Analysis
- max time kernel
150s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 14:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe
- Size 512KB
- Sample240605-rek11shc71
- SHA256 3d87ef5316f13345907fc66eee25046d7076f1e1f3949be23bc1517d63ec2879
- MD5 9859c394a5724b25b10218570ec6f401
- SHA1 03f5090461bb246a6eb5a585c8e5070dac3ca684
- SHA512 3c06e53b76844caccd498fe58ff0ea9859bb9d51c6b038ecd762e9ca50c217abd047435601f3df45090526a6031db157719154594b0438bbf243d1d860e1899c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fngpjacezm.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fngpjacezm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fngpjacezm.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fngpjacezm.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 3580 fngpjacezm.exe 1136 mflkekhyaeafkcn.exe 676 nojegzma.exe 4792 kmbwyxbrqmcal.exe 1080 nojegzma.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fngpjacezm.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uxcrurns = "fngpjacezm.exe" mflkekhyaeafkcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nvcloovy = "mflkekhyaeafkcn.exe" mflkekhyaeafkcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kmbwyxbrqmcal.exe" mflkekhyaeafkcn.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: nojegzma.exe File opened (read-only) \??\a: nojegzma.exe File opened (read-only) \??\r: nojegzma.exe File opened (read-only) \??\w: nojegzma.exe File opened (read-only) \??\m: nojegzma.exe File opened (read-only) \??\b: fngpjacezm.exe File opened (read-only) \??\w: fngpjacezm.exe File opened (read-only) \??\l: nojegzma.exe File opened (read-only) \??\p: nojegzma.exe File opened (read-only) \??\g: nojegzma.exe File opened (read-only) \??\r: nojegzma.exe File opened (read-only) \??\z: fngpjacezm.exe File opened (read-only) \??\o: nojegzma.exe File opened (read-only) \??\j: nojegzma.exe File opened (read-only) \??\a: fngpjacezm.exe File opened (read-only) \??\g: fngpjacezm.exe File opened (read-only) \??\m: fngpjacezm.exe File opened (read-only) \??\v: fngpjacezm.exe File opened (read-only) \??\y: fngpjacezm.exe File opened (read-only) \??\k: nojegzma.exe File opened (read-only) \??\u: nojegzma.exe File opened (read-only) \??\a: nojegzma.exe File opened (read-only) \??\n: nojegzma.exe File opened (read-only) \??\n: nojegzma.exe File opened (read-only) \??\o: nojegzma.exe File opened (read-only) \??\z: nojegzma.exe File opened (read-only) \??\v: nojegzma.exe File opened (read-only) \??\e: fngpjacezm.exe File opened (read-only) \??\g: nojegzma.exe File opened (read-only) \??\x: nojegzma.exe File opened (read-only) \??\i: nojegzma.exe File opened (read-only) \??\l: nojegzma.exe File opened (read-only) \??\p: fngpjacezm.exe File opened (read-only) \??\i: nojegzma.exe File opened (read-only) \??\y: nojegzma.exe File opened (read-only) \??\y: nojegzma.exe File opened (read-only) \??\n: fngpjacezm.exe File opened (read-only) \??\q: fngpjacezm.exe File opened (read-only) \??\b: nojegzma.exe File opened (read-only) \??\h: nojegzma.exe File opened (read-only) \??\j: nojegzma.exe File opened (read-only) \??\k: fngpjacezm.exe File opened (read-only) \??\q: nojegzma.exe File opened (read-only) \??\s: nojegzma.exe File opened (read-only) \??\o: fngpjacezm.exe File opened (read-only) \??\u: fngpjacezm.exe File opened (read-only) \??\k: nojegzma.exe File opened (read-only) \??\s: nojegzma.exe File opened (read-only) \??\t: nojegzma.exe File opened (read-only) \??\r: fngpjacezm.exe File opened (read-only) \??\s: fngpjacezm.exe File opened (read-only) \??\u: nojegzma.exe File opened (read-only) \??\l: fngpjacezm.exe File opened (read-only) \??\p: nojegzma.exe File opened (read-only) \??\q: nojegzma.exe File opened (read-only) \??\x: nojegzma.exe File opened (read-only) \??\j: fngpjacezm.exe File opened (read-only) \??\t: nojegzma.exe File opened (read-only) \??\b: nojegzma.exe File opened (read-only) \??\h: fngpjacezm.exe File opened (read-only) \??\i: fngpjacezm.exe File opened (read-only) \??\t: fngpjacezm.exe File opened (read-only) \??\e: nojegzma.exe File opened (read-only) \??\z: nojegzma.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fngpjacezm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fngpjacezm.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/212-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233fb-5.dat autoit_exe behavioral2/files/0x00080000000233f7-18.dat autoit_exe behavioral2/files/0x00070000000233fc-26.dat autoit_exe behavioral2/files/0x00070000000233fd-31.dat autoit_exe behavioral2/files/0x00080000000233de-68.dat autoit_exe behavioral2/files/0x0007000000023409-71.dat autoit_exe behavioral2/files/0x000800000002347b-517.dat autoit_exe behavioral2/files/0x000800000002347b-573.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\nojegzma.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File created C:\Windows\SysWOW64\kmbwyxbrqmcal.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fngpjacezm.