Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 06:47
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe
- Size 512KB
- Sample240605-hkprqahe69
- SHA256 0a9db832002461edb961b3b530a7268439d510119436457fbc169e4facabe445
- MD5 976549e4473b87ba172d2a60f60a4ea6
- SHA1 d4ada608f9a3ae9112ae2a39f46229dc18d01a93
- SHA512 9313952e958dee79f6763e8ec38a7a11c0aa639407ba509885edf3d7d6c1faae30d31349e4b3fc2e62b77191eeb55a75a21c8bc84168ceaeb8960866fce528e4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hjsejgikgl.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hjsejgikgl.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hjsejgikgl.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hjsejgikgl.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2828 aazjmhtn.exe 4720 gzrsxgzlavgrs.exe 4972 aazjmhtn.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hjsejgikgl.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\drqtsnry = "hjsejgikgl.exe" jjbrqcffhzgwaut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gdjvweqd = "jjbrqcffhzgwaut.exe" jjbrqcffhzgwaut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gzrsxgzlavgrs.exe" jjbrqcffhzgwaut.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: aazjmhtn.exe File opened (read-only) \??\y: aazjmhtn.exe File opened (read-only) \??\o: hjsejgikgl.exe File opened (read-only) \??\u: aazjmhtn.exe File opened (read-only) \??\b: aazjmhtn.exe File opened (read-only) \??\g: aazjmhtn.exe File opened (read-only) \??\j: aazjmhtn.exe File opened (read-only) \??\s: aazjmhtn.exe File opened (read-only) \??\i: hjsejgikgl.exe File opened (read-only) \??\n: aazjmhtn.exe File opened (read-only) \??\w: aazjmhtn.exe File opened (read-only) \??\j: hjsejgikgl.exe File opened (read-only) \??\p: aazjmhtn.exe File opened (read-only) \??\i: aazjmhtn.exe File opened (read-only) \??\z: hjsejgikgl.exe File opened (read-only) \??\w: aazjmhtn.exe File opened (read-only) \??\k: hjsejgikgl.exe File opened (read-only) \??\x: aazjmhtn.exe File opened (read-only) \??\n: aazjmhtn.exe File opened (read-only) \??\b: hjsejgikgl.exe File opened (read-only) \??\r: hjsejgikgl.exe File opened (read-only) \??\t: aazjmhtn.exe File opened (read-only) \??\r: aazjmhtn.exe File opened (read-only) \??\x: aazjmhtn.exe File opened (read-only) \??\a: hjsejgikgl.exe File opened (read-only) \??\i: aazjmhtn.exe File opened (read-only) \??\b: aazjmhtn.exe File opened (read-only) \??\q: aazjmhtn.exe File opened (read-only) \??\k: aazjmhtn.exe File opened (read-only) \??\h: hjsejgikgl.exe File opened (read-only) \??\p: hjsejgikgl.exe File opened (read-only) \??\v: hjsejgikgl.exe File opened (read-only) \??\w: hjsejgikgl.exe File opened (read-only) \??\a: aazjmhtn.exe File opened (read-only) \??\l: aazjmhtn.exe File opened (read-only) \??\p: aazjmhtn.exe File opened (read-only) \??\z: aazjmhtn.exe File opened (read-only) \??\j: aazjmhtn.exe File opened (read-only) \??\v: aazjmhtn.exe File opened (read-only) \??\z: aazjmhtn.exe File opened (read-only) \??\o: aazjmhtn.exe File opened (read-only) \??\q: aazjmhtn.exe File opened (read-only) \??\u: aazjmhtn.exe File opened (read-only) \??\e: hjsejgikgl.exe File opened (read-only) \??\q: hjsejgikgl.exe File opened (read-only) \??\r: aazjmhtn.exe File opened (read-only) \??\a: aazjmhtn.exe File opened (read-only) \??\m: aazjmhtn.exe File opened (read-only) \??\m: hjsejgikgl.exe File opened (read-only) \??\s: hjsejgikgl.exe File opened (read-only) \??\u: hjsejgikgl.exe File opened (read-only) \??\h: aazjmhtn.exe File opened (read-only) \??\e: aazjmhtn.exe File opened (read-only) \??\h: aazjmhtn.exe File opened (read-only) \??\y: aazjmhtn.exe File opened (read-only) \??\e: aazjmhtn.exe File opened (read-only) \??\t: aazjmhtn.exe File opened (read-only) \??\l: hjsejgikgl.exe File opened (read-only) \??\t: hjsejgikgl.exe File opened (read-only) \??\y: hjsejgikgl.exe File opened (read-only) \??\m: aazjmhtn.exe File opened (read-only) \??\n: hjsejgikgl.exe File opened (read-only) \??\x: hjsejgikgl.exe File opened (read-only) \??\k: aazjmhtn.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" hjsejgikgl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" hjsejgikgl.exe - AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2264-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233f0-5.dat autoit_exe behavioral2/files/0x00080000000233ec-18.dat autoit_exe behavioral2/files/0x00070000000233f1-27.dat autoit_exe behavioral2/files/0x00070000000233f2-32.dat autoit_exe behavioral2/files/0x00080000000233dc-72.dat autoit_exe behavioral2/files/0x000700000002340c-91.dat autoit_exe behavioral2/files/0x000700000002340c-96.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\hjsejgikgl.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File created C:\Windows\SysWOW64\jjbrqcffhzgwaut.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gzrsxgzlavgrs.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll hjsejgikgl.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe aazjmhtn.exe File created C:\Windows\SysWOW64\hjsejgikgl.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jjbrqcffhzgwaut.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File created C:\Windows\SysWOW64\aazjmhtn.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\aazjmhtn.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File created C:\Windows\SysWOW64\gzrsxgzlavgrs.exe 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe aazjmhtn.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal aazjmhtn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aazjmhtn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aazjmhtn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal aazjmhtn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal aazjmhtn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal aazjmhtn.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aazjmhtn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aazjmhtn.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aazjmhtn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aazjmhtn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aazjmhtn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aazjmhtn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aazjmhtn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aazjmhtn.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aazjmhtn.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aazjmhtn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification C:\Windows\mydoc.rtf 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aazjmhtn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aazjmhtn.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aazjmhtn.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aazjmhtn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aazjmhtn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aazjmhtn.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aazjmhtn.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C0D9D5183236A3676D7702F2CAE7DF264AC" 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F568B7FF1C22DCD173D0A08B7B9063" 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" hjsejgikgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf hjsejgikgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFC8D4F5D82129030D7207EE6BDE1E133584167406245D6EE" 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat hjsejgikgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs hjsejgikgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" hjsejgikgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFFABEF916F2E0840E3B42869D3997B0FE03FE4316023EE1CF459E09D5" 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh hjsejgikgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc hjsejgikgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" hjsejgikgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" hjsejgikgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg hjsejgikgl.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FCAB12B44E439E853BABAA133EAD7C8" 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC6751591DBC4B9BA7CE1EC9F34CD" 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" hjsejgikgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" hjsejgikgl.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3828 WINWORD.EXE 3828 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 2420 jjbrqcffhzgwaut.exe 2420 jjbrqcffhzgwaut.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2240 hjsejgikgl.exe 2420 jjbrqcffhzgwaut.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 2828 aazjmhtn.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4720 gzrsxgzlavgrs.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe 4972 aazjmhtn.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2240 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 82 PID 2264 wrote to memory of 2240 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 82 PID 2264 wrote to memory of 2240 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 82 PID 2264 wrote to memory of 2420 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 83 PID 2264 wrote to memory of 2420 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 83 PID 2264 wrote to memory of 2420 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 83 PID 2264 wrote to memory of 2828 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 84 PID 2264 wrote to memory of 2828 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 84 PID 2264 wrote to memory of 2828 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 84 PID 2264 wrote to memory of 4720 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 85 PID 2264 wrote to memory of 4720 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 85 PID 2264 wrote to memory of 4720 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 85 PID 2264 wrote to memory of 3828 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 86 PID 2264 wrote to memory of 3828 2264 976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe 86 PID 2240 wrote to memory of 4972 2240 hjsejgikgl.exe 88 PID 2240 wrote to memory of 4972 2240 hjsejgikgl.exe 88 PID 2240 wrote to memory of 4972 2240 hjsejgikgl.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\976549e4473b87ba172d2a60f60a4ea6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\hjsejgikgl.exehjsejgikgl.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\aazjmhtn.exeC:\Windows\system32\aazjmhtn.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4972
-
-
-
C:\Windows\SysWOW64\jjbrqcffhzgwaut.exejjbrqcffhzgwaut.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2420
-
-
C:\Windows\SysWOW64\aazjmhtn.exeaazjmhtn.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2828
-
-
C:\Windows\SysWOW64\gzrsxgzlavgrs.exegzrsxgzlavgrs.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3828
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 7877411a760f147017ced9a04c0132ca126421588994362f48f5e1e62ff2985c
- MD5 abbfdfd4f5a3f635137cf1ce3ad90151
- SHA1 73917749fa620d56da56b6de4f0ef327b29902cc
- SHA512 d3ccda20dd188648c4aaf1e71e79c8d8876cf664b3e680df4da36c248c68510fa00ba4564bbf243b0d4f7a03b3b855eff41573af7e3ddf0d6556a989fc35a678
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj64:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD9694.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 4782870acc4cbeff86369db29d0fcf8156d1354269bee44f452e32fee912dc67
- MD5 9bb418468b53ee404937670a420d0b7c
- SHA1 1ea4c4e376400156d85ef063b394ffd42bf1844b
- SHA512 a996530a7d07aff26cd7aad3c6bb6edbc64f66ed217e6fb21975ff17fed88f3147c7686f0e69fcb8d1461cc16c88969d16e9d749fa7fbe7c92e5ecb3be0ff084
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 525055469d666863c6addabe96f9e0e8fe5e50c91a1694ff4b5fd46223eecc67
- MD5 87a1e5a453c99842894e92f45e8fb4ff
- SHA1 b7d84fb01a490b41aa3b80d79dc568887f881f77
- SHA512 29f1df0cef961d856e9de27a8b5ed2a1fbf972ec255e3321a95bf1dc599cc5077eee05508b64e76bab87613196c4cfad23a9c3290279ec36baf07c7d710e0adc
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\aazjmhtn.exe
- Size 512KB
- SHA256 9ee176e4686b34072dc6a507070df451f153270c66df5aa0176f56f458468251
- MD5 969490896e3e04fc60290a96fdfa0d02
- SHA1 49ac9c2d10bf667eaed300b40aa114626543c157
- SHA512 180972ef075c79ed2e748056c60f57bec05ffc1f9a4a737c08762fa3a0804a525b09250c4c32eca19fd19d5dafbc7d3b0f462a348b087ee1a8b4a46e1b37a0a5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\gzrsxgzlavgrs.exe
- Size 512KB
- SHA256 a4a076996766f7fabb6077d8c9714b780ca9e0098cbbbc0fe4df1095d084d170
- MD5 0d4a38bc3abeb12d5bb9fff24b98f57b
- SHA1 33b7855eac36da6d307d215424a33010a0b64664
- SHA512 f266c6f57107cddfd97085074f646a34ec4cc132dae85fa4c17526b213d1e34a6c77a1970ae0467e018408c867d1b2b71a9aaac2841e023c863912bda176dc60
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hjsejgikgl.exe
- Size 512KB
- SHA256 383aa000923b0a70846b4ca790b151bf4f10c34e21893e0e408776a919e8e0a4
- MD5 1a81f90b9e1b3db67619e387649bf72e
- SHA1 c56717232ca4e8c9d29f4074f74f2974bfeec287
- SHA512 75e3a9fca5fda2b38f51f4ceee8b80bc2bb0ee6c733eda3203d831ad9d64f532592d70b3947aed48b42bb508c7942671ceff05fc554db549e1cb20fd8982d190
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jjbrqcffhzgwaut.exe
- Size 512KB
- SHA256 cf4093c59a477151d8733658fb9110ab24bf202ed3d130000f9c33daf86815ce
- MD5 c506d2e4167a088f1f23ec2b9cf298df
- SHA1 7a2296385af577bf9b7bcecef1fc88c3f8a314d0
- SHA512 290cd9d8061e5f2c6b3a2ccc272cb6cf97509d1759334bbab0170b515c4f5ad32a511d4c1f120209b6b8e9ee1569d3cc824082375aa8253fc3e5dc909893c883
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 00cd6e996a3225f95a6beeaf33f5bdd55087864bce4875bb28864f8050492fbb
- MD5 521e005ed31b67c1581a0afa16b3c538
- SHA1 b177bf00b6177b1b041251062f68b145e133e8ee
- SHA512 7747cc4b5d7c03c9ee70598dc7d1d6f997a95953c0a9e455e5f65f27b414de3804c59f29efbe8ef467083c602562a0456ba3852a6ceb2b4f219fd66b54b5f73b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 748cd5c6b090e5645893eb3dd4626cb896eb4ec51527df42d851837ddfdcc04c
- MD5 29ed73b796995cc7daff3550d43c03a8
- SHA1 82563b5cec4da74511b42cba80a93d6b2477c424
- SHA512 150c6b79a0e738980f9c38d5d2cfe2b3c83deeed4ade0355e833d04e5c5542aedfe4ebf529d0ec05189f31032a0e8ae09661525e39dde33a192f47884a89546d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP