Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 04:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe
- Size 512KB
- Sample240601-fmwlyabd25
- SHA256 4662c7f69769f0a4633b9cc30a22ee86802f6730050c83d1c0738d82496f3384
- MD5 896cf938a352b45196b4e69fdf831972
- SHA1 e380afcd9f89e6448b9c662e4b4bddf21b5af20d
- SHA512 994e5c5167a5dc5a58c23845c6699a71d4a2c122af38c707c1a6fa0631e38fee6c6a80fabf25114a952e8e9087c9ee5671e81900ae0a6ab6eaf9c7d6073e4069
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kljfvddowo.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kljfvddowo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kljfvddowo.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kljfvddowo.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 956 kljfvddowo.exe 1220 umhcgfkvkuusgce.exe 1580 lcutvglh.exe 2096 gfwjitnzvwqjl.exe 3288 lcutvglh.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kljfvddowo.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rgiqquyt = "kljfvddowo.exe" umhcgfkvkuusgce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dmgapzvv = "umhcgfkvkuusgce.exe" umhcgfkvkuusgce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gfwjitnzvwqjl.exe" umhcgfkvkuusgce.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: lcutvglh.exe File opened (read-only) \??\e: lcutvglh.exe File opened (read-only) \??\n: lcutvglh.exe File opened (read-only) \??\j: kljfvddowo.exe File opened (read-only) \??\n: kljfvddowo.exe File opened (read-only) \??\q: kljfvddowo.exe File opened (read-only) \??\a: lcutvglh.exe File opened (read-only) \??\j: lcutvglh.exe File opened (read-only) \??\y: lcutvglh.exe File opened (read-only) \??\p: kljfvddowo.exe File opened (read-only) \??\y: kljfvddowo.exe File opened (read-only) \??\l: lcutvglh.exe File opened (read-only) \??\b: kljfvddowo.exe File opened (read-only) \??\g: kljfvddowo.exe File opened (read-only) \??\z: lcutvglh.exe File opened (read-only) \??\r: kljfvddowo.exe File opened (read-only) \??\m: lcutvglh.exe File opened (read-only) \??\b: lcutvglh.exe File opened (read-only) \??\q: lcutvglh.exe File opened (read-only) \??\b: lcutvglh.exe File opened (read-only) \??\o: lcutvglh.exe File opened (read-only) \??\q: lcutvglh.exe File opened (read-only) \??\r: lcutvglh.exe File opened (read-only) \??\j: lcutvglh.exe File opened (read-only) \??\g: lcutvglh.exe File opened (read-only) \??\t: lcutvglh.exe File opened (read-only) \??\y: lcutvglh.exe File opened (read-only) \??\z: lcutvglh.exe File opened (read-only) \??\h: lcutvglh.exe File opened (read-only) \??\e: kljfvddowo.exe File opened (read-only) \??\s: kljfvddowo.exe File opened (read-only) \??\p: lcutvglh.exe File opened (read-only) \??\w: lcutvglh.exe File opened (read-only) \??\i: lcutvglh.exe File opened (read-only) \??\z: kljfvddowo.exe File opened (read-only) \??\h: lcutvglh.exe File opened (read-only) \??\h: kljfvddowo.exe File opened (read-only) \??\v: lcutvglh.exe File opened (read-only) \??\x: lcutvglh.exe File opened (read-only) \??\k: kljfvddowo.exe File opened (read-only) \??\l: kljfvddowo.exe File opened (read-only) \??\s: lcutvglh.exe File opened (read-only) \??\w: lcutvglh.exe File opened (read-only) \??\u: lcutvglh.exe File opened (read-only) \??\a: kljfvddowo.exe File opened (read-only) \??\k: lcutvglh.exe File opened (read-only) \??\g: lcutvglh.exe File opened (read-only) \??\m: lcutvglh.exe File opened (read-only) \??\p: lcutvglh.exe File opened (read-only) \??\n: lcutvglh.exe File opened (read-only) \??\r: lcutvglh.exe File opened (read-only) \??\t: kljfvddowo.exe File opened (read-only) \??\u: kljfvddowo.exe File opened (read-only) \??\o: lcutvglh.exe File opened (read-only) \??\t: lcutvglh.exe File opened (read-only) \??\x: lcutvglh.exe File opened (read-only) \??\u: lcutvglh.exe File opened (read-only) \??\a: lcutvglh.exe File opened (read-only) \??\s: lcutvglh.exe File opened (read-only) \??\i: kljfvddowo.exe File opened (read-only) \??\m: kljfvddowo.exe File opened (read-only) \??\v: kljfvddowo.exe File opened (read-only) \??\x: kljfvddowo.exe File opened (read-only) \??\i: lcutvglh.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kljfvddowo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kljfvddowo.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1612-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023429-5.dat autoit_exe behavioral2/files/0x000900000002341e-18.dat autoit_exe behavioral2/files/0x000700000002342a-26.dat autoit_exe behavioral2/files/0x000700000002342b-32.dat autoit_exe behavioral2/files/0x000800000002340c-66.dat autoit_exe behavioral2/files/0x0007000000023437-69.dat autoit_exe behavioral2/files/0x001d00000002343e-557.dat autoit_exe behavioral2/files/0x001d00000002343e-571.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\kljfvddowo.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File created C:\Windows\SysWOW64\lcutvglh.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File created C:\Windows\SysWOW64\umhcgfkvkuusgce.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\umhcgfkvkuusgce.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lcutvglh.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification C:\Windows\SysWOW64\kljfvddowo.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gfwjitnzvwqjl.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lcutvglh.exe File created C:\Windows\SysWOW64\gfwjitnzvwqjl.exe 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kljfvddowo.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lcutvglh.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lcutvglh.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lcutvglh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lcutvglh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lcutvglh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lcutvglh.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lcutvglh.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lcutvglh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal lcutvglh.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lcutvglh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification C:\Windows\mydoc.rtf 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lcutvglh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lcutvglh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lcutvglh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lcutvglh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lcutvglh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lcutvglh.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lcutvglh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lcutvglh.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332C0F9C2383596D4376D470222CAA7CF264D6" 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1844C67C15E5DAC5B9BB7F97ECE337CF" 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kljfvddowo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kljfvddowo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kljfvddowo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kljfvddowo.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFFAB9F965F1E3830C3B4786E93E97B0FB03F14214023AE1C9429C08D6" 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kljfvddowo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kljfvddowo.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFFF84F27851B9131D6587DE2BCE7E634584066466334D798" 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kljfvddowo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B1294492389F52C8BAD53299D7CE" 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F36BB2FE6D22D9D108D1D28B099011" 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kljfvddowo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kljfvddowo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kljfvddowo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kljfvddowo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kljfvddowo.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4752 WINWORD.EXE 4752 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 956 kljfvddowo.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1220 umhcgfkvkuusgce.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 1580 lcutvglh.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 2096 gfwjitnzvwqjl.exe 3288 lcutvglh.exe 3288 lcutvglh.exe 3288 lcutvglh.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4752 WINWORD.EXE 4752 WINWORD.EXE 4752 WINWORD.EXE 4752 WINWORD.EXE 4752 WINWORD.EXE 4752 WINWORD.EXE 4752 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1612 wrote to memory of 956 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 83 PID 1612 wrote to memory of 956 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 83 PID 1612 wrote to memory of 956 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 83 PID 1612 wrote to memory of 1220 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 84 PID 1612 wrote to memory of 1220 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 84 PID 1612 wrote to memory of 1220 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 84 PID 1612 wrote to memory of 1580 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 85 PID 1612 wrote to memory of 1580 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 85 PID 1612 wrote to memory of 1580 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 85 PID 1612 wrote to memory of 2096 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 86 PID 1612 wrote to memory of 2096 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 86 PID 1612 wrote to memory of 2096 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 86 PID 956 wrote to memory of 3288 956 kljfvddowo.exe 87 PID 956 wrote to memory of 3288 956 kljfvddowo.exe 87 PID 956 wrote to memory of 3288 956 kljfvddowo.exe 87 PID 1612 wrote to memory of 4752 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 88 PID 1612 wrote to memory of 4752 1612 896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\896cf938a352b45196b4e69fdf831972_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\kljfvddowo.exekljfvddowo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\lcutvglh.exeC:\Windows\system32\lcutvglh.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3288
-
-
-
C:\Windows\SysWOW64\umhcgfkvkuusgce.exeumhcgfkvkuusgce.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1220
-
-
C:\Windows\SysWOW64\lcutvglh.exelcutvglh.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1580
-
-
C:\Windows\SysWOW64\gfwjitnzvwqjl.exegfwjitnzvwqjl.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2096
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4752
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 b04025abc5505e1704b8cf6074fa5d73adf11159e724faa8b062a6056b5a086a
- MD5 fd4a3442bfa9f74dbbc467f5473c11f2
- SHA1 31e1360976f4bfee2d81a2c176bcb5cad29dd4e8
- SHA512 4a9064560c18c3e7e6f4217adb9d97bd63b489c22ef21f8aa7250737cb201ad5a65be9ad489dad89291202dc95e847255d10d08b97185df6b0d1bfb1914633da
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 4a63478df1ad26583bcdee285c76e0cf51972cff0b04aa560625bdf4ceebcc05
- MD5 ce620fdbde8dea30ec53b317f23c32ce
- SHA1 dfbdbbd39026c5f4b585e19108a8e66d1fdc7f7d
- SHA512 dc32e53eab59ed80c81f0b583cc1ca5b46e965f29335019ec4bc3d16ea0ef2ef4f345da5d11f259ceb629d46a88e5b41932a6074821be3311a52eb67b1dbdbc8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD8D05.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 dcafa4f38835cfc44cf3ce06b6898dad802be520a5f3b41468e8a2d361ec6abc
- MD5 0520322933afa0ab23a2a88b2d9ed7bf
- SHA1 03497d8c694c327c2edf5937555f98a6ea745cca
- SHA512 cc185ade1948b64a67d1d0ed1d7c1ab09867d1efe76d9adbc1c4448a2883ba1d0501607051f0ee0f6f319b0953f7848df8e31a3a62c745fec9a5c21b8126c7ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 5dbd07599ea68a9578d8f2c2f27868a264fb21e928294072c6c929ed63200057
- MD5 8a3b14815f18ab50878bb4f7dc860911
- SHA1 ba5ad942faa57138184b659fce62225ef70cdd01
- SHA512 91754dfc92d5b2d4d89dcc433f08c54c69558d9406f0296175779b2015989daa45cfe20e49aa3f6d0d279925eb8e49c718ef236b7c1cb21e2aeb9b7ba967d718
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\gfwjitnzvwqjl.exe
- Size 512KB
- SHA256 d7b8ac6e35f0ce06ce895fcc4ba92acdf656e9b890b3c2040b0eddf71c11edd2
- MD5 4a219330b8e1d1501e244857faf03c66
- SHA1 bb9ec103728ddca7c9f5b926f6485bcdcca6c66b
- SHA512 3510cf7db9df82b863ee4fd89f91158bc80855650458d7ac4a722b4c9784d1f9869f5fdcab15312aa198a2b1950c4cae36e7fd3d15de8097ea5e6d26ea53236d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kljfvddowo.exe
- Size 512KB
- SHA256 a766c458d261a3da9ff88b95543d5b4daffb5d6493cd2db7f30fb54630f4b59f
- MD5 89ce3450c0dad772bc2b5ad5f3ee9e5b
- SHA1 4f5204dfc69f0d1039ac983a069ab5266a79047e
- SHA512 9d6f2cf265fbb1be72ac9a4711b74a570511738558f9674623aff1ff220ec46071be5e314ca7c5d6be48c91993feafbbb95864925185d0a2b925d7f87944bf4b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\lcutvglh.exe
- Size 512KB
- SHA256 8eb2812e0c21292e88cbe9e90753574a871f97ad82a1a4625f1186a2fbe90b18
- MD5 c4f7f935c1f0edf6f14038578018ad87
- SHA1 0de8e211ddd9fab35135287641452f3045e9571e
- SHA512 5ad1c9f0eac2df9daedb91244b985f9b97defa88f737da298fc842b5f22ea1b5ac1683a496d34387d99b62e4c03f87fa7752bd2e598caebe927951dc44cafd77
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6+:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\umhcgfkvkuusgce.exe
- Size 512KB
- SHA256 fe066c6428caebfa2f24b2a4556ee5e02f06b7c68bf75e4acf1a1d8c6bd02aa3
- MD5 a1ce81fb6e4bcf0db101f58afd66dfd8
- SHA1 4af05659aafd31541e0cc1eb01907b49efdc4f6e
- SHA512 5e93170bd8c3fe38d49e662ddcd4d6d598f47639c409e84e518ac162a1e15ccd8ae89d495f3b12591b6dce2907a22cb11413edddc4eed40b7f11ce6187aaf0c9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 17e5555419b7950061880ba9febb7a21839bc12ee77387c1fc0265c354506113
- MD5 46d7dfa5cdd3a24da1bb4ec43cac685c
- SHA1 2d232d385f957b5e524f9aa95286a0f170eb7a8c
- SHA512 837597e86209722e9a74012f3328dad32e79fa164f4a6f361ed2df5956ab163395930b1fe8b6d4784f121c1aa9f9c7d144bc3fba82aad568eea4f9c9bf75c0fa
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 3cbb511cc8018b75c86e8b4536183dcf140fcc2cb77c963a28cad1a06a6ee146
- MD5 a02f05131224ed499643f6c9bf3c6589
- SHA1 c640fe0c05685835558d11b9e5be5ff4e55c32bc
- SHA512 1894d7a485e080044cc7043623be931c6b472896b48d33e245594ba78f2c2c7f3e3d8819d5e02500059c98f64ca537a06216d25018cb32303980c8f2b7ce1ba2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- MD5 SHA1 SHA512 SSDEEP