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe nojegzma.exe File created C:\Windows\SysWOW64\fngpjacezm.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fngpjacezm.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File created C:\Windows\SysWOW64\nojegzma.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe nojegzma.exe File created C:\Windows\SysWOW64\mflkekhyaeafkcn.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mflkekhyaeafkcn.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kmbwyxbrqmcal.exe 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal nojegzma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nojegzma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal nojegzma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal nojegzma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nojegzma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nojegzma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nojegzma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nojegzma.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nojegzma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal nojegzma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nojegzma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nojegzma.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nojegzma.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nojegzma.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe nojegzma.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe nojegzma.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification C:\Windows\mydoc.rtf 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe nojegzma.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe nojegzma.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe nojegzma.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe nojegzma.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe nojegzma.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe nojegzma.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC5B15A47E4399853C9B9A73298D7BC" 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fngpjacezm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" fngpjacezm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fngpjacezm.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFF8A485D826F9031D62F7D97BCEFE633594A6744633FD798" 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F468C4FE6722DAD10CD1D38A0C9010" 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" fngpjacezm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fngpjacezm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fngpjacezm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452C769C5582246A3676D170252CDB7C8464AF" 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB8FAC9F961F19283753B4A86EC3E98B08E02F14369033FE1C5429C08A4" 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat fngpjacezm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs fngpjacezm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" fngpjacezm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf fngpjacezm.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184EC70C15E1DAB7B8CB7C90ECE337B9" 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fngpjacezm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc fngpjacezm.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4484 WINWORD.EXE 4484 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 4792 kmbwyxbrqmcal.exe 676 nojegzma.exe 676 nojegzma.exe 676 nojegzma.exe 676 nojegzma.exe 676 nojegzma.exe 676 nojegzma.exe 676 nojegzma.exe 676 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 4792 kmbwyxbrqmcal.exe 676 nojegzma.exe 4792 kmbwyxbrqmcal.exe 676 nojegzma.exe 4792 kmbwyxbrqmcal.exe 676 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 3580 fngpjacezm.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 1136 mflkekhyaeafkcn.exe 4792 kmbwyxbrqmcal.exe 676 nojegzma.exe 4792 kmbwyxbrqmcal.exe 676 nojegzma.exe 4792 kmbwyxbrqmcal.exe 676 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe 1080 nojegzma.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 212 wrote to memory of 3580 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 83 PID 212 wrote to memory of 3580 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 83 PID 212 wrote to memory of 3580 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 83 PID 212 wrote to memory of 1136 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 84 PID 212 wrote to memory of 1136 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 84 PID 212 wrote to memory of 1136 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 84 PID 212 wrote to memory of 676 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 85 PID 212 wrote to memory of 676 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 85 PID 212 wrote to memory of 676 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 85 PID 212 wrote to memory of 4792 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 86 PID 212 wrote to memory of 4792 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 86 PID 212 wrote to memory of 4792 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 86 PID 3580 wrote to memory of 1080 3580 fngpjacezm.exe 87 PID 3580 wrote to memory of 1080 3580 fngpjacezm.exe 87 PID 3580 wrote to memory of 1080 3580 fngpjacezm.exe 87 PID 212 wrote to memory of 4484 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 88 PID 212 wrote to memory of 4484 212 9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9859c394a5724b25b10218570ec6f401_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\fngpjacezm.exefngpjacezm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\nojegzma.exeC:\Windows\system32\nojegzma.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1080
-
-
-
C:\Windows\SysWOW64\mflkekhyaeafkcn.exemflkekhyaeafkcn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1136
-
-
C:\Windows\SysWOW64\nojegzma.exenojegzma.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:676
-
-
C:\Windows\SysWOW64\kmbwyxbrqmcal.exekmbwyxbrqmcal.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4792
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4484
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 501781962f11002b6508b390db0e98f58210ff9bea82d41de9d14bed38af4474
- MD5 f28fab4473ad5943303f098211a6f7ea
- SHA1 9fac616c78e7eaaa18ecb488bcf9064dc8743b83
- SHA512 20b0d7a89457bafaa7e5457f37e027c9f71ac884d143f70512e876154781a850d1cdeeb7138d58ca6eb381c5b51567fae679c0dfee8398e855ba85f397f591cb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 48e7984295de2d543afb084a8939d51604a0db6036ffae6e6fca92dc182482db
- MD5 fdcdeefa8fc1797b086649b7ff02055b
- SHA1 c173df56f22acfc3c0816b13a58d4ba75d477b5c
- SHA512 05b88a15f4350956e8d60efac6b0a8112be1d2745fe329522b9d8a6be1ee711c219b41a6536e9d15f31dbd7ee1a3d021489e60b4596d90a671d4557cdecce0f3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD95B6.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 0de6d4827d85536c8fcd619d20189d6276d3b82d0ebaee4598a343789823077e
- MD5 cc8e882159937ac902a940f731e7b33a
- SHA1 ca40fdb7eb93cc919e4926cd867c64e27e959e95
- SHA512 7ed40b9865615639ac7fbadd117464bc5be59e4fc56982df822096da1cfbe921e6570c81ce1f40f2ccabbca52a5d110031744a60e7f4dfb4e2094c8b175add88
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 016210553525e6c075793f3615383c8b327615f60b49a3700e24edc3702fc8ae
- MD5 72ce0c510ffb78f885324b5779efe870
- SHA1 391b1e51535b0ad80d9677af2ef38ce828aafd94
- SHA512 02aa6d2b4d2fe13d17f56bb1e08cd43c6f9a822a6bb614169a659762abcb80b3fdcc971ee6d30e16099706814d1b3a40ba4c1eec0ef5b9d66bf66a2508fb93da
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\fngpjacezm.exe
- Size 512KB
- SHA256 0e87dc126d457cadb4c2edaa75f5c0c3ef9c4bf3bf99e9a1eae419a0d856ef80
- MD5 f3958cd22d31490bb7d32c5a395eb282
- SHA1 25d66c531e9f10a61b03371567d1091951211af3
- SHA512 6b604d63216724706a8fe5f7df994215d0d303d3130e8ff7b211926f50033023b08e6145f2eb891516ecb42f5f0f98bce89f3a15850fc14e935ce5c81a1917a5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kmbwyxbrqmcal.exe
- Size 512KB
- SHA256 6df4248776770aa5adb761e2cc17f84cbba844e91489a7f87a76f7b82a02e231
- MD5 e6300de1e4bd29e5ca71d4e3c058f0d3
- SHA1 a0af652ea9a96890487371fecd076b5f6d8b1661
- SHA512 6ebe134a1921f1659e59cacc6bde9ca032c56ca18b9db6b43723c145cf65241d4ef242947356ccdb36f342ddd8a0b8315aef1e0ffe28c72e54b0a1a7c2b78532
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mflkekhyaeafkcn.exe
- Size 512KB
- SHA256 5a036890a2a78b3740fa9f102d2c915a56190142146e1ea576489e9ccd186e14
- MD5 a87d0db126c15b5cb2a78d317814f63c
- SHA1 101e0a2b7c54ed5f849bb1e3322e7d39adb23ee0
- SHA512 6fc366dbee83d006330212979c409d828541e3d6e5074606acbf9df984deddf03cf38b0a9ad735b34854d4d770f326d7484c50bc9c0b53a1ca3b0ee6a1ea4f3b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\nojegzma.exe
- Size 512KB
- SHA256 5509df23f52c328d40fad55dfd04dede9c0a390b3737e5b3e9986f531b199c00
- MD5 8651fa7ad21e7c2f15520ab3abd4ff44
- SHA1 bfe305b5889cde995940ea3a1fc212634cb8292f
- SHA512 897332576e6d3eab08a917768cfb3dfe976388c18b82b9b7e253f729716c5a02ebd306ed4cb6616290ccdef9cb83544c2b611587c0db1270862dc3df6b1fbe88
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 b2d2369fe312eab51fe51e4a9ced4d3b7c4a2fd2b713e8ec43aaad92d143b947
- MD5 44a6dfc8c268f74d305391d06dea97e0
- SHA1 ba7d4d926acf27c40e95e77811e6cfb9b44619d2
- SHA512 b8103223c3cbc5713116606709865b60b6c6ceac5bc74a1b810d3f18d4355814a74f1ce9096a0846e1414a6e0699ab485bed88047f3820c6b44c418abf691727
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 513KB
- SHA256 fe392dc10536a1a917c3bf1a2548d815c4935a8c263d521232498840c14a37c2
- MD5 1fc89efb56b6362ad56c267f60fc96da
- SHA1 c013ccd4a9beef07a2bf8728aabdb1ffb25a7c36
- SHA512 69d3af9ea914267723f95c6bf64edead7d35554048eb816284a899257731b1501ec6c1e1777f5c4aa8a45dc9221424b8a085bfaa887650a77c1eff38ca327279
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- MD5 SHA1 SHA512 SSDEEP