Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe
- Size 512KB
- Sample240603-mpaktabe9w
- SHA256 4a4f92c2e6eb34edc411f9b7dd64b8a6bac92e67195271b334a0e618d8e9a550
- MD5 917888b4277b02e38683e3b9c17707d9
- SHA1 aac025aeb9f4b9ed72a761331a229b34fd4c000d
- SHA512 e9899481b04a718f710159c91ce3701b29e2343b26157ef11190232bbfb45e0fd3fbc39be47be65d85ff8ea51897a120de27143b80461b4bd0a3a27c37e99b1c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" zdsghrgrqa.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zdsghrgrqa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" zdsghrgrqa.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zdsghrgrqa.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 3068 ngkqnsuk.exe 4372 otvzwphqjewru.exe 2228 ngkqnsuk.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" zdsghrgrqa.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urtoubvc = "zdsghrgrqa.exe" nadjoutduagnujh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ypnzirlz = "nadjoutduagnujh.exe" nadjoutduagnujh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "otvzwphqjewru.exe" nadjoutduagnujh.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: zdsghrgrqa.exe File opened (read-only) \??\m: ngkqnsuk.exe File opened (read-only) \??\r: ngkqnsuk.exe File opened (read-only) \??\w: ngkqnsuk.exe File opened (read-only) \??\b: zdsghrgrqa.exe File opened (read-only) \??\q: zdsghrgrqa.exe File opened (read-only) \??\v: ngkqnsuk.exe File opened (read-only) \??\x: ngkqnsuk.exe File opened (read-only) \??\s: ngkqnsuk.exe File opened (read-only) \??\h: ngkqnsuk.exe File opened (read-only) \??\l: zdsghrgrqa.exe File opened (read-only) \??\b: ngkqnsuk.exe File opened (read-only) \??\e: ngkqnsuk.exe File opened (read-only) \??\x: ngkqnsuk.exe File opened (read-only) \??\m: ngkqnsuk.exe File opened (read-only) \??\a: zdsghrgrqa.exe File opened (read-only) \??\n: zdsghrgrqa.exe File opened (read-only) \??\v: zdsghrgrqa.exe File opened (read-only) \??\t: ngkqnsuk.exe File opened (read-only) \??\g: zdsghrgrqa.exe File opened (read-only) \??\z: zdsghrgrqa.exe File opened (read-only) \??\l: ngkqnsuk.exe File opened (read-only) \??\x: zdsghrgrqa.exe File opened (read-only) \??\k: ngkqnsuk.exe File opened (read-only) \??\j: ngkqnsuk.exe File opened (read-only) \??\q: ngkqnsuk.exe File opened (read-only) \??\y: ngkqnsuk.exe File opened (read-only) \??\u: ngkqnsuk.exe File opened (read-only) \??\i: ngkqnsuk.exe File opened (read-only) \??\k: ngkqnsuk.exe File opened (read-only) \??\p: ngkqnsuk.exe File opened (read-only) \??\i: zdsghrgrqa.exe File opened (read-only) \??\m: zdsghrgrqa.exe File opened (read-only) \??\o: zdsghrgrqa.exe File opened (read-only) \??\t: zdsghrgrqa.exe File opened (read-only) \??\y: ngkqnsuk.exe File opened (read-only) \??\e: zdsghrgrqa.exe File opened (read-only) \??\w: zdsghrgrqa.exe File opened (read-only) \??\o: ngkqnsuk.exe File opened (read-only) \??\v: ngkqnsuk.exe File opened (read-only) \??\p: zdsghrgrqa.exe File opened (read-only) \??\g: ngkqnsuk.exe File opened (read-only) \??\q: ngkqnsuk.exe File opened (read-only) \??\g: ngkqnsuk.exe File opened (read-only) \??\b: ngkqnsuk.exe File opened (read-only) \??\s: ngkqnsuk.exe File opened (read-only) \??\y: zdsghrgrqa.exe File opened (read-only) \??\n: ngkqnsuk.exe File opened (read-only) \??\o: ngkqnsuk.exe File opened (read-only) \??\a: ngkqnsuk.exe File opened (read-only) \??\w: ngkqnsuk.exe File opened (read-only) \??\t: ngkqnsuk.exe File opened (read-only) \??\z: ngkqnsuk.exe File opened (read-only) \??\s: zdsghrgrqa.exe File opened (read-only) \??\h: ngkqnsuk.exe File opened (read-only) \??\i: ngkqnsuk.exe File opened (read-only) \??\j: ngkqnsuk.exe File opened (read-only) \??\u: ngkqnsuk.exe File opened (read-only) \??\h: zdsghrgrqa.exe File opened (read-only) \??\k: zdsghrgrqa.exe File opened (read-only) \??\u: zdsghrgrqa.exe File opened (read-only) \??\r: ngkqnsuk.exe File opened (read-only) \??\p: ngkqnsuk.exe File opened (read-only) \??\z: ngkqnsuk.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" zdsghrgrqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" zdsghrgrqa.exe - AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2788-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023556-5.dat autoit_exe behavioral2/files/0x000900000002354f-19.dat autoit_exe behavioral2/files/0x0007000000023557-27.dat autoit_exe behavioral2/files/0x0007000000023558-32.dat autoit_exe behavioral2/files/0x0008000000023416-66.dat autoit_exe behavioral2/files/0x0008000000023417-68.dat autoit_exe behavioral2/files/0x0007000000023564-76.dat autoit_exe behavioral2/files/0x00080000000232d4-82.dat autoit_exe behavioral2/files/0x001f000000023579-532.dat autoit_exe behavioral2/files/0x001f000000023579-587.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\zdsghrgrqa.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File created C:\Windows\SysWOW64\otvzwphqjewru.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\otvzwphqjewru.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification C:\Windows\SysWOW64\zdsghrgrqa.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File created C:\Windows\SysWOW64\nadjoutduagnujh.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nadjoutduagnujh.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File created C:\Windows\SysWOW64\ngkqnsuk.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ngkqnsuk.exe 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll zdsghrgrqa.exe - Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngkqnsuk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngkqnsuk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ngkqnsuk.exe File created \??\c:\Program Files\StepReceive.doc.exe ngkqnsuk.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngkqnsuk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngkqnsuk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngkqnsuk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ngkqnsuk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngkqnsuk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ngkqnsuk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngkqnsuk.exe File opened for modification \??\c:\Program Files\StepReceive.doc.exe ngkqnsuk.exe File opened for modification C:\Program Files\StepReceive.nal ngkqnsuk.exe File opened for modification C:\Program Files\StepReceive.nal ngkqnsuk.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngkqnsuk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngkqnsuk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ngkqnsuk.exe File opened for modification C:\Program Files\StepReceive.doc.exe ngkqnsuk.exe File opened for modification C:\Program Files\StepReceive.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Program Files\StepReceive.doc.exe ngkqnsuk.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngkqnsuk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngkqnsuk.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification C:\Windows\mydoc.rtf 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngkqnsuk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngkqnsuk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngkqnsuk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" zdsghrgrqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg zdsghrgrqa.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBFACCF910F193837F3A44819F3995B38A028A4316034EE2CB42EA08A2" 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302C7C9D5183586A3477D270212DDC7C8F64D8" 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFEFC834F26821B9046D65C7D9DBC97E141594266406245D691" 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C70E15ECDBB1B8CD7FE6ED9237BC" 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh zdsghrgrqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf zdsghrgrqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs zdsghrgrqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC5B12D47E538E353BFB9D133E9D7CD" 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F468B7FF1B21AED10CD0D38B7F9110" 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3832 WINWORD.EXE 3832 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3096 nadjoutduagnujh.exe 3096 nadjoutduagnujh.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 2228 ngkqnsuk.exe 2228 ngkqnsuk.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 2228 ngkqnsuk.exe 2228 ngkqnsuk.exe 2228 ngkqnsuk.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 1052 zdsghrgrqa.exe 3096 nadjoutduagnujh.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 4372 otvzwphqjewru.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 3068 ngkqnsuk.exe 2228 ngkqnsuk.exe 2228 ngkqnsuk.exe 2228 ngkqnsuk.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3832 WINWORD.EXE 3832 WINWORD.EXE 3832 WINWORD.EXE 3832 WINWORD.EXE 3832 WINWORD.EXE 3832 WINWORD.EXE 3832 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2788 wrote to memory of 1052 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 90 PID 2788 wrote to memory of 1052 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 90 PID 2788 wrote to memory of 1052 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 90 PID 2788 wrote to memory of 3096 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 91 PID 2788 wrote to memory of 3096 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 91 PID 2788 wrote to memory of 3096 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 91 PID 2788 wrote to memory of 3068 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 92 PID 2788 wrote to memory of 3068 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 92 PID 2788 wrote to memory of 3068 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 92 PID 2788 wrote to memory of 4372 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 93 PID 2788 wrote to memory of 4372 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 93 PID 2788 wrote to memory of 4372 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 93 PID 2788 wrote to memory of 3832 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 94 PID 2788 wrote to memory of 3832 2788 917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe 94 PID 1052 wrote to memory of 2228 1052 zdsghrgrqa.exe 96 PID 1052 wrote to memory of 2228 1052 zdsghrgrqa.exe 96 PID 1052 wrote to memory of 2228 1052 zdsghrgrqa.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\917888b4277b02e38683e3b9c17707d9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\zdsghrgrqa.exezdsghrgrqa.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\ngkqnsuk.exeC:\Windows\system32\ngkqnsuk.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2228
-
-
-
C:\Windows\SysWOW64\nadjoutduagnujh.exenadjoutduagnujh.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3096
-
-
C:\Windows\SysWOW64\ngkqnsuk.exengkqnsuk.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3068
-
-
C:\Windows\SysWOW64\otvzwphqjewru.exeotvzwphqjewru.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4372
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4368,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:81⤵PID:2008
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 9e7d4da9f8761b289f5e43b852e524ead69e53d2ae87c53ca205ab898b7f05fe
- MD5 532397fcb439b5d74c3d499e08491eb2
- SHA1 b289f15c1c803ca0d5dbe99eaa01996632c54473
- SHA512 ba048c0593aed3e34fad9ce06c34890d6eedd0b8648bb4f05561e9efabc31e2fdfd1f76e00699ffac8f5a0259735efb6e259877006b871765b5e4cdf35e66249
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 f680b7d6b9ed34a9eb581a958bcb3f8c28ff6c44c327cee1c6019f7096173f33
- MD5 c0e9aff09d3d14fb1f01ee0211e3caad
- SHA1 077233065b412faa2e3a8d00e96a042220d693e3
- SHA512 6e0f37eaa9ad65babc0be849a0f3ff4a0f40de7cddcad874e7fe91ecd88f649799fd3536cf71e2cc04ffc5ec737f9230960f09447f442bbad94f20c522cedcba
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\StepReceive.doc.exe
- Size 512KB
- SHA256 3af2b96c2303257a1e47c3a7982d6a16754c67035bc4ac0b5e99904007677d72
- MD5 2f75f1d1b2fb10a70a4f953f693c8784
- SHA1 41576d19fc8a5088cff71d2d8bcbe56665dadc5b
- SHA512 516cc4ee889a78825843d33c402cf9ab2211894ab7f5070d48d5495b3c9f5782156be95211beba1bd58c9c760a45a4b24c09f5e57d7005862470849b3f18202f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD3C53.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ImportAssert.doc.exe
- Size 512KB
- SHA256 a30effa10cad004009eb3dbb2e8a89472322b3d6fb60e08e8b833f1eda1386c5
- MD5 a3135677bf1ddd4bee78f86d03427ded
- SHA1 1b68b1fc87566ea85690e59ab6f6caca450a77d1
- SHA512 0dd72381d55b09e26a4ad5df7ce0621899b7915473236672b7720b764cb0b57e015df3b60747ef5a2b15ec90cff487bcdfb1f40a914aa1c033e3a908a1f4c696
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 202977f1c61160bed45d475b040fcabac025b92885ca6c910d80cfb5d50e271d
- MD5 3b55cf09acb5f429d90ebda95cb58c63
- SHA1 484d36e23a9a7ad11cf324722d0bd5a9c484e756
- SHA512 bc93659c33595a893cc62d45875ae9995bfd30949e75c746ee6efc1a8b371d0c7f40932ca4dafd166a501cdea78ca9e83a099d954d9bf2f927cf654e7a43837f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 28f68b8b3bcb21bbeca842f068837442f69e062519192dc796a201ccff70dd1c
- MD5 75be1ec175ce8979345ba71515f9c633
- SHA1 0d83568dd6f2a41b880ad217dd40c133c6cf736c
- SHA512 81e5a4f595e8bc29c6a911baf7708464d10a9a63fbd36f33bbaa3a5100715759f566cc93815c9b0eebb5ab43d8609bc6225347871a65749c460be189ef754ebb
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\nadjoutduagnujh.exe
- Size 512KB
- SHA256 ea6fc2e884f6d9c13150ca035833fc3dfc56a36908f69bd8174423637b638808
- MD5 81ab28d6650c1b1f7c8922a1fcf898ee
- SHA1 2d44929e7f8871f6c435132fd7acd2420689086a
- SHA512 e9040a8b9129dfa47d3c3c3a55cc6c97be47448d8aac1482122121dd0c7babbe8b93ae7c4158d183cd339e426b468b4b00e89944238cec8be25748f4587ae453
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6H:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ngkqnsuk.exe
- Size 512KB
- SHA256 842876221a0706156f5a034387e58d639f77ac490ece2e12c641e65b11241399
- MD5 d510df0c78f64821fc012647ca4027d6
- SHA1 fba5a35dd1e31e2d1bf072b82f2948c637a8208e
- SHA512 756678b1d78eb12123cef511ac155eb2858ac242291c295a3607a49bfbd3e2d264b9347b3523df06a631499b17cad7db50d93fd84d07daedd35425db7fa3b059
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\otvzwphqjewru.exe
- Size 512KB
- SHA256 caba3c36d3a732f3897ed5641ef5fffb0e2372b0835e8e46219901512a091ebd
- MD5 f8b343dbc17c1768a349aa05e0a25f6e
- SHA1 f3c357994c1348c105f44e8468a3c8792090e811
- SHA512 105903dfd4102b08d0b99f4cb14a393da14bb269e019c99b225216f0ff43270c433c832b301682cf04470d88d5cf264551fcdcfa5f5b425588a896d64477521e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\zdsghrgrqa.exe
- Size 512KB
- SHA256 9e1825cb240289b1953cd32f58791c9f0cb3fdeee6c3e15b7aaf0504a73d3143
- MD5 32faf05b8f75e2c9a424f184bafe309f
- SHA1 8fd997e8f299e58b14b8ff3185af6c16872aba89
- SHA512 8f8a038a8526e01e4b85a74ecdc66310a8ae6d0e509d8eb2306478006f7541f5e33e5ae908a740ad961f7f6165ac811f475d3795435ae008fbd716b3b6df247f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 0f0362b05cb11f782bbe37a8ec2ec48f6edc58c89fc635f27cd64b0ce140d53e
- MD5 1a90a5c12fde57dd8fdb4cdde0cba661
- SHA1 3cad176b3fa85e451c845ed3b27679cf4a402bd5
- SHA512 402919a44483bb212281bd5a7223e45b322aae063cee632459e8e194fccf7dc39855f8a7340773167984baf20d92119b75d75fa76ecc68cf31f3c08c44315ae1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 1fc7f47bd8cd0543167223f8d2cc18fb9dfedda48583405f1990c5faa9ee8600
- MD5 48f572dac6473771c0c77666ab05973a
- SHA1 81efbbc670c0a4b92c523d3f04880fcdee1761e6
- SHA512 32dc479bdeecf9b58177a1e59b7f1fda38dc99c7b0ad89afeef62607401f87777b04a73e5752ab471e01ca39a1d2b8d2108669c73b877bac1522c589843a7ff0
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- MD5 SHA1 SHA512 SSDEEP