Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 22:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
92d316761c31264a04924ebbac68070d_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
92d316761c31264a04924ebbac68070d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe
- Size 512KB
- Sample240603-2dvtyabc9t
- SHA256 104c99fc50c4f413c862fe78973f3e5e5595330ffa84ab7be064939637912789
- MD5 92d316761c31264a04924ebbac68070d
- SHA1 3b19dbe6d9cb8d8ccc975be5f5f922858e516bd8
- SHA512 ce1d07d93b8f73d71a8187afbc6022c7a90ee93a939f3212779ca0b321b0ac47e2a784a10b977acb8de8449e6d50738942bcdde18bab383e9ef30d0e4b7129cb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5K
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" wyborbkrbq.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wyborbkrbq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wyborbkrbq.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wyborbkrbq.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1400 wyborbkrbq.exe 1128 rntddxbdghltfrb.exe 3520 ucdeyypc.exe 2820 rjpalcbnyoyzq.exe 3972 ucdeyypc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" wyborbkrbq.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sagpagae = "rntddxbdghltfrb.exe" rntddxbdghltfrb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "rjpalcbnyoyzq.exe" rntddxbdghltfrb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zyfpxyje = "wyborbkrbq.exe" rntddxbdghltfrb.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: ucdeyypc.exe File opened (read-only) \??\x: wyborbkrbq.exe File opened (read-only) \??\k: ucdeyypc.exe File opened (read-only) \??\m: ucdeyypc.exe File opened (read-only) \??\u: ucdeyypc.exe File opened (read-only) \??\j: ucdeyypc.exe File opened (read-only) \??\n: ucdeyypc.exe File opened (read-only) \??\z: wyborbkrbq.exe File opened (read-only) \??\g: ucdeyypc.exe File opened (read-only) \??\g: ucdeyypc.exe File opened (read-only) \??\j: wyborbkrbq.exe File opened (read-only) \??\t: ucdeyypc.exe File opened (read-only) \??\i: ucdeyypc.exe File opened (read-only) \??\u: ucdeyypc.exe File opened (read-only) \??\w: ucdeyypc.exe File opened (read-only) \??\e: wyborbkrbq.exe File opened (read-only) \??\h: ucdeyypc.exe File opened (read-only) \??\n: wyborbkrbq.exe File opened (read-only) \??\w: wyborbkrbq.exe File opened (read-only) \??\q: ucdeyypc.exe File opened (read-only) \??\p: ucdeyypc.exe File opened (read-only) \??\x: ucdeyypc.exe File opened (read-only) \??\l: wyborbkrbq.exe File opened (read-only) \??\p: wyborbkrbq.exe File opened (read-only) \??\m: ucdeyypc.exe File opened (read-only) \??\q: ucdeyypc.exe File opened (read-only) \??\t: ucdeyypc.exe File opened (read-only) \??\h: wyborbkrbq.exe File opened (read-only) \??\s: wyborbkrbq.exe File opened (read-only) \??\r: ucdeyypc.exe File opened (read-only) \??\x: ucdeyypc.exe File opened (read-only) \??\z: ucdeyypc.exe File opened (read-only) \??\k: wyborbkrbq.exe File opened (read-only) \??\m: wyborbkrbq.exe File opened (read-only) \??\u: wyborbkrbq.exe File opened (read-only) \??\b: ucdeyypc.exe File opened (read-only) \??\e: ucdeyypc.exe File opened (read-only) \??\l: ucdeyypc.exe File opened (read-only) \??\q: wyborbkrbq.exe File opened (read-only) \??\e: ucdeyypc.exe File opened (read-only) \??\i: ucdeyypc.exe File opened (read-only) \??\y: ucdeyypc.exe File opened (read-only) \??\b: wyborbkrbq.exe File opened (read-only) \??\r: wyborbkrbq.exe File opened (read-only) \??\a: ucdeyypc.exe File opened (read-only) \??\l: ucdeyypc.exe File opened (read-only) \??\y: wyborbkrbq.exe File opened (read-only) \??\h: ucdeyypc.exe File opened (read-only) \??\j: ucdeyypc.exe File opened (read-only) \??\o: ucdeyypc.exe File opened (read-only) \??\o: wyborbkrbq.exe File opened (read-only) \??\v: wyborbkrbq.exe File opened (read-only) \??\o: ucdeyypc.exe File opened (read-only) \??\s: ucdeyypc.exe File opened (read-only) \??\s: ucdeyypc.exe File opened (read-only) \??\v: ucdeyypc.exe File opened (read-only) \??\a: wyborbkrbq.exe File opened (read-only) \??\v: ucdeyypc.exe File opened (read-only) \??\y: ucdeyypc.exe File opened (read-only) \??\a: ucdeyypc.exe File opened (read-only) \??\b: ucdeyypc.exe File opened (read-only) \??\p: ucdeyypc.exe File opened (read-only) \??\w: ucdeyypc.exe File opened (read-only) \??\z: ucdeyypc.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" wyborbkrbq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" wyborbkrbq.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2920-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233cb-5.dat autoit_exe behavioral2/files/0x00080000000233ca-19.dat autoit_exe behavioral2/files/0x00070000000233cc-27.dat autoit_exe behavioral2/files/0x00070000000233cd-32.dat autoit_exe behavioral2/files/0x0002000000022999-66.dat autoit_exe behavioral2/files/0x00080000000233b7-71.dat autoit_exe behavioral2/files/0x000c0000000233ff-283.dat autoit_exe behavioral2/files/0x000c0000000233ff-555.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rntddxbdghltfrb.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rjpalcbnyoyzq.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll wyborbkrbq.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ucdeyypc.exe File created C:\Windows\SysWOW64\rjpalcbnyoyzq.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ucdeyypc.exe File created C:\Windows\SysWOW64\wyborbkrbq.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wyborbkrbq.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe File created C:\Windows\SysWOW64\rntddxbdghltfrb.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe File created C:\Windows\SysWOW64\ucdeyypc.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ucdeyypc.exe 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ucdeyypc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ucdeyypc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ucdeyypc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ucdeyypc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ucdeyypc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ucdeyypc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ucdeyypc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ucdeyypc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ucdeyypc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ucdeyypc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ucdeyypc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ucdeyypc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ucdeyypc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ucdeyypc.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ucdeyypc.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ucdeyypc.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ucdeyypc.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ucdeyypc.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ucdeyypc.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ucdeyypc.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ucdeyypc.exe File opened for modification C:\Windows\mydoc.rtf 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf wyborbkrbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wyborbkrbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wyborbkrbq.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat wyborbkrbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" wyborbkrbq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc wyborbkrbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" wyborbkrbq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg wyborbkrbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442D089C5283506D3E76D270562DDC7DF565D8" 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B1294795399852BEB9A233EED7C5" 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F88FF8D4F5B85699134D75D7D97BDE3E6405931664E6234D6EC" 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193AC60915E5DBC2B8BC7CE3ED9F34CC" 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCEFABAFE10F1E283743A3286993995B08802FC4364023DE1C8459B08A8" 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08068C3FE1D22D8D178D1A78A089116" 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" wyborbkrbq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh wyborbkrbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" wyborbkrbq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs wyborbkrbq.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1860 WINWORD.EXE 1860 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 3972 ucdeyypc.exe 3972 ucdeyypc.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 3972 ucdeyypc.exe 3972 ucdeyypc.exe 3972 ucdeyypc.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 1128 rntddxbdghltfrb.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 3520 ucdeyypc.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 1400 wyborbkrbq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 2820 rjpalcbnyoyzq.exe 3972 ucdeyypc.exe 3972 ucdeyypc.exe 3972 ucdeyypc.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1860 WINWORD.EXE 1860 WINWORD.EXE 1860 WINWORD.EXE 1860 WINWORD.EXE 1860 WINWORD.EXE 1860 WINWORD.EXE 1860 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2920 wrote to memory of 1400 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 82 PID 2920 wrote to memory of 1400 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 82 PID 2920 wrote to memory of 1400 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 82 PID 2920 wrote to memory of 1128 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 83 PID 2920 wrote to memory of 1128 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 83 PID 2920 wrote to memory of 1128 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 83 PID 2920 wrote to memory of 3520 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 84 PID 2920 wrote to memory of 3520 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 84 PID 2920 wrote to memory of 3520 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 84 PID 2920 wrote to memory of 2820 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 85 PID 2920 wrote to memory of 2820 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 85 PID 2920 wrote to memory of 2820 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 85 PID 2920 wrote to memory of 1860 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 86 PID 2920 wrote to memory of 1860 2920 92d316761c31264a04924ebbac68070d_JaffaCakes118.exe 86 PID 1400 wrote to memory of 3972 1400 wyborbkrbq.exe 89 PID 1400 wrote to memory of 3972 1400 wyborbkrbq.exe 89 PID 1400 wrote to memory of 3972 1400 wyborbkrbq.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\92d316761c31264a04924ebbac68070d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\92d316761c31264a04924ebbac68070d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\wyborbkrbq.exewyborbkrbq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\ucdeyypc.exeC:\Windows\system32\ucdeyypc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3972
-
-
-
C:\Windows\SysWOW64\rntddxbdghltfrb.exerntddxbdghltfrb.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1128
-
-
C:\Windows\SysWOW64\ucdeyypc.exeucdeyypc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3520
-
-
C:\Windows\SysWOW64\rjpalcbnyoyzq.exerjpalcbnyoyzq.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2820
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1860
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 915e2342ad20946cdc25ae368a2cb4afeaf1c29a46d19c44fd3a6c5ffa600169
- MD5 1fecd416dd229115f28b9c085347ef37
- SHA1 77c62233bc410f70da8514c91c365f4e7a9b7c0b
- SHA512 a435959de8b54454e37fdc096afc25cd557298eef4af8a150ef25bd95c83d7fecdc34ac3eaf1b66f39e6479500803739b54fb1b1e35e72b048990b1c55a094fb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 e53f28e3c41e0f4b7da0c5378253c2a65ca84e7121f7f9575af873b030140657
- MD5 110cbf688d7c08b6d8000bcb00f2db39
- SHA1 daa6808c952a1a37c30651085232de0f590cdae3
- SHA512 43cfff25e1f971f437e47ea1edd58bfaad0e08ae9f22f1b85020ecf9733acdbe56a674b79acc08c8a83bfef5bc10b327add8da1bf31115a26ccbd249cb3de337
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD91AD.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 247B
- SHA256 774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440
- MD5 1b529425a37b1334b8b33ebd890269a4
- SHA1 84768e6475b45e3431d5dd62968dde9b92bcb799
- SHA512 8d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 a87317396ce665cf916c9e891baf626fa5f2c0658799216b19f8eb84130db409
- MD5 7bd0d2af105a5abbc1528a396762a226
- SHA1 d15861834cf732ba5d3fd8e6bbde72cd6b269ed7
- SHA512 d2f293334ec17c2125c23972b4c3b9257ccb830ef1cd987f39d00ae1df145c74d13448fc7b959335db5a709df1f4738b40093abb0001aec9b622917eb5c0c91d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 732dc1c62a3d0839ae45909657162093cd48282c0ccb4df22492af5e6e007d29
- MD5 21bbc36df0d96e23e61092fb25a60ccd
- SHA1 9985c34a8d16b1b4bc7228c4913c1975880b93d5
- SHA512 e1840a1801904f44b928d050e9551ae9f281b6e87129db99f01e512c648be5f3f2302e394dd0a1e579ac53fa0b41bdc77c1336d3f232c0086fe200c85a3e2c5c
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\rjpalcbnyoyzq.exe
- Size 512KB
- SHA256 7d51cc63b9cc54a4b8ab92814c7e379e9b20cfad3d310eb773854c8ed05f325b
- MD5 271e4b2d97106654865591e156f54be6
- SHA1 dbfe1dfaadb462c91f756296607b8e3d11676b42
- SHA512 e6623c1979f95b6866d755655fe22149ce3909a332da2af444815ba738b32a7aafa9d1f10d76349e60a326669570c75b8acb707fd3a87786a7ce8849e291da3c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rntddxbdghltfrb.exe
- Size 512KB
- SHA256 9557ddc602bb3361da253f13a2e1d575cb2818184683863e56c717240ad332cc
- MD5 e9a69ed116eb7f46faa25d748b087bc3
- SHA1 bb2a06ddade4f2bc17dbc94f0fa29b599170557c
- SHA512 e6aaca90024689c6d7ca2172c650e536e9fe7f41c9119ecf9306bfa2a0015b53aeec516d55f951726a32eef77bc5d626b3cc039f561ef2013719ee1a01cf08a4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ucdeyypc.exe
- Size 512KB
- SHA256 18c4cb18ea53fdd1c87072d96fe762bf19b8efce94532ce7d5478a1ac17c356d
- MD5 85bda61091d1cbdfd5017471a883a936
- SHA1 8f93f1395d8137811324c75113aa89c886f04878
- SHA512 8e6c5bbe833207663cee20096824e39bcf19a2e6cf26f9981c6ff8cf06e8368066baf09ea1a7ae2da3a4358e619e3d026eea9fc7f27a9a6e78e519df6318ccc2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wyborbkrbq.exe
- Size 512KB
- SHA256 7aafe3d82944ae326c5e54ef83a13196f5cb1c5ad27549e1aaf9e22726befdab
- MD5 40f50db46433c1ebb6f4cf5ee0fc0ebb
- SHA1 780957388694fa752023d21b14252196efdff84f
- SHA512 22f9b51b04dabbb602385d0a9146e6101e899eced6a15d332df633a470615534291d55e596bd979bb2ee09f5060d475ae84b3c2d6d12bdd2cc5f604a3bfc77d4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 db7c4b5c9a78b8e92a8938003ffa4f634b0c7ce2428c33284b54bcbf438d4394
- MD5 77d14c1466a8ffdeed5b56b339458edc
- SHA1 5856145843b5421c367884cb2ba4ff80408c592b
- SHA512 81727ed79f57bff17d5c9f66b978c610c3f72a818e84f4f199d639f303c735b96f60e387011c6a050d5be06ac2d8f18e2cb718cde22778152a2ea153cbb24f7d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 61ee5642445109a70ff958d3dae0d2c1168bcc612dfc40fbebc3d764d31474d0
- MD5 3ad2efd68ac89aebc9204bc553d2b4c8
- SHA1 0635bcb0de528d33a2aa8bc3f7fc692367dc3732
- SHA512 b2efabfcc3b1e9ce99ac9d20c32b09d1bdff323098fa0650e4a1259f1507c8c823bde1b03347be1ec776ce512e5429adfe5fc2d03c56a4df0bd581ad9f4646ba
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- MD5 SHA1 SHA512 SSDEEP