Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 01:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe
- Size 512KB
- Sample240602-cbex9seh5s
- SHA256 499ec4d407e757725a9e493034015b15e3ec973d17e04b896e947354d33d8bc1
- MD5 8c864b91fb82051d996f80e8d56f0a85
- SHA1 74bfe0b2e6c10a8b8e67bff56cc7514e66fc9a9a
- SHA512 336256699253b8de55b9e9c9784c5255a61c720f1a8a50e38c780011f173b0f0380c778be6cecb76ccf428e2ad674378fb37ef5ddf896f6d48a97c8b68c96105
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" sflfnjrxhr.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sflfnjrxhr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sflfnjrxhr.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sflfnjrxhr.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1848 sflfnjrxhr.exe 1836 bprvtsoqkusnpvk.exe 2492 ujeqmbgl.exe 3472 ftwqnwhricvxk.exe 2180 ujeqmbgl.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sflfnjrxhr.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\broaoeic = "sflfnjrxhr.exe" bprvtsoqkusnpvk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cnaozodf = "bprvtsoqkusnpvk.exe" bprvtsoqkusnpvk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ftwqnwhricvxk.exe" bprvtsoqkusnpvk.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: ujeqmbgl.exe File opened (read-only) \??\v: ujeqmbgl.exe File opened (read-only) \??\n: ujeqmbgl.exe File opened (read-only) \??\s: ujeqmbgl.exe File opened (read-only) \??\x: ujeqmbgl.exe File opened (read-only) \??\g: sflfnjrxhr.exe File opened (read-only) \??\u: sflfnjrxhr.exe File opened (read-only) \??\y: ujeqmbgl.exe File opened (read-only) \??\h: ujeqmbgl.exe File opened (read-only) \??\t: ujeqmbgl.exe File opened (read-only) \??\j: sflfnjrxhr.exe File opened (read-only) \??\k: sflfnjrxhr.exe File opened (read-only) \??\p: ujeqmbgl.exe File opened (read-only) \??\l: ujeqmbgl.exe File opened (read-only) \??\a: sflfnjrxhr.exe File opened (read-only) \??\r: sflfnjrxhr.exe File opened (read-only) \??\x: sflfnjrxhr.exe File opened (read-only) \??\j: ujeqmbgl.exe File opened (read-only) \??\k: ujeqmbgl.exe File opened (read-only) \??\s: sflfnjrxhr.exe File opened (read-only) \??\b: ujeqmbgl.exe File opened (read-only) \??\i: ujeqmbgl.exe File opened (read-only) \??\w: ujeqmbgl.exe File opened (read-only) \??\j: ujeqmbgl.exe File opened (read-only) \??\g: ujeqmbgl.exe File opened (read-only) \??\m: ujeqmbgl.exe File opened (read-only) \??\b: ujeqmbgl.exe File opened (read-only) \??\o: ujeqmbgl.exe File opened (read-only) \??\r: ujeqmbgl.exe File opened (read-only) \??\t: sflfnjrxhr.exe File opened (read-only) \??\o: ujeqmbgl.exe File opened (read-only) \??\z: ujeqmbgl.exe File opened (read-only) \??\m: sflfnjrxhr.exe File opened (read-only) \??\q: sflfnjrxhr.exe File opened (read-only) \??\a: ujeqmbgl.exe File opened (read-only) \??\h: ujeqmbgl.exe File opened (read-only) \??\z: ujeqmbgl.exe File opened (read-only) \??\i: ujeqmbgl.exe File opened (read-only) \??\p: ujeqmbgl.exe File opened (read-only) \??\q: ujeqmbgl.exe File opened (read-only) \??\u: ujeqmbgl.exe File opened (read-only) \??\v: ujeqmbgl.exe File opened (read-only) \??\k: ujeqmbgl.exe File opened (read-only) \??\s: ujeqmbgl.exe File opened (read-only) \??\a: ujeqmbgl.exe File opened (read-only) \??\g: ujeqmbgl.exe File opened (read-only) \??\u: ujeqmbgl.exe File opened (read-only) \??\i: sflfnjrxhr.exe File opened (read-only) \??\v: sflfnjrxhr.exe File opened (read-only) \??\n: sflfnjrxhr.exe File opened (read-only) \??\o: sflfnjrxhr.exe File opened (read-only) \??\y: ujeqmbgl.exe File opened (read-only) \??\l: ujeqmbgl.exe File opened (read-only) \??\w: ujeqmbgl.exe File opened (read-only) \??\t: ujeqmbgl.exe File opened (read-only) \??\e: sflfnjrxhr.exe File opened (read-only) \??\w: sflfnjrxhr.exe File opened (read-only) \??\y: sflfnjrxhr.exe File opened (read-only) \??\n: ujeqmbgl.exe File opened (read-only) \??\q: ujeqmbgl.exe File opened (read-only) \??\z: sflfnjrxhr.exe File opened (read-only) \??\e: ujeqmbgl.exe File opened (read-only) \??\r: ujeqmbgl.exe File opened (read-only) \??\e: ujeqmbgl.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" sflfnjrxhr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" sflfnjrxhr.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/636-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000700000002342d-5.dat autoit_exe behavioral2/files/0x0008000000023429-19.dat autoit_exe behavioral2/files/0x000700000002342e-26.dat autoit_exe behavioral2/files/0x000700000002342f-31.dat autoit_exe behavioral2/files/0x000400000001e0c3-69.dat autoit_exe behavioral2/files/0x000800000001e094-66.dat autoit_exe behavioral2/files/0x000200000001e70f-90.dat autoit_exe behavioral2/files/0x000200000001e70f-92.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftwqnwhricvxk.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll sflfnjrxhr.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ujeqmbgl.exe File created C:\Windows\SysWOW64\bprvtsoqkusnpvk.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bprvtsoqkusnpvk.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File created C:\Windows\SysWOW64\ujeqmbgl.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ujeqmbgl.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ujeqmbgl.exe File created C:\Windows\SysWOW64\sflfnjrxhr.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sflfnjrxhr.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ftwqnwhricvxk.exe 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ujeqmbgl.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ujeqmbgl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ujeqmbgl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ujeqmbgl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ujeqmbgl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ujeqmbgl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ujeqmbgl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ujeqmbgl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ujeqmbgl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ujeqmbgl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ujeqmbgl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ujeqmbgl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ujeqmbgl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ujeqmbgl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ujeqmbgl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ujeqmbgl.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification C:\Windows\mydoc.rtf 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ujeqmbgl.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ujeqmbgl.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ujeqmbgl.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ujeqmbgl.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ujeqmbgl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ujeqmbgl.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ujeqmbgl.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ujeqmbgl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat sflfnjrxhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" sflfnjrxhr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf sflfnjrxhr.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B120479238E353BABAD03292D7CA" 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F368B7FE6B21D9D27FD0D28A099110" 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" sflfnjrxhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" sflfnjrxhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACEF9CBFE16F2E484743A4286ED3E90B0FB03F14212034EE2CE45E608A1" 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183AC67F15E3DAB4B9CE7C90EDE534CF" 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc sflfnjrxhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" sflfnjrxhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32402C7E9C2583596A3276A177242DD67D8665DB" 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8CFC834F2782699136D6207D9DBCEFE140594466416236D79F" 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh sflfnjrxhr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg sflfnjrxhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" sflfnjrxhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" sflfnjrxhr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs sflfnjrxhr.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4592 WINWORD.EXE 4592 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1836 bprvtsoqkusnpvk.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 1848 sflfnjrxhr.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 3472 ftwqnwhricvxk.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2492 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe 2180 ujeqmbgl.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE 4592 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 636 wrote to memory of 1848 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 81 PID 636 wrote to memory of 1848 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 81 PID 636 wrote to memory of 1848 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 81 PID 636 wrote to memory of 1836 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 82 PID 636 wrote to memory of 1836 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 82 PID 636 wrote to memory of 1836 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 82 PID 636 wrote to memory of 2492 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 83 PID 636 wrote to memory of 2492 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 83 PID 636 wrote to memory of 2492 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 83 PID 636 wrote to memory of 3472 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 84 PID 636 wrote to memory of 3472 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 84 PID 636 wrote to memory of 3472 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 84 PID 636 wrote to memory of 4592 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 85 PID 636 wrote to memory of 4592 636 8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe 85 PID 1848 wrote to memory of 2180 1848 sflfnjrxhr.exe 88 PID 1848 wrote to memory of 2180 1848 sflfnjrxhr.exe 88 PID 1848 wrote to memory of 2180 1848 sflfnjrxhr.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c864b91fb82051d996f80e8d56f0a85_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\sflfnjrxhr.exesflfnjrxhr.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\ujeqmbgl.exeC:\Windows\system32\ujeqmbgl.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2180
-
-
-
C:\Windows\SysWOW64\bprvtsoqkusnpvk.exebprvtsoqkusnpvk.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1836
-
-
C:\Windows\SysWOW64\ujeqmbgl.exeujeqmbgl.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2492
-
-
C:\Windows\SysWOW64\ftwqnwhricvxk.exeftwqnwhricvxk.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3472
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4592
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 5d281eb9dde41618b161836ca4e69cab174c05236108115969efeb4fd5b734fa
- MD5 80febb91d14f1eda521653a5a5e9b5b0
- SHA1 0878f703956d045aec0913c63d424a4feb3436e4
- SHA512 8640ffdd1177608f0a347fc512740fe21db654bfc78035fcba816d4899fda72b1d46240f6cc4c5654a813453c29c634d31cf78d00c34ce5f7f594720969b428a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 6df274d1fd4eb01259ee9b80c6ce43218fb07f407d660c482b2125e3a9ade16b
- MD5 cfc5eccec20f9e4924f1cfa8baa1cde7
- SHA1 c51d59bdf294957d8ca60fcea13b184db306697f
- SHA512 29bd9ef42353139ad809107d5b5fcaf5970b60c3b9a4bce7ffcc3c7704d51182c8149fbec9a66fb6f0c0ca0c39af30fdc074accf5802da9f707b7b4b1225e5c8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6MTV2N79RE59M6EY4MRF.temp
- Size 3KB
- SHA256 87a06bb4eaf459c319c81e3dfdbcd1ecf9c6c1e7283f5cd6b90d663414d33e0d
- MD5 6a31bd8c557a9eb2181380232f53a90b
- SHA1 aa96d10601afe12d28c082cb4f722b854b320558
- SHA512 f6f0dc617018aa52fadf495882ad2340fe30fcb324d0c3d820ea29ff078e7ccb13217eb684224a10bc3dfc0c4721cd2cbae655ce8d5f779b64749f1ce6470559
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 a48dbc267a6908189ccedcb666bcd18e51c54d21b23287ae43bdc57ac763d87f
- MD5 db62dc01ec77e314a2d819ec468089a5
- SHA1 1ba348ab33eda589e596747f1b9cc1f0cd6c7312
- SHA512 20f67ade56c431ca437da97dd8ff95cd45a1e2e206006ae8ca5ad8e2ff160d79fd20a600038eec7630fa50a5d71789c06fadc3ca8798a335d9b15ae93b50b8a9
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\bprvtsoqkusnpvk.exe
- Size 512KB
- SHA256 f20ff7702ce76969d9f9e0d2344d699dbd9324109d5d6dc5d20544456b3a5cb4
- MD5 085f69392125db0a7c9dd022b2c4daca
- SHA1 92af4cbd73bba75441c5677ee918082e478cc30f
- SHA512 f4ef83decc5caf00de9788b5bef233ddc18ced6483ecc258ebeff4423660617ccb74f90f5268a34b1e3631ffd446cdbc21544d5fb458e79f1618b4728d9f8a04
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6+:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ftwqnwhricvxk.exe
- Size 512KB
- SHA256 9058860df4bfcd377b76c2b686fb556a6c1d65ec3557475eb409e888a9fbaba4
- MD5 351e864828d63687237c2db2f70e19be
- SHA1 0456cd2e1c04b2862003cec1191507feeca4aaee
- SHA512 912a1d36fa8496b0dd4aa841b5b039e0417fb88a9fe1eed3f467c3a5d77260e53821157146f5605f899f743dc688abdaaa3e45a10b13302f594c3305d9392808
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sflfnjrxhr.exe
- Size 512KB
- SHA256 bc18891de25897fc1a1676edf2bcb3929f96a968825469950c903125ac39b4a0
- MD5 c633d4dd9af1e4ed85c51b802408f5f0
- SHA1 60f416b77f0f986320e452b22bd4880658c5bfc8
- SHA512 9dc91973dde32bc2b11917cb0b97914832eda5858ca443cf57b445352a1a6171975b6a87eb8b7ad0891834177c4d0bc695304f40ffabb0faac5f3645c2b36bc3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ujeqmbgl.exe
- Size 512KB
- SHA256 15c79e1625e8f05ba575b01741f2ae4a8707258e1c5d3e4a58faafe95242e2e0
- MD5 34ca280fe20111bc46a31962a9b9cbae
- SHA1 1c1b023fa2a7d89c2813938000df51599ce1316f
- SHA512 0036e4e38652ec1cafb81949664e555b9693b1af3447b304820c0fe67f8abbd93e9f9e0868c22a6efc524a37901aa301c0ccb95d6dcd9bd41f6385123487daf4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 f1cc4eefeee6ddf9645afca255993f53adca3582fc3823a54ea63a7dff0f0f1f
- MD5 df11899f9f057e85fc8c34caf990af5d
- SHA1 be46b16f44f9719f80266e59721a2620bf97e212
- SHA512 5cb24690a613ccffeebda3c81a6133b46ff30adbfd77117e8c53b25d41156d236adbd31942f1a2ae281f7e07570636214dea36eb759ee9cb82c3ed6f25de216c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 881d4488c48398a69c7ec6ab86ee18708f042bd7054f771293a893572719536b
- MD5 a5ce8b41df828f3b67e8280ab482606d
- SHA1 1bf8f61950feec5753cd2a4b5ad408bbcbaf21d5
- SHA512 fb08c0858a38770c6185ad17c5e6461c625ffa62c41be899de33b3564e5b833bbf6d54ea4756d9d03a0eca71c00d01c0cc5698bb04fc82b8e849f75f61313786
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP