Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 14:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe
- Size 512KB
- Sample240603-rhaz8aha91
- SHA256 95eed510431d0f1dbd917b27b1310a4535554b081ba6d9316c908ac5e197a104
- MD5 921198594bfc6193d310acd0d8e3da41
- SHA1 e20419de4a3c533a97c7760fa82cb46a1b4c590b
- SHA512 7571603b0426b64ff79453d7e3fb1927e42c8b12cf13f47014fe4869fe55ab4353366c95e4041e38c175afcb4cde37ccfc9f9ae5fab29bebf643b8a03c5b5ae3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tmrhwbxljp.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tmrhwbxljp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tmrhwbxljp.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmrhwbxljp.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 3448 tmrhwbxljp.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 1940 rubalxeusvjfw.exe 532 qmjqabna.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tmrhwbxljp.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ztgohwdn = "tmrhwbxljp.exe" qfbpihaercbxuqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahdmctru = "qfbpihaercbxuqj.exe" qfbpihaercbxuqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "rubalxeusvjfw.exe" qfbpihaercbxuqj.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: qmjqabna.exe File opened (read-only) \??\t: qmjqabna.exe File opened (read-only) \??\a: tmrhwbxljp.exe File opened (read-only) \??\k: tmrhwbxljp.exe File opened (read-only) \??\b: qmjqabna.exe File opened (read-only) \??\j: qmjqabna.exe File opened (read-only) \??\r: qmjqabna.exe File opened (read-only) \??\l: qmjqabna.exe File opened (read-only) \??\s: qmjqabna.exe File opened (read-only) \??\q: qmjqabna.exe File opened (read-only) \??\y: tmrhwbxljp.exe File opened (read-only) \??\v: tmrhwbxljp.exe File opened (read-only) \??\j: qmjqabna.exe File opened (read-only) \??\v: qmjqabna.exe File opened (read-only) \??\a: qmjqabna.exe File opened (read-only) \??\v: qmjqabna.exe File opened (read-only) \??\y: qmjqabna.exe File opened (read-only) \??\z: qmjqabna.exe File opened (read-only) \??\t: tmrhwbxljp.exe File opened (read-only) \??\x: qmjqabna.exe File opened (read-only) \??\s: qmjqabna.exe File opened (read-only) \??\u: qmjqabna.exe File opened (read-only) \??\i: tmrhwbxljp.exe File opened (read-only) \??\t: qmjqabna.exe File opened (read-only) \??\z: tmrhwbxljp.exe File opened (read-only) \??\e: qmjqabna.exe File opened (read-only) \??\m: qmjqabna.exe File opened (read-only) \??\o: qmjqabna.exe File opened (read-only) \??\o: tmrhwbxljp.exe File opened (read-only) \??\u: tmrhwbxljp.exe File opened (read-only) \??\g: tmrhwbxljp.exe File opened (read-only) \??\u: qmjqabna.exe File opened (read-only) \??\n: tmrhwbxljp.exe File opened (read-only) \??\q: tmrhwbxljp.exe File opened (read-only) \??\s: tmrhwbxljp.exe File opened (read-only) \??\n: qmjqabna.exe File opened (read-only) \??\w: qmjqabna.exe File opened (read-only) \??\x: tmrhwbxljp.exe File opened (read-only) \??\g: qmjqabna.exe File opened (read-only) \??\h: tmrhwbxljp.exe File opened (read-only) \??\p: tmrhwbxljp.exe File opened (read-only) \??\o: qmjqabna.exe File opened (read-only) \??\n: qmjqabna.exe File opened (read-only) \??\x: qmjqabna.exe File opened (read-only) \??\b: tmrhwbxljp.exe File opened (read-only) \??\e: tmrhwbxljp.exe File opened (read-only) \??\h: qmjqabna.exe File opened (read-only) \??\r: qmjqabna.exe File opened (read-only) \??\y: qmjqabna.exe File opened (read-only) \??\i: qmjqabna.exe File opened (read-only) \??\k: qmjqabna.exe File opened (read-only) \??\p: qmjqabna.exe File opened (read-only) \??\j: tmrhwbxljp.exe File opened (read-only) \??\m: tmrhwbxljp.exe File opened (read-only) \??\b: qmjqabna.exe File opened (read-only) \??\k: qmjqabna.exe File opened (read-only) \??\m: qmjqabna.exe File opened (read-only) \??\z: qmjqabna.exe File opened (read-only) \??\l: qmjqabna.exe File opened (read-only) \??\r: tmrhwbxljp.exe File opened (read-only) \??\i: qmjqabna.exe File opened (read-only) \??\l: tmrhwbxljp.exe File opened (read-only) \??\a: qmjqabna.exe File opened (read-only) \??\e: qmjqabna.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tmrhwbxljp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tmrhwbxljp.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1312-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00080000000233c4-5.dat autoit_exe behavioral2/files/0x00090000000233c1-18.dat autoit_exe behavioral2/files/0x00070000000233c8-28.dat autoit_exe behavioral2/files/0x00070000000233c9-31.dat autoit_exe behavioral2/files/0x00070000000233d6-72.dat autoit_exe behavioral2/files/0x00080000000233b4-66.dat autoit_exe behavioral2/files/0x000f0000000233f7-441.dat autoit_exe behavioral2/files/0x000f0000000233f7-509.dat autoit_exe behavioral2/files/0x000f0000000233f7-511.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\qfbpihaercbxuqj.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification C:\Windows\SysWOW64\qfbpihaercbxuqj.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File created C:\Windows\SysWOW64\qmjqabna.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File created C:\Windows\SysWOW64\rubalxeusvjfw.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rubalxeusvjfw.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tmrhwbxljp.exe File opened for modification C:\Windows\SysWOW64\tmrhwbxljp.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\qmjqabna.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File created C:\Windows\SysWOW64\tmrhwbxljp.exe 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qmjqabna.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qmjqabna.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qmjqabna.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qmjqabna.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qmjqabna.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qmjqabna.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qmjqabna.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qmjqabna.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qmjqabna.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qmjqabna.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qmjqabna.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qmjqabna.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qmjqabna.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qmjqabna.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qmjqabna.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qmjqabna.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qmjqabna.exe File opened for modification C:\Windows\mydoc.rtf 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tmrhwbxljp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tmrhwbxljp.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tmrhwbxljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tmrhwbxljp.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1838C67915E6DAB6B8BE7FE0ECE737CC" 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tmrhwbxljp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tmrhwbxljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tmrhwbxljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tmrhwbxljp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tmrhwbxljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08068B1FE1A21AED278D1A98A7D9164" 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tmrhwbxljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB15C47E438E353CFBAD0329BD7BC" 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F88FC82485D85699134D62F7D90BC93E631584167366341D6EA" 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tmrhwbxljp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tmrhwbxljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472C0C9D5283576D4476D2772E2CAB7D8465D9" 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB4FAC9F916F29983793B32869A3994B38D028C43110248E2CB459A08A0" 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2932 WINWORD.EXE 2932 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 3448 tmrhwbxljp.exe 4600 qfbpihaercbxuqj.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 4472 qmjqabna.exe 4472 qmjqabna.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 4600 qfbpihaercbxuqj.exe 4600 qfbpihaercbxuqj.exe 4600 qfbpihaercbxuqj.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 1940 rubalxeusvjfw.exe 4600 qfbpihaercbxuqj.exe 4600 qfbpihaercbxuqj.exe 532 qmjqabna.exe 532 qmjqabna.exe 532 qmjqabna.exe 532 qmjqabna.exe 532 qmjqabna.exe 532 qmjqabna.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1940 rubalxeusvjfw.exe 3448 tmrhwbxljp.exe 1940 rubalxeusvjfw.exe 3448 tmrhwbxljp.exe 1940 rubalxeusvjfw.exe 3448 tmrhwbxljp.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 532 qmjqabna.exe 532 qmjqabna.exe 532 qmjqabna.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 1940 rubalxeusvjfw.exe 3448 tmrhwbxljp.exe 1940 rubalxeusvjfw.exe 3448 tmrhwbxljp.exe 1940 rubalxeusvjfw.exe 3448 tmrhwbxljp.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 4472 qmjqabna.exe 4600 qfbpihaercbxuqj.exe 532 qmjqabna.exe 532 qmjqabna.exe 532 qmjqabna.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1312 wrote to memory of 3448 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 84 PID 1312 wrote to memory of 3448 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 84 PID 1312 wrote to memory of 3448 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 84 PID 1312 wrote to memory of 4600 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 85 PID 1312 wrote to memory of 4600 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 85 PID 1312 wrote to memory of 4600 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 85 PID 1312 wrote to memory of 4472 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 86 PID 1312 wrote to memory of 4472 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 86 PID 1312 wrote to memory of 4472 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 86 PID 1312 wrote to memory of 1940 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 87 PID 1312 wrote to memory of 1940 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 87 PID 1312 wrote to memory of 1940 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 87 PID 1312 wrote to memory of 2932 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 88 PID 1312 wrote to memory of 2932 1312 921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe 88 PID 3448 wrote to memory of 532 3448 tmrhwbxljp.exe 90 PID 3448 wrote to memory of 532 3448 tmrhwbxljp.exe 90 PID 3448 wrote to memory of 532 3448 tmrhwbxljp.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\921198594bfc6193d310acd0d8e3da41_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\tmrhwbxljp.exetmrhwbxljp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\qmjqabna.exeC:\Windows\system32\qmjqabna.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:532
-
-
-
C:\Windows\SysWOW64\qfbpihaercbxuqj.exeqfbpihaercbxuqj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4600
-
-
C:\Windows\SysWOW64\qmjqabna.exeqmjqabna.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4472
-
-
C:\Windows\SysWOW64\rubalxeusvjfw.exerubalxeusvjfw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1940
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 ab193c2d1bbe3e959f48dfd73d9e4dc0b61d61ddd954359a6006451f36f08408
- MD5 63fece5cb72fd3b7c951c8c4a9d7b077
- SHA1 11964cb37b170a55069501456877b54f0ea9e0a5
- SHA512 48634105bd80a8c1239881154c71e91bbee97a4785a9d7b132dbb5c829c52b98b945810a34d43b14b6de4024e379bdb2781d1aa7f6d3e5912aa396c2bfd98a1f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 d052f3b9e33e4df5a7e87257f16c1ed885bc7759dd49707ece5588426b470693
- MD5 4fca49b55bf5e24410a193af156a072f
- SHA1 3ebde6cca2beed67afb0dd02ca4e5c0df807355b
- SHA512 7a7afc99885f470cabad82771cfabc094f0fee2e1107a79eb19f6edbe4997ef1413a9cd47b55dba9fbb44f4aa8850f77d7cbb38c8880642223a83a6947e92505
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD8EDE.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 befab8c820eb89a727dc238b0957b3e83aece19bfeb8ad27b03e900217e0afc2
- MD5 355a66d0cf1827a72be32525a0e44dbe
- SHA1 bb2de5b31001e5b541f3d4d16bc8c8e415a3ae85
- SHA512 6c89a72a92d2d6b9a75e6a5f379007c230ab2c6802b407251ebf1390bc6aee859f1e466b2ba72844093b1bc28c6e655d0b7a63dc5072caa96de7e9eac5c12f29
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 95ae14e03cb994328b5863677a83f9409bdf9949ff51d9d4eee5ef3a8afde211
- MD5 0eeb50a4c305f4b366345feeaf8047c2
- SHA1 d6c7cbc4443a952b62c44f50db925fb97eacb207
- SHA512 ad1c2e805618f6b9da52d53d87e4684d3fd123f0c4ffc8ecacd78f0d913c4e823a92303de035d089e02187b75af782c91df22ccfed93f78abd25ac7b948446da
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\qfbpihaercbxuqj.exe
- Size 512KB
- SHA256 73dd1f3cc39a313b981ae0ca206cbd122f7affbf925d077665dfbe6f868c08d1
- MD5 a4f92f731af55f0cb9454a57ecf05175
- SHA1 6aee8e751a40a8d604b48e72a137fd124f2bfcec
- SHA512 0f91e0e49a4df5c22ebd4bf8e879e3a9eb6c607173b1a34c7af7d3c1c44c3d85f43582116a0ad4e672caa49c1a09cb6e249ffbc985cf3c704c14ade2f36568ec
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\qmjqabna.exe
- Size 512KB
- SHA256 71cdfa982caef245a397437394c2397807942d8e45d63bbaf50661c62b33c82b
- MD5 e7ab8b77842d1c65da66723c7dba9de0
- SHA1 8804bc5d19f3644549bc5b0d2c30d9499ea9c88c
- SHA512 c5f874578f068241498d63ea35b6d0751868d37e9b48513e7dc3c69850305a789fce484d790d6cc0b3d6bcb62e72addf0231f6dde80ee220577703730f8a271d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rubalxeusvjfw.exe
- Size 512KB
- SHA256 f74953cddb5e87f8064348ad8599da132236fb88782cf15509c30ec3eb98d152
- MD5 78590e9f22ea1788f35257cc0ab1da95
- SHA1 791de8c3b76cf0844529a9de93b1957421d8150a
- SHA512 dbb29391283150b4deb2bc900e474a9cc43077f3a5bc5038b688b0a0a63bf5349ad5d598c2e6dfe9ef4a6442aaa216090eda7deb2e1875de7c278eb6a12f2a60
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tmrhwbxljp.exe
- Size 512KB
- SHA256 dcb59aa9abd122c23304bee102e9b4a1ef2c89bacb4a3de0ecd7762672c1b95c
- MD5 b5ec46cce3aef6670f3f0c533ff2c8be
- SHA1 9cd53dea91cd1ecf3a887cb8577a625840590148
- SHA512 1b0d0a3eff82b92e7a07476efa6d82fc1c2068199bba8dc10aad4de9e3fe05a5ddf01b07f493956860348df7e23cf0a3010cc4fe3232a07c831a72e40d85924d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 f34c2564471ee0249d14ca07edf368ff0d4a5312fa77098f8f03b8c23c6150a5
- MD5 2ccad0ed267f85850a1e565a3af1dc7c
- SHA1 6b3ff0c66635fe201ddb9a87589348b043715a76
- SHA512 29a920bab7f6b25c6cb87cf505bf0d1e6a8f98f7d49dbf4eb9f06d2c342ecd5e49ceec78affc51cc8de8c92cf72dc74fe7a7f3bc16dfc68fb5cab3e949bcf663
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 4dd0a38dcaebff85447d89e8e5f3f28c2ccb0e9e007b8ea1a3a60c16ef96daeb
- MD5 ae057491a92398270483d767ffd64254
- SHA1 b06744c360e5e928b494f2b4f6372a8d9d2f8a40
- SHA512 8c0640521400cfd7e8956d9611f4eef9c1bc596e724ae230194626b2b496cd37b4794409c96cff7ce6dc2e30ca5ce6b293d903d30320488838292b39fc826157
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 020f664e1625e772c16a46c507f329701715cd72e69805755a5826b2e03d15b4
- MD5 7fb7ffdaffca300a7042f24fe6fbd4b8
- SHA1 43b48948e226fde26b5d6e927e8fe6ff20df095d
- SHA512 40ac763ea02bd36f04264f7ee4c561edde4dffeebfd971600f2c528be1cff4999b916985aab6f773b0e0dba1e4ab52ca9e6662afca3d67e42992593f6c968e9f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- MD5 SHA1 SHA512 SSDEEP