Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 22:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe
- Size 512KB
- Sample240603-2bvq6abc2z
- SHA256 41cc015333d10ae29914bed2a8bb600a9f18d8349dfd6cc5fd9465aeed27ba2d
- MD5 92d01e39f819f6561d2e7b8a4c806069
- SHA1 89561e5efcd59e784224bce04ae395c31c8f6a52
- SHA512 2d382004cf655420702ec544b98a2fbe2cf53f821c281ca12fb45ff17e804fc1249e0b354ebf0f93b783ed418bb9452dfe3ec7d857fb5b6f9f86258112fecf20
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj63:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" qitkffyenn.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qitkffyenn.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" qitkffyenn.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" qitkffyenn.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1648 qitkffyenn.exe 3120 jykxrosqmbcqonx.exe 888 gsjmkppp.exe 2268 vfprarqierlhq.exe 1184 gsjmkppp.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" qitkffyenn.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bzlymnfa = "qitkffyenn.exe" jykxrosqmbcqonx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pelgoonb = "jykxrosqmbcqonx.exe" jykxrosqmbcqonx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "vfprarqierlhq.exe" jykxrosqmbcqonx.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: gsjmkppp.exe File opened (read-only) \??\e: gsjmkppp.exe File opened (read-only) \??\b: qitkffyenn.exe File opened (read-only) \??\q: gsjmkppp.exe File opened (read-only) \??\v: gsjmkppp.exe File opened (read-only) \??\l: gsjmkppp.exe File opened (read-only) \??\o: gsjmkppp.exe File opened (read-only) \??\r: gsjmkppp.exe File opened (read-only) \??\y: gsjmkppp.exe File opened (read-only) \??\n: gsjmkppp.exe File opened (read-only) \??\r: gsjmkppp.exe File opened (read-only) \??\g: gsjmkppp.exe File opened (read-only) \??\i: gsjmkppp.exe File opened (read-only) \??\z: gsjmkppp.exe File opened (read-only) \??\m: gsjmkppp.exe File opened (read-only) \??\n: gsjmkppp.exe File opened (read-only) \??\h: gsjmkppp.exe File opened (read-only) \??\w: gsjmkppp.exe File opened (read-only) \??\y: gsjmkppp.exe File opened (read-only) \??\g: qitkffyenn.exe File opened (read-only) \??\p: qitkffyenn.exe File opened (read-only) \??\i: gsjmkppp.exe File opened (read-only) \??\k: qitkffyenn.exe File opened (read-only) \??\v: qitkffyenn.exe File opened (read-only) \??\a: gsjmkppp.exe File opened (read-only) \??\e: qitkffyenn.exe File opened (read-only) \??\m: qitkffyenn.exe File opened (read-only) \??\t: qitkffyenn.exe File opened (read-only) \??\s: gsjmkppp.exe File opened (read-only) \??\i: qitkffyenn.exe File opened (read-only) \??\k: gsjmkppp.exe File opened (read-only) \??\w: gsjmkppp.exe File opened (read-only) \??\p: gsjmkppp.exe File opened (read-only) \??\a: gsjmkppp.exe File opened (read-only) \??\z: gsjmkppp.exe File opened (read-only) \??\n: qitkffyenn.exe File opened (read-only) \??\r: qitkffyenn.exe File opened (read-only) \??\v: gsjmkppp.exe File opened (read-only) \??\a: qitkffyenn.exe File opened (read-only) \??\l: qitkffyenn.exe File opened (read-only) \??\b: gsjmkppp.exe File opened (read-only) \??\o: gsjmkppp.exe File opened (read-only) \??\p: gsjmkppp.exe File opened (read-only) \??\o: qitkffyenn.exe File opened (read-only) \??\q: qitkffyenn.exe File opened (read-only) \??\t: gsjmkppp.exe File opened (read-only) \??\x: qitkffyenn.exe File opened (read-only) \??\j: gsjmkppp.exe File opened (read-only) \??\q: gsjmkppp.exe File opened (read-only) \??\u: gsjmkppp.exe File opened (read-only) \??\u: qitkffyenn.exe File opened (read-only) \??\w: qitkffyenn.exe File opened (read-only) \??\l: gsjmkppp.exe File opened (read-only) \??\x: gsjmkppp.exe File opened (read-only) \??\h: qitkffyenn.exe File opened (read-only) \??\y: qitkffyenn.exe File opened (read-only) \??\s: gsjmkppp.exe File opened (read-only) \??\u: gsjmkppp.exe File opened (read-only) \??\g: gsjmkppp.exe File opened (read-only) \??\s: qitkffyenn.exe File opened (read-only) \??\e: gsjmkppp.exe File opened (read-only) \??\h: gsjmkppp.exe File opened (read-only) \??\j: gsjmkppp.exe File opened (read-only) \??\x: gsjmkppp.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" qitkffyenn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" qitkffyenn.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2368-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023415-5.dat autoit_exe behavioral2/files/0x0009000000023408-18.dat autoit_exe behavioral2/files/0x0007000000023416-26.dat autoit_exe behavioral2/files/0x0007000000023417-32.dat autoit_exe behavioral2/files/0x0008000000023328-69.dat autoit_exe behavioral2/files/0x0008000000023401-75.dat autoit_exe behavioral2/files/0x000e000000023388-573.dat autoit_exe behavioral2/files/0x000e000000023388-580.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\gsjmkppp.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File created C:\Windows\SysWOW64\vfprarqierlhq.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe gsjmkppp.exe File created C:\Windows\SysWOW64\qitkffyenn.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\qitkffyenn.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gsjmkppp.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll qitkffyenn.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe gsjmkppp.exe File created C:\Windows\SysWOW64\jykxrosqmbcqonx.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vfprarqierlhq.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification C:\Windows\SysWOW64\jykxrosqmbcqonx.exe 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gsjmkppp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gsjmkppp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gsjmkppp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal gsjmkppp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gsjmkppp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gsjmkppp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gsjmkppp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gsjmkppp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gsjmkppp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal gsjmkppp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gsjmkppp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal gsjmkppp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gsjmkppp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal gsjmkppp.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification C:\Windows\mydoc.rtf 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe gsjmkppp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe gsjmkppp.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe gsjmkppp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe gsjmkppp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe gsjmkppp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe gsjmkppp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe gsjmkppp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe gsjmkppp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe gsjmkppp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F368C6FE6822D1D27DD0A08A7F916B" 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" qitkffyenn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh qitkffyenn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" qitkffyenn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg qitkffyenn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8CFFF84F5B82139140D65A7E94BDE4E137584567346336D6EC" 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat qitkffyenn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc qitkffyenn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" qitkffyenn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs qitkffyenn.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB5B02947E439EF53C5B9D233EED4BF" 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32422C089D2D83546A4376D6772F2CDB7D8064D7" 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFF9BDF966F291840B3B3781983E90B0F9028F43120238E1B842EE09A2" 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193FC6741597DAC7B8CB7C90ED9034CB" 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" qitkffyenn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf qitkffyenn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" qitkffyenn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" qitkffyenn.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5056 WINWORD.EXE 5056 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 888 gsjmkppp.exe 888 gsjmkppp.exe 888 gsjmkppp.exe 888 gsjmkppp.exe 888 gsjmkppp.exe 888 gsjmkppp.exe 888 gsjmkppp.exe 888 gsjmkppp.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 2268 vfprarqierlhq.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 888 gsjmkppp.exe 2268 vfprarqierlhq.exe 888 gsjmkppp.exe 2268 vfprarqierlhq.exe 888 gsjmkppp.exe 2268 vfprarqierlhq.exe 1184 gsjmkppp.exe 1184 gsjmkppp.exe 1184 gsjmkppp.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 1648 qitkffyenn.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 3120 jykxrosqmbcqonx.exe 888 gsjmkppp.exe 2268 vfprarqierlhq.exe 888 gsjmkppp.exe 2268 vfprarqierlhq.exe 888 gsjmkppp.exe 2268 vfprarqierlhq.exe 1184 gsjmkppp.exe 1184 gsjmkppp.exe 1184 gsjmkppp.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5056 WINWORD.EXE 5056 WINWORD.EXE 5056 WINWORD.EXE 5056 WINWORD.EXE 5056 WINWORD.EXE 5056 WINWORD.EXE 5056 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1648 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 83 PID 2368 wrote to memory of 1648 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 83 PID 2368 wrote to memory of 1648 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 83 PID 2368 wrote to memory of 3120 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 84 PID 2368 wrote to memory of 3120 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 84 PID 2368 wrote to memory of 3120 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 84 PID 2368 wrote to memory of 888 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 85 PID 2368 wrote to memory of 888 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 85 PID 2368 wrote to memory of 888 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 85 PID 2368 wrote to memory of 2268 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 86 PID 2368 wrote to memory of 2268 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 86 PID 2368 wrote to memory of 2268 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 86 PID 2368 wrote to memory of 5056 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 87 PID 2368 wrote to memory of 5056 2368 92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe 87 PID 1648 wrote to memory of 1184 1648 qitkffyenn.exe 89 PID 1648 wrote to memory of 1184 1648 qitkffyenn.exe 89 PID 1648 wrote to memory of 1184 1648 qitkffyenn.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\92d01e39f819f6561d2e7b8a4c806069_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\qitkffyenn.exeqitkffyenn.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\gsjmkppp.exeC:\Windows\system32\gsjmkppp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1184
-
-
-
C:\Windows\SysWOW64\jykxrosqmbcqonx.exejykxrosqmbcqonx.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3120
-
-
C:\Windows\SysWOW64\gsjmkppp.exegsjmkppp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:888
-
-
C:\Windows\SysWOW64\vfprarqierlhq.exevfprarqierlhq.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2268
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5056
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 79b746e4f7cf1fc785bf8f969abc4d4de47bca66420f058cb16078e7a6db0569
- MD5 c8722b97683a043eb4ada30b62e4764a
- SHA1 c341251026a54fcaaeced16f5fd38ab37e7ee815
- SHA512 d6fea31353c877ae29f461ebdbae77025e7f3d968232eb6fbde98d4fc5574f3576392f592447f06a1df2fcfceaa319c6aff40125fd9d4448737558824d319dc5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 d8fbc9abd08eabb86949a57aedd4e4439d345126dce0f6c79379e4f914889a0e
- MD5 73c6e4687f9fc3d4b3a843aad45f0fb2
- SHA1 b2a313cc96336cd3e22343919808875efedbe687
- SHA512 4fb793f318a20e3d5960fe0aa1b4a7cf6328ef93817609b0413d5565cf89052c4c754f306a442875bd2d2cd7bee9585a9027b88a1a49dea8a2612fd59786ac09
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCDBAE3.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N318BB6LIGGRNAXCIT00.temp
- Size 3KB
- SHA256 fb7e80c901d8c00500da32a971c9e15daf648b5013f3ad420f4ab3588aafe3ee
- MD5 fda2b8ada2fcf0a1bd18677a910c418e
- SHA1 40369e057877ff955af3a2e06dbbb2a23463a20e
- SHA512 c404e3a54362d0fd5d6a18b4260b2c16a5269c3a4be4d3a341c5077d3f22e8d6fcfe40696f189e7c16e322e6e56824f31c89b0276a660a147be9ab1b766d1688
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 a40dbeda2b1eb5d6f85d65bab0a50f8669c231bf17af10171c99c3379c4174a1
- MD5 89df5e1f1adc91d9196cf04b9d40bd60
- SHA1 aa93f3d68613e860675e293e48a500db5096f9ee
- SHA512 a4f05eab37ac37109ec3a5de8305892f4b1fe99b34fdfbcbfb90ff3ac6ab5e412fc7d87c0837a69feb379541549d3d4c67db1922074b870b272a816450c64703
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\gsjmkppp.exe
- Size 512KB
- SHA256 80535b2eb98e8fc97f5205e3d8c4516044bca7d1fb34d9cd104f770bce60639e
- MD5 eafad959dde09422f822a5012b589a6a
- SHA1 69fb141564397ce92ecc22498528fafa04c0335c
- SHA512 fb9b2ea96edae2673fe04d9627aa677cbd21b697360b41399f0c0bd339d6ceb33e07ea62e760faaacec848505301070a6e80be6f46bcf5adb74c99afb42d0486
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jykxrosqmbcqonx.exe
- Size 512KB
- SHA256 5d3eb535bd4911a45f70221dbbef23f60b9843e3dc08ba8d188a5b7fd9876d05
- MD5 0d41bea09aeb69d0f6be1b55c3b91b8e
- SHA1 09de21427b11c54540cc3f84767861d54770d281
- SHA512 85c5655ec4a1d9b5df25eb33215c472c1c90f3284278638a329e04efd17736aae8d02fa35e14bbd20f79e5fdca12aaa467bc2eb19af3b7df084651876647e8ab
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\qitkffyenn.exe
- Size 512KB
- SHA256 c581bee454185847af292f8db8c41d811e857681813711e953f082dd5e2225a2
- MD5 0243c2284c8fe1d130b8f6f3e29511d5
- SHA1 c21b63f3a6feebbe7923337a0ed25e974c627e7a
- SHA512 95161ce33cb1d2f274513c144934eb490e5bcb6c1667ad97be5a9102f10cc77ef5b0b9527dc9c7c8f44ba52d5e155710ef346a2c71d0248166fd9f6ac771241c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vfprarqierlhq.exe
- Size 512KB
- SHA256 eda63cb25949615aa15be8daf6dc112fd41738a6ef0562722f6456e876bc8280
- MD5 82ba87afd3e54b743ff9c72dfce05483
- SHA1 c662e14fb4e534c591d8117028a76e5a3be16106
- SHA512 4107fa63d9366c08d03524bf5903e4db6f6c9a31d859e30e4fff62a318dec08b1ee94ec2eda876ae5f3e948beaf89ab023648cc890e466b843e1d96f131a993f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 2ee8ddc953154cf8a7483b93f198c604815f03b573659de0b95ed094c867129d
- MD5 c70a057a3eb0602e11a6887f2efc6ff9
- SHA1 d0905848fb7f129efab356fab5aed9c3ca40301d
- SHA512 4f14c8f21d750e72e40afe3e343bef4ccb10e42227743216b1203e7fd97447e99d00fcc6e9d112228a00d0ec4f6d507b9c5524afa697abfc96eac9751b65f9a8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 5f892a6a909184a18d4d0d2fa592836a5e941bb635c9f46fbcd032141c2ffb5a
- MD5 c6d8961e51206d6fe9a60d2b3d39ce32
- SHA1 181faaf43c82d95ef80a5ca807599df53ea4860d
- SHA512 f0d37bfad6aa0c523b1c01a6e09ee21d37d5d21b629e7a242a04e9de9e1d566aa146ad363160597efa0a6a5da05f4af30ba57232856e30b5a2870a3dc5aa5b30
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- MD5 SHA1 SHA512 SSDEEP