5dqaeg62
- SHA256 fa218202807a01308bf6c30aecbe4d74906db5e040860e6bffb6603abd2b678b
- MD5 890fff1575ed4f5bf0b19744d84a29c2
- SHA1 48664983377ab7c83acc65f2f4219c32e487121b
- SHA512 bad18799feab8d70c16cd82018c9cb6c2e5b8f7e648cce9746389fe4e38949642ab578dc19a40e46e18a254c2f663619f5e137f3ca88585bfa91eab2f3c819e3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hzwptwntuk.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hzwptwntuk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hzwptwntuk.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hzwptwntuk.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1944 hzwptwntuk.exe 4484 ryuhkqqoajtsujt.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 3092 eutuzqom.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hzwptwntuk.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxpyoamg = "hzwptwntuk.exe" ryuhkqqoajtsujt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jqbzkdbc = "ryuhkqqoajtsujt.exe" ryuhkqqoajtsujt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ycasbvshazjsm.exe" ryuhkqqoajtsujt.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: eutuzqom.exe File opened (read-only) \??\b: eutuzqom.exe File opened (read-only) \??\k: eutuzqom.exe File opened (read-only) \??\r: eutuzqom.exe File opened (read-only) \??\z: eutuzqom.exe File opened (read-only) \??\g: eutuzqom.exe File opened (read-only) \??\z: eutuzqom.exe File opened (read-only) \??\l: eutuzqom.exe File opened (read-only) \??\t: eutuzqom.exe File opened (read-only) \??\j: hzwptwntuk.exe File opened (read-only) \??\w: hzwptwntuk.exe File opened (read-only) \??\e: eutuzqom.exe File opened (read-only) \??\v: eutuzqom.exe File opened (read-only) \??\m: eutuzqom.exe File opened (read-only) \??\q: eutuzqom.exe File opened (read-only) \??\e: hzwptwntuk.exe File opened (read-only) \??\m: hzwptwntuk.exe File opened (read-only) \??\z: hzwptwntuk.exe File opened (read-only) \??\h: eutuzqom.exe File opened (read-only) \??\n: eutuzqom.exe File opened (read-only) \??\j: eutuzqom.exe File opened (read-only) \??\u: hzwptwntuk.exe File opened (read-only) \??\a: eutuzqom.exe File opened (read-only) \??\o: eutuzqom.exe File opened (read-only) \??\r: eutuzqom.exe File opened (read-only) \??\y: eutuzqom.exe File opened (read-only) \??\i: hzwptwntuk.exe File opened (read-only) \??\q: hzwptwntuk.exe File opened (read-only) \??\v: hzwptwntuk.exe File opened (read-only) \??\b: eutuzqom.exe File opened (read-only) \??\u: eutuzqom.exe File opened (read-only) \??\q: eutuzqom.exe File opened (read-only) \??\g: eutuzqom.exe File opened (read-only) \??\i: eutuzqom.exe File opened (read-only) \??\p: eutuzqom.exe File opened (read-only) \??\s: eutuzqom.exe File opened (read-only) \??\b: hzwptwntuk.exe File opened (read-only) \??\k: hzwptwntuk.exe File opened (read-only) \??\p: eutuzqom.exe File opened (read-only) \??\v: eutuzqom.exe File opened (read-only) \??\y: eutuzqom.exe File opened (read-only) \??\a: hzwptwntuk.exe File opened (read-only) \??\m: eutuzqom.exe File opened (read-only) \??\w: eutuzqom.exe File opened (read-only) \??\x: eutuzqom.exe File opened (read-only) \??\n: hzwptwntuk.exe File opened (read-only) \??\i: eutuzqom.exe File opened (read-only) \??\x: eutuzqom.exe File opened (read-only) \??\o: eutuzqom.exe File opened (read-only) \??\u: eutuzqom.exe File opened (read-only) \??\g: hzwptwntuk.exe File opened (read-only) \??\o: hzwptwntuk.exe File opened (read-only) \??\x: hzwptwntuk.exe File opened (read-only) \??\n: eutuzqom.exe File opened (read-only) \??\e: eutuzqom.exe File opened (read-only) \??\h: hzwptwntuk.exe File opened (read-only) \??\w: eutuzqom.exe File opened (read-only) \??\l: hzwptwntuk.exe File opened (read-only) \??\r: hzwptwntuk.exe File opened (read-only) \??\t: hzwptwntuk.exe File opened (read-only) \??\h: eutuzqom.exe File opened (read-only) \??\p: hzwptwntuk.exe File opened (read-only) \??\k: eutuzqom.exe File opened (read-only) \??\s: eutuzqom.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" hzwptwntuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" hzwptwntuk.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1020-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233c8-5.dat autoit_exe behavioral2/files/0x00080000000233c4-18.dat autoit_exe behavioral2/files/0x00070000000233ca-29.dat autoit_exe behavioral2/files/0x00070000000233c9-28.dat autoit_exe behavioral2/files/0x00080000000233b4-66.dat autoit_exe behavioral2/files/0x00070000000233d6-72.dat autoit_exe behavioral2/files/0x002000000002342d-567.dat autoit_exe behavioral2/files/0x002000000002342d-572.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\ryuhkqqoajtsujt.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eutuzqom.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\ycasbvshazjsm.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll hzwptwntuk.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe eutuzqom.exe File created C:\Windows\SysWOW64\hzwptwntuk.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hzwptwntuk.