Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 04:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe
- Size 512KB
- Sample240603-e1kwxsce66
- SHA256 f0c05bffc0e423d5a620c9cdf4321d2982651320bb960c28bebb3c64e35000b9
- MD5 9085257f73856569fae373230fbc6d9e
- SHA1 9f0a89845c9b8b93c477214ebc560a9396476537
- SHA512 ad82342f43d3beac6e8732f39dd6b6ef860cb4cd48fef1ff309d9bc887cc8092494b6ad58dd659573490de58a0c7390a5cea66b58c4065a03c943e921e53d28b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" gkdohbqkhv.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gkdohbqkhv.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gkdohbqkhv.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gkdohbqkhv.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2996 gkdohbqkhv.exe 1232 edcdtjppknptgfi.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 2976 bowefidx.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gkdohbqkhv.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cimwsbml = "gkdohbqkhv.exe" edcdtjppknptgfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rnenmcla = "edcdtjppknptgfi.exe" edcdtjppknptgfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "bbkanbtabnskj.exe" edcdtjppknptgfi.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: bowefidx.exe File opened (read-only) \??\z: bowefidx.exe File opened (read-only) \??\q: gkdohbqkhv.exe File opened (read-only) \??\z: bowefidx.exe File opened (read-only) \??\e: bowefidx.exe File opened (read-only) \??\x: gkdohbqkhv.exe File opened (read-only) \??\t: bowefidx.exe File opened (read-only) \??\b: bowefidx.exe File opened (read-only) \??\h: bowefidx.exe File opened (read-only) \??\m: gkdohbqkhv.exe File opened (read-only) \??\p: gkdohbqkhv.exe File opened (read-only) \??\r: bowefidx.exe File opened (read-only) \??\y: bowefidx.exe File opened (read-only) \??\h: gkdohbqkhv.exe File opened (read-only) \??\k: gkdohbqkhv.exe File opened (read-only) \??\p: bowefidx.exe File opened (read-only) \??\i: bowefidx.exe File opened (read-only) \??\k: bowefidx.exe File opened (read-only) \??\n: bowefidx.exe File opened (read-only) \??\p: bowefidx.exe File opened (read-only) \??\u: bowefidx.exe File opened (read-only) \??\e: bowefidx.exe File opened (read-only) \??\j: bowefidx.exe File opened (read-only) \??\j: bowefidx.exe File opened (read-only) \??\v: bowefidx.exe File opened (read-only) \??\a: gkdohbqkhv.exe File opened (read-only) \??\k: bowefidx.exe File opened (read-only) \??\m: bowefidx.exe File opened (read-only) \??\o: bowefidx.exe File opened (read-only) \??\q: bowefidx.exe File opened (read-only) \??\t: bowefidx.exe File opened (read-only) \??\s: gkdohbqkhv.exe File opened (read-only) \??\u: gkdohbqkhv.exe File opened (read-only) \??\i: bowefidx.exe File opened (read-only) \??\l: bowefidx.exe File opened (read-only) \??\s: bowefidx.exe File opened (read-only) \??\n: gkdohbqkhv.exe File opened (read-only) \??\r: bowefidx.exe File opened (read-only) \??\q: bowefidx.exe File opened (read-only) \??\z: gkdohbqkhv.exe File opened (read-only) \??\v: bowefidx.exe File opened (read-only) \??\g: bowefidx.exe File opened (read-only) \??\m: bowefidx.exe File opened (read-only) \??\x: bowefidx.exe File opened (read-only) \??\v: gkdohbqkhv.exe File opened (read-only) \??\w: gkdohbqkhv.exe File opened (read-only) \??\w: bowefidx.exe File opened (read-only) \??\b: gkdohbqkhv.exe File opened (read-only) \??\g: gkdohbqkhv.exe File opened (read-only) \??\l: gkdohbqkhv.exe File opened (read-only) \??\r: gkdohbqkhv.exe File opened (read-only) \??\t: gkdohbqkhv.exe File opened (read-only) \??\u: bowefidx.exe File opened (read-only) \??\x: bowefidx.exe File opened (read-only) \??\e: gkdohbqkhv.exe File opened (read-only) \??\o: gkdohbqkhv.exe File opened (read-only) \??\y: bowefidx.exe File opened (read-only) \??\y: gkdohbqkhv.exe File opened (read-only) \??\h: bowefidx.exe File opened (read-only) \??\n: bowefidx.exe File opened (read-only) \??\l: bowefidx.exe File opened (read-only) \??\w: bowefidx.exe File opened (read-only) \??\b: bowefidx.exe File opened (read-only) \??\g: bowefidx.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" gkdohbqkhv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" gkdohbqkhv.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/432-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233f4-5.dat autoit_exe behavioral2/files/0x00080000000233f0-18.dat autoit_exe behavioral2/files/0x00070000000233f5-28.dat autoit_exe behavioral2/files/0x00070000000233f6-32.dat autoit_exe behavioral2/files/0x00080000000233aa-70.dat autoit_exe behavioral2/files/0x0007000000023402-74.dat autoit_exe behavioral2/files/0x001300000002341a-474.dat autoit_exe behavioral2/files/0x001300000002341a-578.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\gkdohbqkhv.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bowefidx.exe File created C:\Windows\SysWOW64\gkdohbqkhv.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File created C:\Windows\SysWOW64\bowefidx.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bowefidx.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bbkanbtabnskj.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll gkdohbqkhv.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bowefidx.exe File created C:\Windows\SysWOW64\edcdtjppknptgfi.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\edcdtjppknptgfi.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bowefidx.exe File created C:\Windows\SysWOW64\bbkanbtabnskj.exe 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bowefidx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bowefidx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bowefidx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bowefidx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bowefidx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bowefidx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bowefidx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bowefidx.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bowefidx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bowefidx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bowefidx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bowefidx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bowefidx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bowefidx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bowefidx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification C:\Windows\mydoc.rtf 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bowefidx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bowefidx.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf gkdohbqkhv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs gkdohbqkhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACFFAB0F911F1E284743B4B819B3E91B0FB02FA4268023DE1C942E608A3" 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F26BC3FE6922DFD173D0D38A749166" 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" gkdohbqkhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" gkdohbqkhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B15A4490399853C8BAA232EAD4CE" 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E88FFFC482B85699136D75A7E91BD97E130593266446335D79E" 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc gkdohbqkhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" gkdohbqkhv.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C67F15E7DAB5B8C97CE7ED9234C8" 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" gkdohbqkhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" gkdohbqkhv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg gkdohbqkhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33442C0A9C2D83506A3476D277272CAE7D8665DF" 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat gkdohbqkhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" gkdohbqkhv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh gkdohbqkhv.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1764 WINWORD.EXE 1764 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 1580 bowefidx.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 1580 bowefidx.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 1580 bowefidx.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 1580 bowefidx.exe 1580 bowefidx.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 2996 gkdohbqkhv.exe 1232 edcdtjppknptgfi.exe 1232 edcdtjppknptgfi.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 5040 bbkanbtabnskj.exe 2976 bowefidx.exe 2976 bowefidx.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 1580 bowefidx.exe 1232 edcdtjppknptgfi.exe 2996 gkdohbqkhv.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 1232 edcdtjppknptgfi.exe 2996 gkdohbqkhv.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 1232 edcdtjppknptgfi.exe 2996 gkdohbqkhv.exe 5040 bbkanbtabnskj.exe 2976 bowefidx.exe 2976 bowefidx.exe 2976 bowefidx.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 1580 bowefidx.exe 1232 edcdtjppknptgfi.exe 2996 gkdohbqkhv.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 1232 edcdtjppknptgfi.exe 2996 gkdohbqkhv.exe 1580 bowefidx.exe 5040 bbkanbtabnskj.exe 1232 edcdtjppknptgfi.exe 2996 gkdohbqkhv.exe 5040 bbkanbtabnskj.exe 2976 bowefidx.exe 2976 bowefidx.exe 2976 bowefidx.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1764 WINWORD.EXE 1764 WINWORD.EXE 1764 WINWORD.EXE 1764 WINWORD.EXE 1764 WINWORD.EXE 1764 WINWORD.EXE 1764 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 432 wrote to memory of 2996 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 83 PID 432 wrote to memory of 2996 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 83 PID 432 wrote to memory of 2996 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 83 PID 432 wrote to memory of 1232 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 84 PID 432 wrote to memory of 1232 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 84 PID 432 wrote to memory of 1232 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 84 PID 432 wrote to memory of 1580 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 85 PID 432 wrote to memory of 1580 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 85 PID 432 wrote to memory of 1580 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 85 PID 432 wrote to memory of 5040 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 86 PID 432 wrote to memory of 5040 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 86 PID 432 wrote to memory of 5040 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 86 PID 432 wrote to memory of 1764 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 87 PID 432 wrote to memory of 1764 432 9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe 87 PID 2996 wrote to memory of 2976 2996 gkdohbqkhv.exe 90 PID 2996 wrote to memory of 2976 2996 gkdohbqkhv.exe 90 PID 2996 wrote to memory of 2976 2996 gkdohbqkhv.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9085257f73856569fae373230fbc6d9e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\gkdohbqkhv.exegkdohbqkhv.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\bowefidx.exeC:\Windows\system32\bowefidx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2976
-
-
-
C:\Windows\SysWOW64\edcdtjppknptgfi.exeedcdtjppknptgfi.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1232
-
-
C:\Windows\SysWOW64\bowefidx.exebowefidx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1580
-
-
C:\Windows\SysWOW64\bbkanbtabnskj.exebbkanbtabnskj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5040
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1764
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 a3362bdf5f1d1e3bcaa08f969b353c6421240d4bdc13d4839f646098aa2b21d4
- MD5 22f4dc02c38f69d35aa482201e854054
- SHA1 45950783afa16d22cec71d8bf07e253244fafec3
- SHA512 48c8d70a5de6d0f649c575d7527105d2e9649c11c546b0d14d8cc5d93a68816de87dc9aa0cb640a7540d31313894e7e417559c7c533372d3d9b4ce4a00ddb451
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 b735100996bb5c9774c069f3915fa503ba0980c4b6f1a9b0aff55dd6fdb2f1d1
- MD5 309487341eb00793f01996594cb4930f
- SHA1 686ad07b37c0dcdc2bdceb2f11f0962c7698cdf6
- SHA512 4566c24088a673dad7a03d185343ef58c57b62673ee7f059d0f4b9547f6d7e4ae401a0ed88dbc91084f583e72d1c00bef8c6dd16d35ff358d99d80f6ffd3d2b4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD966E.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 55d94efcf88bfbf854951cf97b177140c3801419a021964483fe168f74b5c7c8
- MD5 e1bbb85be6a5634897e0106ea20a2bc2
- SHA1 6888b298c60e2d7f28ac8aadac41f6e36e1bc92c
- SHA512 8e1a7da4450425fe66307a1ebc03be130331cdda8e6acefa7e436148cb027d0cda6cd2e32fa5bed70f781426f1e77c94977a7d29bbd2c8c4299d2f153526750a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 e6b977b777f4ff7a90216dfaeb108a0804a26424323e49f38563a7f5ba8360ce
- MD5 1ff2246e450cef083580883b47b2f1be
- SHA1 396063149c13633cd604ce4d2b80ed2e6d20eded
- SHA512 305111b5f40e6732ac012aa2c4ff481810379b6c7a3ef4fdc1b97d24aa9a3e5826ba89b0766ff81ea2796d99bc01422796f03203d1acb17fb956631513c1a36b
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\bbkanbtabnskj.exe
- Size 512KB
- SHA256 e224008f710c1a17a6c419efd2d2de334e1eac40f2d5a45667f42f4b81a59491
- MD5 c879915358bfe32c24e1f971b7e8d219
- SHA1 516c6820cf8f476c33ad14edbf72189f49a020b5
- SHA512 c4bf072db2cefcc80e71c023a4e867c97d0a79346d087f1f6e5c660299c1f5c8db716d750f81c7225835f06bd53ee17dd4eed29cc4d592ca6a20f13fce11f9be
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6s:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\bowefidx.exe
- Size 512KB
- SHA256 c6427537867fbef27304001cad488fa2cfc6fc9318e8d853f114e360ac2c7f55
- MD5 cd036d85bd724b179c8fb3d646cd7c86
- SHA1 071c59fd92375b87f602f100082b0ac60af2bcc4
- SHA512 489052395b00c1c8abd140590b5bc904b25d5d3f4b7671a1e548769c70e0e7b59874ecbe37ae2516b1e3739b0996179398c35e541b9c917bc98c12eaeed7632f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\edcdtjppknptgfi.exe
- Size 512KB
- SHA256 572b0cbe26cb7c1e503939e8a14c463cff6295e92e3afd8800c7fd9d32548783
- MD5 f4a24b77fe6f694da7ca26b93c5bb4c3
- SHA1 7d2061e66d2c0fea83dd997d5eef250e8440ab42
- SHA512 8124c95dee0a3eb738f795f422ec32e50fca9dd93d80b81451e9e3f4d7b20cc62c32d17589dec1d1fbb809b2fc19d4ebafda6f6e915c6355c0109f3015baf808
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\gkdohbqkhv.exe
- Size 512KB
- SHA256 b7e8ba7243e977970bdf5d454122f192a57bea0ec31b34656e6e20f7466b6034
- MD5 c65d2cb2ea4027ad13904802d8a64139
- SHA1 b2ad673b2c7212d11772c0fb91b5783bff081514
- SHA512 0c05e0cccf45e0ff7579fa13fe31868e7a083ce998c9f118c858cb5c5ffb6bea61e37c3eb286ecaecdd779180761ac27e9b92ea9b5f2e6a201b6554153a918f6
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 9c158f93431b9cbd0641eee6545b6a14626de8ded896f41309c999deffc69b5c
- MD5 14bedae34a11c187dc1788b7c1ea62f5
- SHA1 484f020ddf2c9234873ce6cf7f453955e2654a8e
- SHA512 38e0be5c23540e7bd9c4c864be8d040c6d565ba0bb803b853493d08ff4eeedfd45fd1077f82036b1c0e4c5737ada957f24962ff80870fade75df756b4e05d29a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 20e503e174884239f686b5aa1090a9f0feb745e3c0e6599099d9911c47914a04
- MD5 a605e4a84820efb192bf71a571af0403
- SHA1 67bccae664eb786b6f7b1fb83e0858a81d18cb83
- SHA512 e428e372c40ee9408dcf1fb65c4edf8f5e4aa355cfc367ffe2566449fcf1fc31396fa07a3322c59bae187e7e86d86af12e0d58f578ef34821b1ae627a73ad883
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6s:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- MD5 SHA1 SHA512 SSDEEP