Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 04:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe
- Size 512KB
- Sample240603-eqel6acb35
- SHA256 3bc7c7c6b0cb63439f38967db6208aa7f01d3ce2b7a33ee21e6908a4d71b4094
- MD5 907c7706855e1a1c8016df3a48687567
- SHA1 d7385627202131c8201d7eca990123854b769467
- SHA512 03b0361e8cf1c09256dd83c7209b15b271822bd7d91d4be4420260dc71e7ec3be2cad068e73f079cad56d63b685942895112bf9536bc1468d598b9921f00f654
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hdreybhkyq.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hdreybhkyq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hdreybhkyq.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hdreybhkyq.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2416 hdreybhkyq.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 2228 pyjpryotvlvwf.exe 3088 snkbzruf.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hdreybhkyq.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntvzppps = "hdreybhkyq.exe" woaeucbyvqrgqon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sbopkytw = "woaeucbyvqrgqon.exe" woaeucbyvqrgqon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "pyjpryotvlvwf.exe" woaeucbyvqrgqon.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: hdreybhkyq.exe File opened (read-only) \??\v: snkbzruf.exe File opened (read-only) \??\p: snkbzruf.exe File opened (read-only) \??\b: hdreybhkyq.exe File opened (read-only) \??\s: hdreybhkyq.exe File opened (read-only) \??\o: snkbzruf.exe File opened (read-only) \??\p: hdreybhkyq.exe File opened (read-only) \??\i: snkbzruf.exe File opened (read-only) \??\p: snkbzruf.exe File opened (read-only) \??\w: snkbzruf.exe File opened (read-only) \??\z: snkbzruf.exe File opened (read-only) \??\l: snkbzruf.exe File opened (read-only) \??\v: snkbzruf.exe File opened (read-only) \??\y: snkbzruf.exe File opened (read-only) \??\s: snkbzruf.exe File opened (read-only) \??\j: snkbzruf.exe File opened (read-only) \??\w: snkbzruf.exe File opened (read-only) \??\e: snkbzruf.exe File opened (read-only) \??\z: snkbzruf.exe File opened (read-only) \??\n: hdreybhkyq.exe File opened (read-only) \??\r: hdreybhkyq.exe File opened (read-only) \??\u: snkbzruf.exe File opened (read-only) \??\e: hdreybhkyq.exe File opened (read-only) \??\g: hdreybhkyq.exe File opened (read-only) \??\l: hdreybhkyq.exe File opened (read-only) \??\m: hdreybhkyq.exe File opened (read-only) \??\e: snkbzruf.exe File opened (read-only) \??\q: snkbzruf.exe File opened (read-only) \??\s: snkbzruf.exe File opened (read-only) \??\x: snkbzruf.exe File opened (read-only) \??\u: hdreybhkyq.exe File opened (read-only) \??\v: hdreybhkyq.exe File opened (read-only) \??\b: snkbzruf.exe File opened (read-only) \??\t: snkbzruf.exe File opened (read-only) \??\i: hdreybhkyq.exe File opened (read-only) \??\h: snkbzruf.exe File opened (read-only) \??\u: snkbzruf.exe File opened (read-only) \??\y: snkbzruf.exe File opened (read-only) \??\k: hdreybhkyq.exe File opened (read-only) \??\o: hdreybhkyq.exe File opened (read-only) \??\k: snkbzruf.exe File opened (read-only) \??\m: snkbzruf.exe File opened (read-only) \??\g: snkbzruf.exe File opened (read-only) \??\y: hdreybhkyq.exe File opened (read-only) \??\z: hdreybhkyq.exe File opened (read-only) \??\g: snkbzruf.exe File opened (read-only) \??\h: hdreybhkyq.exe File opened (read-only) \??\w: hdreybhkyq.exe File opened (read-only) \??\a: snkbzruf.exe File opened (read-only) \??\b: snkbzruf.exe File opened (read-only) \??\j: hdreybhkyq.exe File opened (read-only) \??\q: snkbzruf.exe File opened (read-only) \??\l: snkbzruf.exe File opened (read-only) \??\i: snkbzruf.exe File opened (read-only) \??\n: snkbzruf.exe File opened (read-only) \??\o: snkbzruf.exe File opened (read-only) \??\x: snkbzruf.exe File opened (read-only) \??\a: hdreybhkyq.exe File opened (read-only) \??\j: snkbzruf.exe File opened (read-only) \??\n: snkbzruf.exe File opened (read-only) \??\h: snkbzruf.exe File opened (read-only) \??\k: snkbzruf.exe File opened (read-only) \??\r: snkbzruf.exe File opened (read-only) \??\x: hdreybhkyq.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" hdreybhkyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" hdreybhkyq.exe - AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2964-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0008000000023242-5.dat autoit_exe behavioral2/files/0x000800000002323e-18.dat autoit_exe behavioral2/files/0x0008000000023245-24.dat autoit_exe behavioral2/files/0x0008000000023246-32.dat autoit_exe behavioral2/files/0x0007000000023251-61.dat autoit_exe behavioral2/files/0x000300000000070d-94.dat autoit_exe behavioral2/files/0x000300000000070d-99.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\pyjpryotvlvwf.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe snkbzruf.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe snkbzruf.exe File opened for modification C:\Windows\SysWOW64\snkbzruf.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\pyjpryotvlvwf.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll hdreybhkyq.exe File created C:\Windows\SysWOW64\hdreybhkyq.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hdreybhkyq.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\woaeucbyvqrgqon.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File created C:\Windows\SysWOW64\snkbzruf.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File created C:\Windows\SysWOW64\woaeucbyvqrgqon.exe 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe snkbzruf.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe snkbzruf.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe snkbzruf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal snkbzruf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal snkbzruf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe snkbzruf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe snkbzruf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe snkbzruf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe snkbzruf.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg hdreybhkyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C7C9D5283236D3576D2702E2CAE7C8765D8" 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC9FABBF917F1E584753B4286993E98B389038A4211033EE2CF42EF08A4" 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78468B1FF1D22A9D10BD1D58B799010" 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193AC60815EDDBC2B8CF7F92ECE537CE" 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" hdreybhkyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs hdreybhkyq.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB1B15D47E5399952C4B9D033E9D7B9" 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8EFC8E482A826A9041D62E7DE1BC90E634594B66416242D7E9" 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" hdreybhkyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc hdreybhkyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf hdreybhkyq.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat hdreybhkyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" hdreybhkyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh hdreybhkyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" hdreybhkyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" hdreybhkyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" hdreybhkyq.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1760 WINWORD.EXE 1760 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 4528 snkbzruf.exe 4528 snkbzruf.exe 4528 snkbzruf.exe 4528 snkbzruf.exe 4528 snkbzruf.exe 4528 snkbzruf.exe 4528 snkbzruf.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 4032 woaeucbyvqrgqon.exe 4032 woaeucbyvqrgqon.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 3088 snkbzruf.exe 3088 snkbzruf.exe 3088 snkbzruf.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 2416 hdreybhkyq.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 4528 snkbzruf.exe 4032 woaeucbyvqrgqon.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 2228 pyjpryotvlvwf.exe 3088 snkbzruf.exe 3088 snkbzruf.exe 3088 snkbzruf.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1760 WINWORD.EXE 1760 WINWORD.EXE 1760 WINWORD.EXE 1760 WINWORD.EXE 1760 WINWORD.EXE 1760 WINWORD.EXE 1760 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2416 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 90 PID 2964 wrote to memory of 2416 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 90 PID 2964 wrote to memory of 2416 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 90 PID 2964 wrote to memory of 4032 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 91 PID 2964 wrote to memory of 4032 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 91 PID 2964 wrote to memory of 4032 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 91 PID 2964 wrote to memory of 4528 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 92 PID 2964 wrote to memory of 4528 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 92 PID 2964 wrote to memory of 4528 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 92 PID 2964 wrote to memory of 2228 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 93 PID 2964 wrote to memory of 2228 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 93 PID 2964 wrote to memory of 2228 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 93 PID 2416 wrote to memory of 3088 2416 hdreybhkyq.exe 94 PID 2416 wrote to memory of 3088 2416 hdreybhkyq.exe 94 PID 2416 wrote to memory of 3088 2416 hdreybhkyq.exe 94 PID 2964 wrote to memory of 1760 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 95 PID 2964 wrote to memory of 1760 2964 907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\907c7706855e1a1c8016df3a48687567_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\hdreybhkyq.exehdreybhkyq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\snkbzruf.exeC:\Windows\system32\snkbzruf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3088
-
-
-
C:\Windows\SysWOW64\woaeucbyvqrgqon.exewoaeucbyvqrgqon.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4032
-
-
C:\Windows\SysWOW64\snkbzruf.exesnkbzruf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4528
-
-
C:\Windows\SysWOW64\pyjpryotvlvwf.exepyjpryotvlvwf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2228
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:4356
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 562d37100f7cfcb344b31c407bb7b22ec3e55edf1b7bd365a83de6ad2d9874e9
- MD5 90753e44fcb2e5057e633a6aa0cf3f0e
- SHA1 e3d5297641468c060a0bd5f2aa48efa4184a2921
- SHA512 eb722c4a55f1cbc2ed6a794b2d827830b52da535f339b5ee4e5597d2e9af694ba38637ec33d24b5bb88652ba78c18231695d68102370aecada0cf614aa471197
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 53000dba83fbf6aaca1b2fdec8ce92d718de743d3fe19dd104fc107eecc6f195
- MD5 41d3a75bb8c88294ba0e02b25b19682a
- SHA1 23dcc225e3c106948564336c355b22690add1289
- SHA512 14199b328a2e4ad792b77e99947278022023594dc4fe3c3c53f4b86d05272130373899726b7aa91a65a313227c18daeb700a791813b500d66da91ff9deec3d2a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 1a9e51a2a8ab05e6841aaf1e37c6bb04435526089d029d565645ed6ae6bce053
- MD5 e2df11367d377f3cb025dc95079d217b
- SHA1 cf588fd363130b67b56c6f32d239a08e18da4895
- SHA512 fcfd5cfebd7698a86e414e8879cf06046391348cd045d0451cf80c126e890fc7d2b7f5ced4fcc9a0ba969460fe0210fd1f8097c97d6d8a9161cd3a8d8af14d86
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\hdreybhkyq.exe
- Size 512KB
- SHA256 6d2a6196b206712189513710471b5a8e573c8af7927d87eb14f87b8bd47074ef
- MD5 775c9cc1cc094ea3a97704f10946dd4c
- SHA1 d9d80e81cdd7242197e6ea576797918ccbeb5b2e
- SHA512 3bc16a4f948ad28c717b9648a2e8ce305cf72e45652694cebe806c134da76480e7559303614fc8ce119239dacc726541142039186a350fe2af0c884f33aeadb6
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pyjpryotvlvwf.exe
- Size 512KB
- SHA256 f018b080e12a03bbd59a3b8fb10153876531c388e5f3ef3b353c8de31c66373d
- MD5 bbe0cc7d6f3e517a71cc4d27e489b329
- SHA1 00fc7e1a5a7fba566c8f11742f419d616f9da20c
- SHA512 1795aeddbecabc4c75114743c0a37c697341436341557df25969917f122114fe12516931b100bf6cf45505587bc82bf88d4ea5e2d7097ef09e740249dfad6ee9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\snkbzruf.exe
- Size 512KB
- SHA256 a4f9dab796adb9bfa4f812fff5ca9af7e4b73f59fa47e253c46b6571bea36a47
- MD5 04c108ab2a6f4d37c56e944486a1351d
- SHA1 605e8cff9ca6ea9fe1bfae02e29feb8d2ab256df
- SHA512 907926ffee5ff6dcb3476909a4ccfc26a4bc4f9d80c806edc012d88861a30e05a1825047c337a7d7111718a9a40fb69e3894c57581d3ec859586de80c9d92d02
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\woaeucbyvqrgqon.exe
- Size 512KB
- SHA256 4c06153a973710252fed898ba9178696edb4207a2d68302e6800a425a456be7d
- MD5 6ef845f5ee0465fa73d920e2afd8a175
- SHA1 c9cc57cefe4fca9f2ce0636e1a4f54873b8ada34
- SHA512 803ddc734f75d867cf75ab83301a70ca78578909c75e7e9816a6d66e27289e96ecd5240f15dc68cc752ea1e822a0c9f983eba27f515548a84255b9a8c62dab99
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 81af67442c7656db16542f339cae82391f540669c1d3d9305131528b67eeae93
- MD5 b551c2d502d46bec0b88fe2bc492d948
- SHA1 91a41e3f92b1bd8878e8c34eefe7740870fc3ce3
- SHA512 df528efae6997f2592dcd8b63d50e71cf47c38636da4fe90a13412376ecd1a15b91968716ae2274a044712993b731490b8fe9b63f4c735ce4f8f4e4229aec40f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj63:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 efccfbc733fa17312b5d244118b6dc972f07d5ad261b640878ac80183482de32
- MD5 9429484623d810295fdb6048848ca966
- SHA1 918db591cdc8127fae2e30073143e4c9c2914f56
- SHA512 4dfafdf7c760ce5bfed260db7f7e74d9ba76d9ce7de4ce9d906fa04fe4239e8764c57f4d311f84c30012b2f9b45b2ae882618f3cdb754e9fb11cd27a98ec8309
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- MD5 SHA1 SHA512 SSDEEP