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ryuhkqqoajtsujt.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\eutuzqom.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ycasbvshazjsm.exe 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe eutuzqom.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal eutuzqom.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eutuzqom.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eutuzqom.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal eutuzqom.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eutuzqom.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eutuzqom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal eutuzqom.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eutuzqom.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eutuzqom.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eutuzqom.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eutuzqom.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eutuzqom.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe eutuzqom.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe eutuzqom.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe eutuzqom.exe File opened for modification C:\Windows\mydoc.rtf 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B02F4495389852C4B9D3329AD7CB" 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F068C4FF1F22D1D27FD0D68A749114" 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat hzwptwntuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" hzwptwntuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCEF9BDFE13F191837B3A40819A39E5B08E02FE4213023AE2CB42EA09D5" 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh hzwptwntuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322D0D9D5582246D4177D770512DDA7CF464AD" 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC70915E0DBB1B8CF7CE0EDE734CA" 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" hzwptwntuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf hzwptwntuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" hzwptwntuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF8FFFF485882129141D6217E96BDE5E133583667366246D799" 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" hzwptwntuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc hzwptwntuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" hzwptwntuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" hzwptwntuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs hzwptwntuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg hzwptwntuk.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1468 WINWORD.EXE 1468 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 1944 hzwptwntuk.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 1396 ycasbvshazjsm.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 4572 eutuzqom.exe 4572 eutuzqom.exe 4572 eutuzqom.exe 4572 eutuzqom.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 4572 eutuzqom.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 1396 ycasbvshazjsm.exe 4484 ryuhkqqoajtsujt.exe 4484 ryuhkqqoajtsujt.exe 3092 eutuzqom.exe 3092 eutuzqom.exe 3092 eutuzqom.exe 3092 eutuzqom.exe 3092 eutuzqom.exe 3092 eutuzqom.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 4484 ryuhkqqoajtsujt.exe 1944 hzwptwntuk.exe 4484 ryuhkqqoajtsujt.exe 1944 hzwptwntuk.exe 4484 ryuhkqqoajtsujt.exe 1944 hzwptwntuk.exe 1396 ycasbvshazjsm.exe 4572 eutuzqom.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 3092 eutuzqom.exe 3092 eutuzqom.exe 3092 eutuzqom.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 4484 ryuhkqqoajtsujt.exe 1944 hzwptwntuk.exe 4484 ryuhkqqoajtsujt.exe 1944 hzwptwntuk.exe 4484 ryuhkqqoajtsujt.exe 1944 hzwptwntuk.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 4572 eutuzqom.exe 1396 ycasbvshazjsm.exe 3092 eutuzqom.exe 3092 eutuzqom.exe 3092 eutuzqom.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1468 WINWORD.EXE 1468 WINWORD.EXE 1468 WINWORD.EXE 1468 WINWORD.EXE 1468 WINWORD.EXE 1468 WINWORD.EXE 1468 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1020 wrote to memory of 1944 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 82 PID 1020 wrote to memory of 1944 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 82 PID 1020 wrote to memory of 1944 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 82 PID 1020 wrote to memory of 4484 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 83 PID 1020 wrote to memory of 4484 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 83 PID 1020 wrote to memory of 4484 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 83 PID 1020 wrote to memory of 4572 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 84 PID 1020 wrote to memory of 4572 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 84 PID 1020 wrote to memory of 4572 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 84 PID 1020 wrote to memory of 1396 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 85 PID 1020 wrote to memory of 1396 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 85 PID 1020 wrote to memory of 1396 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 85 PID 1020 wrote to memory of 1468 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 86 PID 1020 wrote to memory of 1468 1020 890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe 86 PID 1944 wrote to memory of 3092 1944 hzwptwntuk.exe 88 PID 1944 wrote to memory of 3092 1944 hzwptwntuk.exe 88 PID 1944 wrote to memory of 3092 1944 hzwptwntuk.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\890fff1575ed4f5bf0b19744d84a29c2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\hzwptwntuk.exehzwptwntuk.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\eutuzqom.exeC:\Windows\system32\eutuzqom.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3092
-
-
-
C:\Windows\SysWOW64\ryuhkqqoajtsujt.exeryuhkqqoajtsujt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4484
-
-
C:\Windows\SysWOW64\eutuzqom.exeeutuzqom.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4572
-
-
C:\Windows\SysWOW64\ycasbvshazjsm.exeycasbvshazjsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1396
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1468
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 ad9d1c7de530cb1670627403895c902daa9ed595df26fdc4d631720dd7260bda
- MD5 9fac632beeb5f543379cb557c7e5187b
- SHA1 56143df10d0d11f476af2debe2188563a19319a3
- SHA512 57038b8ffc6bd811e7f6e08fe990a2d1f2d6f928beafeeb78d01da1d8ee8feb1a50342e5917fd17cc049dc9388336995282ed6033e4ab6a7609df735312a7589
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 244fd6b9fdf4c2cf7dde1ae49850e4781ba2bf7fbd875a64ab1a319f82cc31d9
- MD5 7c93c24efa936321b723fc0745a3cbcd
- SHA1 46f4469392a047dc83c21c2f827395f5ba9ae40c
- SHA512 f39c82f0957e3079af4fefe3d6e71fd5084a1b8315064857a4e27d85a6901fbfc72c1054f85810353dfc4cdb03caadc9afcb8d3073fb74ee186ee201b82a03e9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD90C5.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 44c78d03ad93e555cae2a177c75b25fb74cde8ed89ff65b46f06ca356350f4ea
- MD5 575cc1cc52c076fd8e103fd014deb36a
- SHA1 fbeeddbec9ecaa11254fff99c6263a708ad1bcfd
- SHA512 de83b5a9c211317860fa0dad605de78a941f77a2c67fa09a738f9b374f2f8431c1b2ac6bd887f2a9659614b10953e2b4911f049eb0d7a8cb64b6c43b58408643
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 cd1fa5a4aab7135f8e5dad234d2605817af9fd3985f8e9a37a51285f86c8f99e
- MD5 bfc3e3b4437c8d9c9d2f64ecd9d3496f
- SHA1 1dd8f908e49bb3fd4ec86ff78a769590fa9abaf5
- SHA512 1865b6eeb8c8bebbe42e0b38161c3a725bace23cf92c806237cf7e2505790b13356ebd4a9a2b1d73e7d9dadec81646b4c843d1d4de7792c68b879d7ae1e38ab0
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\eutuzqom.exe
- Size 512KB
- SHA256 5cb7acac4d5f1f56e0a9db37dc92d773128fcf69bd11afe6c54f7de0d317afc0
- MD5 e620e82a823227b913e08fc2ff2ee45c
- SHA1 b98bbad88dee4c47caac9dbcada5a7afcb660e3f
- SHA512 9803029f8934f7648e19036f97abddb959b8259b5ad08b9f2d9579962d237988e80618ac4f21fe640de94612428e76dceb15c73f0fa56f33b2ab2e9b58428c1a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hzwptwntuk.exe
- Size 512KB
- SHA256 44a21dc74d930796a74cec7226626e316371e2b699eda7a841554eb8de39c046
- MD5 ccc0b6184e6783551fcaa3a81671d7c8
- SHA1 b54d1b810eaafa15f7900d2503a77d86776a5851
- SHA512 a074bfd46571804ac126fcb6976f4485f2cbe5873ac3c9d3b277256d461fae0e54133381de7f58e83e3e98fadbdaf3dc75d9480315b4f5b243a23883c0e9577e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ryuhkqqoajtsujt.exe
- Size 512KB
- SHA256 9e20d5babbc6cca6c7d67e21908e31eda9d3b8c54c8007d676bf88ced6256c48
- MD5 2c6da2d4bd1c6cca86de6cac35236725
- SHA1 a2de1a81fe64507867a2132537d14b947584c7a8
- SHA512 f9da8de5682cbdd427187386b082b5ceab9ea60a2deeadae70de1663b81fd8726c5b093722b0367c8c08e40e5bc783b69ae29a40e680a72784d8f575c4f474b1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj64:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ycasbvshazjsm.exe
- Size 512KB
- SHA256 30a9dd314220591ec055560a5fd6f60c36342261263aad6fc141c0732ffd166f
- MD5 c06a2ac9e25cd7fa2d69be84f90b5eed
- SHA1 34720e82701c33e4a099ae9eeb06d84951a3e491
- SHA512 8963d170c0e80614f8ce3e2ee9eb48073d5f04ccfa4089d5ad153d1cda53a7a81360e5d8d7f28983b59f98335b712cccec7e21d5f40f19584eb98a078c045e61
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 c21b58fccf87e29e69934cd54817bd1ae67df2b495c9e971f86f9783e5f20353
- MD5 fa3c3a9e9961eaf349f17b7c8cae1f3c
- SHA1 bf75dbe03fa363eefcb8d05747de0f2d30046b65
- SHA512 2732906e838c555edff9a02442635fa18756922b1cd5f9a94499d92f4483daf48ede568e7e105155f4b47c6ab3f46b5ccac923032d0373013520b38c7bdb29cb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 c96db1c79f2d09520f372447d8b8c3db82c47b2898eaec6027a5b8f807901962
- MD5 85428079e5a335047e199781735049be
- SHA1 09b1ba7b071de5a6d23b42a42a4e1f0da037e183
- SHA512 5fedd31bf9b42cb4dd85c0235c65470a39ba0890a73154a234af69ef3f511ee7ca9a74c70ad2bfab79a922fd94904564d69bbe028f015dcf0f580c21f8245add
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP