Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe
- Size 512KB
- Sample240603-n7vjdafa52
- SHA256 4d7e0057e9ae9369bc008df6d651fe3ce16ecaae82bcc3741cba9385154a40ab
- MD5 91b6c2d6fabe05758a0372a4f0af2065
- SHA1 b6c2aa0c7dcffa951f4d2d85e7b1225067faffc4
- SHA512 d4d327a8961bc835384962f84b0bbd5c477e6da237ae612a2aad72faf10148bc91fb792a8de757d4ead42b88053ff82f0e442544a00f986d02f9a57ba1eccd5f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" eeimnzaveg.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" eeimnzaveg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" eeimnzaveg.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eeimnzaveg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2424 eeimnzaveg.exe 2848 icmkgqylnpiwcgj.exe 1004 ikbzbdlb.exe 8 cdkefoudjwnsz.exe 4852 ikbzbdlb.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" eeimnzaveg.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oayarxmd = "eeimnzaveg.exe" icmkgqylnpiwcgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qqmkxzer = "icmkgqylnpiwcgj.exe" icmkgqylnpiwcgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cdkefoudjwnsz.exe" icmkgqylnpiwcgj.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: ikbzbdlb.exe File opened (read-only) \??\j: ikbzbdlb.exe File opened (read-only) \??\n: ikbzbdlb.exe File opened (read-only) \??\j: eeimnzaveg.exe File opened (read-only) \??\t: eeimnzaveg.exe File opened (read-only) \??\h: ikbzbdlb.exe File opened (read-only) \??\j: ikbzbdlb.exe File opened (read-only) \??\u: ikbzbdlb.exe File opened (read-only) \??\v: ikbzbdlb.exe File opened (read-only) \??\s: eeimnzaveg.exe File opened (read-only) \??\x: eeimnzaveg.exe File opened (read-only) \??\n: eeimnzaveg.exe File opened (read-only) \??\b: ikbzbdlb.exe File opened (read-only) \??\i: ikbzbdlb.exe File opened (read-only) \??\l: ikbzbdlb.exe File opened (read-only) \??\q: ikbzbdlb.exe File opened (read-only) \??\e: ikbzbdlb.exe File opened (read-only) \??\h: eeimnzaveg.exe File opened (read-only) \??\i: eeimnzaveg.exe File opened (read-only) \??\r: ikbzbdlb.exe File opened (read-only) \??\i: ikbzbdlb.exe File opened (read-only) \??\q: ikbzbdlb.exe File opened (read-only) \??\m: ikbzbdlb.exe File opened (read-only) \??\a: eeimnzaveg.exe File opened (read-only) \??\y: ikbzbdlb.exe File opened (read-only) \??\l: ikbzbdlb.exe File opened (read-only) \??\o: ikbzbdlb.exe File opened (read-only) \??\p: eeimnzaveg.exe File opened (read-only) \??\q: eeimnzaveg.exe File opened (read-only) \??\m: eeimnzaveg.exe File opened (read-only) \??\h: ikbzbdlb.exe File opened (read-only) \??\e: ikbzbdlb.exe File opened (read-only) \??\g: ikbzbdlb.exe File opened (read-only) \??\a: ikbzbdlb.exe File opened (read-only) \??\n: ikbzbdlb.exe File opened (read-only) \??\o: ikbzbdlb.exe File opened (read-only) \??\x: ikbzbdlb.exe File opened (read-only) \??\z: ikbzbdlb.exe File opened (read-only) \??\g: ikbzbdlb.exe File opened (read-only) \??\k: eeimnzaveg.exe File opened (read-only) \??\y: eeimnzaveg.exe File opened (read-only) \??\k: ikbzbdlb.exe File opened (read-only) \??\t: ikbzbdlb.exe File opened (read-only) \??\t: ikbzbdlb.exe File opened (read-only) \??\b: ikbzbdlb.exe File opened (read-only) \??\p: ikbzbdlb.exe File opened (read-only) \??\x: ikbzbdlb.exe File opened (read-only) \??\k: ikbzbdlb.exe File opened (read-only) \??\r: ikbzbdlb.exe File opened (read-only) \??\m: ikbzbdlb.exe File opened (read-only) \??\w: ikbzbdlb.exe File opened (read-only) \??\y: ikbzbdlb.exe File opened (read-only) \??\z: ikbzbdlb.exe File opened (read-only) \??\o: eeimnzaveg.exe File opened (read-only) \??\r: eeimnzaveg.exe File opened (read-only) \??\v: ikbzbdlb.exe File opened (read-only) \??\w: eeimnzaveg.exe File opened (read-only) \??\v: eeimnzaveg.exe File opened (read-only) \??\s: ikbzbdlb.exe File opened (read-only) \??\u: ikbzbdlb.exe File opened (read-only) \??\e: eeimnzaveg.exe File opened (read-only) \??\u: eeimnzaveg.exe File opened (read-only) \??\a: ikbzbdlb.exe File opened (read-only) \??\s: ikbzbdlb.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" eeimnzaveg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" eeimnzaveg.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3952-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0008000000023401-5.dat autoit_exe behavioral2/files/0x00090000000233ee-18.dat autoit_exe behavioral2/files/0x0007000000023405-24.dat autoit_exe behavioral2/files/0x0007000000023406-27.dat autoit_exe behavioral2/files/0x000400000001d9ea-66.dat autoit_exe behavioral2/files/0x000400000001d9ec-72.dat autoit_exe behavioral2/files/0x001200000001e29d-78.dat autoit_exe behavioral2/files/0x000300000001e5b2-93.dat autoit_exe behavioral2/files/0x000300000001e5b2-98.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cdkefoudjwnsz.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll eeimnzaveg.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ikbzbdlb.exe File created C:\Windows\SysWOW64\eeimnzaveg.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File created C:\Windows\SysWOW64\cdkefoudjwnsz.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icmkgqylnpiwcgj.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File created C:\Windows\SysWOW64\ikbzbdlb.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ikbzbdlb.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification C:\Windows\SysWOW64\eeimnzaveg.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File created C:\Windows\SysWOW64\icmkgqylnpiwcgj.exe 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ikbzbdlb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ikbzbdlb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ikbzbdlb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ikbzbdlb.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ikbzbdlb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ikbzbdlb.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ikbzbdlb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ikbzbdlb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ikbzbdlb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ikbzbdlb.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ikbzbdlb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ikbzbdlb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ikbzbdlb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ikbzbdlb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ikbzbdlb.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ikbzbdlb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ikbzbdlb.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ikbzbdlb.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ikbzbdlb.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ikbzbdlb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ikbzbdlb.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ikbzbdlb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ikbzbdlb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ikbzbdlb.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat eeimnzaveg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" eeimnzaveg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC2B121479738E853CCBAD63299D7C4" 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8BFF83482B856D9145D7287E90BD90E141584067326246D69E" 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" eeimnzaveg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" eeimnzaveg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" eeimnzaveg.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7876BB4FF6D21D9D172D1A68A749111" 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C7091594DAB0B9CC7F97EDE237CB" 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh eeimnzaveg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" eeimnzaveg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs eeimnzaveg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg eeimnzaveg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33462C7D9C2083526A3277A170272DD87DF464DE" 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABCFACEF960F192830C3A4081EB39E4B081038D4361023EE1CD42E708A0" 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc eeimnzaveg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf eeimnzaveg.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" eeimnzaveg.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2832 WINWORD.EXE 2832 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 1004 ikbzbdlb.exe 1004 ikbzbdlb.exe 1004 ikbzbdlb.exe 1004 ikbzbdlb.exe 1004 ikbzbdlb.exe 1004 ikbzbdlb.exe 1004 ikbzbdlb.exe 1004 ikbzbdlb.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 2848 icmkgqylnpiwcgj.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 2848 icmkgqylnpiwcgj.exe 1004 ikbzbdlb.exe 2848 icmkgqylnpiwcgj.exe 1004 ikbzbdlb.exe 2848 icmkgqylnpiwcgj.exe 1004 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 2424 eeimnzaveg.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 8 cdkefoudjwnsz.exe 2848 icmkgqylnpiwcgj.exe 1004 ikbzbdlb.exe 2848 icmkgqylnpiwcgj.exe 1004 ikbzbdlb.exe 2848 icmkgqylnpiwcgj.exe 1004 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe 4852 ikbzbdlb.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2832 WINWORD.EXE 2832 WINWORD.EXE 2832 WINWORD.EXE 2832 WINWORD.EXE 2832 WINWORD.EXE 2832 WINWORD.EXE 2832 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3952 wrote to memory of 2424 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 81 PID 3952 wrote to memory of 2424 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 81 PID 3952 wrote to memory of 2424 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 81 PID 3952 wrote to memory of 2848 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 82 PID 3952 wrote to memory of 2848 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 82 PID 3952 wrote to memory of 2848 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 82 PID 3952 wrote to memory of 1004 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 83 PID 3952 wrote to memory of 1004 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 83 PID 3952 wrote to memory of 1004 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 83 PID 3952 wrote to memory of 8 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 84 PID 3952 wrote to memory of 8 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 84 PID 3952 wrote to memory of 8 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 84 PID 2424 wrote to memory of 4852 2424 eeimnzaveg.exe 86 PID 2424 wrote to memory of 4852 2424 eeimnzaveg.exe 86 PID 2424 wrote to memory of 4852 2424 eeimnzaveg.exe 86 PID 3952 wrote to memory of 2832 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 85 PID 3952 wrote to memory of 2832 3952 91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91b6c2d6fabe05758a0372a4f0af2065_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\eeimnzaveg.exeeeimnzaveg.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\ikbzbdlb.exeC:\Windows\system32\ikbzbdlb.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4852
-
-
-
C:\Windows\SysWOW64\icmkgqylnpiwcgj.exeicmkgqylnpiwcgj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2848
-
-
C:\Windows\SysWOW64\ikbzbdlb.exeikbzbdlb.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1004
-
-
C:\Windows\SysWOW64\cdkefoudjwnsz.execdkefoudjwnsz.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 15363d8862560277a430c949d30bd74a6d8566fe3d7dbc8fa8c27f0ebfb6bd82
- MD5 0fc11c99cdd9a9b8d35324e80cc33972
- SHA1 7aa8a9d19c9422eb1d71c44355968ec16f8ee68c
- SHA512 7f99fcda917fa373fb1afbadd924422bb0818ea60210bd3a1ed1d0b0cda7b60f532929e9ba61c17fc2d4b8f6b71ce28c0c8f79bb4d55a530b3f81527d69641c0
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 22647cfb1a88f72b91c013bf424af1750b74588a687cd57e7078dddd5b1598d0
- MD5 7d6df2130cd300860b00565325990eb1
- SHA1 f40043fe1aec7714b0d71f34d1587e29151f10e3
- SHA512 6385bb64dbde0feff408639d466c12a68222a221c6f91f65d65c3109fbae42fac681405f7d6c7c1deab4ebd02d41537bcc76c547fb4a67b5460135f623387994
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD734D.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 8865d2de5da6a44af8bd6877ef546eafd2cb24158a1060de84d785a7ea0aaaa7
- MD5 842246ee787002f4e290911425d79cc8
- SHA1 34f4e0c11bd65f00bba6df404eee5adb59e74a16
- SHA512 e2f7192747ff677dc45a4052c4407a06e0972eb9826084e2c75ec551fe30e82620bd7145415999553a38c463b151be1b71979c39b11e64f0626ad3334b5d6cdf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 a8f0bf73526123529720c4862e74fbe94b54cb8b074c4c777b29b5b569b376b0
- MD5 6db65e56b8a32489bfb599a372ca35b8
- SHA1 32635d1866511a2240686fce787231a5aabc8616
- SHA512 0c0e8b88fe1aa7ddf1eaf12bb3260b833ba905179cf5b9e6ea0b4bd560b13f6c1e5ecd6bae62ea12acf24bdc117f52659166feabc7f20adf12b3348d1032b604
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\ResolveSkip.doc.exe
- Size 512KB
- SHA256 4b6b417f9e72eee9db6c4e6e77e61c6251a79b9c356c59f550be45adeb0b2cf1
- MD5 eca1842eecdad3e207c6c52d80a571a1
- SHA1 019cb83b135d118ce52a07a3dc961eed6bd0cab2
- SHA512 c52580b5c4b501d099ee82879cbfd43e3c7e7a2144faf18a1a4d7be9b2cc8ff2d7ee5cf07649a16123cde17f13e0d2179195002affbf0ca60611df7898628660
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\cdkefoudjwnsz.exe
- Size 512KB
- SHA256 9adabfee2c76a4762f81f707b65884a19e15c3725a5e5fbc5216fd91b42efca5
- MD5 9eb80425233ac074b8d9d9629a031822
- SHA1 b48af726ded80c4aa1cebe841ae2da2a09e86171
- SHA512 7cae2e977f6c6faafb4f37a94824d61df229af40efd045b0a8e986963671c7fec4b061b2ab8fc27ebcd1f20b8c3ddd6dcd476decc4aafcf0f5173da7947ff7dd
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\eeimnzaveg.exe
- Size 512KB
- SHA256 38bed2979012ad4523e16ab1b1cd54360fe5799a27f7d2182646230ee6955997
- MD5 95d43fc7a35cbac3161d53350a42c474
- SHA1 cfdc090ded4fc0987dae2c95c2340feb364db3b4
- SHA512 66a725a6b5a68a9a2778a358d32d5136fdb095bdeed9fe78b7ff458f9cec5732a710c7990bd093d630db9e9dc81b5ac408e4e74eb353655edcfbb4e31862b669
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\icmkgqylnpiwcgj.exe
- Size 512KB
- SHA256 bc987fa5f998c07ab8dafe03b08ee2c09076551f57ad1745a733af85db2a13df
- MD5 8304f427471990a3be358323d1ba7128
- SHA1 8e702b97799480ba76da5a095bc35c2bdb96d454
- SHA512 fa770bb51b413fd7a3d1b70eb9402ac22860e92c394b3472a830b52f67332c98f01fba214b6d1e32cea5844076a591552d6651b4bba6dd6f6fa4d6caedd85d23
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ikbzbdlb.exe
- Size 512KB
- SHA256 e4788e2d237619468a16f0df012ca81c0f3605fb28dd4da969a9b260b432dea0
- MD5 c9cc5ce3b6479aa06b39a6673c3590ec
- SHA1 1d6b1021c8ae948261959b2fb91284e6809d5735
- SHA512 5cf556d36bf3735b9858f10052af01f1e9a20378b3a0031fbf8991b805fd99515d168513a6e581ea14b637df1bf5902b59c312d57d467fb4da49f1d7b9a8b6d8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 54a2123cdc97de9516523e0871c883a7780b920fcd91552ce708127a86e5196a
- MD5 620a539c565275419ad886bc08a41d86
- SHA1 121c32f7266c321e03d0d4ecadb96f406ed6cf0e
- SHA512 d53e404734a4b0e0229fc868aafd24ca836deda7ac468fa0ddde9831240d052940331820bb36b06efe73692fae83f7e58682ef537c69bcbf0c4be1a38af1e78b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 fa451b2023fcc8d8a433cc7d7829289c1698e3d347f7b6fda796aab8b59df246
- MD5 1c6440cc14455ccbd609560ee4bf2668
- SHA1 b8503bbe81b4146cb0f75356b09a9b8803686571
- SHA512 b2d83fd378fc12968040af23d9cea9dcc530f04efdc9afaa917160c452d885dc927f96ed2dec7a72e06fc735421c608b02611804bef3f7a793d8d1c63c214011
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6s:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP