Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 01:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe
- Size 512KB
- Sample240611-b82b4azbnf
- SHA256 985f9fff7aea27158ab5588a648d3061b5d24d2b3dfc4df1ed0a3f5df508cf6a
- MD5 9ca2484ede722eb00a3538f3d1030871
- SHA1 91d929f49d2a8700b3c50b666cd6cff9f2981c1f
- SHA512 c2f4b0dc748ed04176527f69f51be53dd3372e58c59559c507377ec0fae1c20ce109ed46a9cd9959cb50d0bdcdc380193bb260f12576115c25c3fbcac8a22b86
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kyulatleru.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kyulatleru.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kyulatleru.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kyulatleru.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 4036 kyulatleru.exe 212 cgevygiguajeekd.exe 4916 lotshhel.exe 3924 mbzoncxwouunz.exe 2400 lotshhel.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kyulatleru.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\butfrgvm = "kyulatleru.exe" cgevygiguajeekd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miwplacs = "cgevygiguajeekd.exe" cgevygiguajeekd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mbzoncxwouunz.exe" cgevygiguajeekd.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: lotshhel.exe File opened (read-only) \??\o: lotshhel.exe File opened (read-only) \??\s: lotshhel.exe File opened (read-only) \??\v: lotshhel.exe File opened (read-only) \??\z: lotshhel.exe File opened (read-only) \??\m: lotshhel.exe File opened (read-only) \??\w: lotshhel.exe File opened (read-only) \??\m: kyulatleru.exe File opened (read-only) \??\v: kyulatleru.exe File opened (read-only) \??\e: lotshhel.exe File opened (read-only) \??\k: lotshhel.exe File opened (read-only) \??\l: lotshhel.exe File opened (read-only) \??\x: lotshhel.exe File opened (read-only) \??\q: lotshhel.exe File opened (read-only) \??\a: kyulatleru.exe File opened (read-only) \??\m: lotshhel.exe File opened (read-only) \??\l: lotshhel.exe File opened (read-only) \??\i: lotshhel.exe File opened (read-only) \??\b: lotshhel.exe File opened (read-only) \??\n: lotshhel.exe File opened (read-only) \??\x: kyulatleru.exe File opened (read-only) \??\o: lotshhel.exe File opened (read-only) \??\r: lotshhel.exe File opened (read-only) \??\n: kyulatleru.exe File opened (read-only) \??\h: kyulatleru.exe File opened (read-only) \??\q: kyulatleru.exe File opened (read-only) \??\g: lotshhel.exe File opened (read-only) \??\h: lotshhel.exe File opened (read-only) \??\p: lotshhel.exe File opened (read-only) \??\u: lotshhel.exe File opened (read-only) \??\j: lotshhel.exe File opened (read-only) \??\s: kyulatleru.exe File opened (read-only) \??\z: kyulatleru.exe File opened (read-only) \??\p: lotshhel.exe File opened (read-only) \??\w: lotshhel.exe File opened (read-only) \??\g: lotshhel.exe File opened (read-only) \??\z: lotshhel.exe File opened (read-only) \??\s: lotshhel.exe File opened (read-only) \??\u: kyulatleru.exe File opened (read-only) \??\a: lotshhel.exe File opened (read-only) \??\i: lotshhel.exe File opened (read-only) \??\q: lotshhel.exe File opened (read-only) \??\t: lotshhel.exe File opened (read-only) \??\e: kyulatleru.exe File opened (read-only) \??\k: lotshhel.exe File opened (read-only) \??\v: lotshhel.exe File opened (read-only) \??\g: kyulatleru.exe File opened (read-only) \??\i: kyulatleru.exe File opened (read-only) \??\r: kyulatleru.exe File opened (read-only) \??\t: kyulatleru.exe File opened (read-only) \??\b: lotshhel.exe File opened (read-only) \??\j: lotshhel.exe File opened (read-only) \??\y: lotshhel.exe File opened (read-only) \??\y: kyulatleru.exe File opened (read-only) \??\h: lotshhel.exe File opened (read-only) \??\t: lotshhel.exe File opened (read-only) \??\y: lotshhel.exe File opened (read-only) \??\a: lotshhel.exe File opened (read-only) \??\e: lotshhel.exe File opened (read-only) \??\b: kyulatleru.exe File opened (read-only) \??\o: kyulatleru.exe File opened (read-only) \??\p: kyulatleru.exe File opened (read-only) \??\r: lotshhel.exe File opened (read-only) \??\u: lotshhel.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kyulatleru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kyulatleru.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1544-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00070000000233ff-5.dat autoit_exe behavioral2/files/0x00080000000233fb-18.dat autoit_exe behavioral2/files/0x0007000000023400-27.dat autoit_exe behavioral2/files/0x0007000000023401-32.dat autoit_exe behavioral2/files/0x000b000000016299-57.dat autoit_exe behavioral2/files/0x0005000000016927-63.dat autoit_exe behavioral2/files/0x000200000001e70d-83.dat autoit_exe behavioral2/files/0x000200000001e70d-88.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lotshhel.exe File created C:\Windows\SysWOW64\kyulatleru.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cgevygiguajeekd.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mbzoncxwouunz.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kyulatleru.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification C:\Windows\SysWOW64\kyulatleru.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File created C:\Windows\SysWOW64\cgevygiguajeekd.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File created C:\Windows\SysWOW64\lotshhel.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File created C:\Windows\SysWOW64\mbzoncxwouunz.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification C:\Windows\SysWOW64\lotshhel.exe 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lotshhel.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lotshhel.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lotshhel.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal lotshhel.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lotshhel.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lotshhel.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal lotshhel.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lotshhel.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lotshhel.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lotshhel.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lotshhel.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe lotshhel.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe lotshhel.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lotshhel.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lotshhel.exe File opened for modification C:\Windows\mydoc.rtf 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe lotshhel.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe lotshhel.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kyulatleru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kyulatleru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kyulatleru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFFFC4F2A851E9136D75D7E9DBC95E13D584266426330D69E" 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kyulatleru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kyulatleru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kyulatleru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kyulatleru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kyulatleru.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACDFACAF913F2E484793B4686EB3996B38A028A4362033CE1CB42EB08D5" 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F368B0FF1B21DED172D0A98B7F9167" 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B15A4495389A53BDBAA132E9D7CA" 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kyulatleru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kyulatleru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kyulatleru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332D089D2C83536A4677D470532CDB7CF565DC" 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184DC67814E5DBC2B8C87CE5EDE437CA" 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kyulatleru.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1772 WINWORD.EXE 1772 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4916 lotshhel.exe 4916 lotshhel.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4916 lotshhel.exe 4916 lotshhel.exe 4036 kyulatleru.exe 4916 lotshhel.exe 4916 lotshhel.exe 4036 kyulatleru.exe 4916 lotshhel.exe 4916 lotshhel.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 212 cgevygiguajeekd.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 3924 mbzoncxwouunz.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4916 lotshhel.exe 4916 lotshhel.exe 4916 lotshhel.exe 212 cgevygiguajeekd.exe 3924 mbzoncxwouunz.exe 212 cgevygiguajeekd.exe 3924 mbzoncxwouunz.exe 212 cgevygiguajeekd.exe 3924 mbzoncxwouunz.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4036 kyulatleru.exe 4916 lotshhel.exe 4916 lotshhel.exe 4916 lotshhel.exe 212 cgevygiguajeekd.exe 3924 mbzoncxwouunz.exe 212 cgevygiguajeekd.exe 3924 mbzoncxwouunz.exe 212 cgevygiguajeekd.exe 3924 mbzoncxwouunz.exe 2400 lotshhel.exe 2400 lotshhel.exe 2400 lotshhel.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1772 WINWORD.EXE 1772 WINWORD.EXE 1772 WINWORD.EXE 1772 WINWORD.EXE 1772 WINWORD.EXE 1772 WINWORD.EXE 1772 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1544 wrote to memory of 4036 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 82 PID 1544 wrote to memory of 4036 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 82 PID 1544 wrote to memory of 4036 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 82 PID 1544 wrote to memory of 212 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 83 PID 1544 wrote to memory of 212 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 83 PID 1544 wrote to memory of 212 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 83 PID 1544 wrote to memory of 4916 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 84 PID 1544 wrote to memory of 4916 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 84 PID 1544 wrote to memory of 4916 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 84 PID 1544 wrote to memory of 3924 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 85 PID 1544 wrote to memory of 3924 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 85 PID 1544 wrote to memory of 3924 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 85 PID 1544 wrote to memory of 1772 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 86 PID 1544 wrote to memory of 1772 1544 9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe 86 PID 4036 wrote to memory of 2400 4036 kyulatleru.exe 89 PID 4036 wrote to memory of 2400 4036 kyulatleru.exe 89 PID 4036 wrote to memory of 2400 4036 kyulatleru.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9ca2484ede722eb00a3538f3d1030871_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\kyulatleru.exekyulatleru.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\lotshhel.exeC:\Windows\system32\lotshhel.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2400
-
-
-
C:\Windows\SysWOW64\cgevygiguajeekd.execgevygiguajeekd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:212
-
-
C:\Windows\SysWOW64\lotshhel.exelotshhel.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4916
-
-
C:\Windows\SysWOW64\mbzoncxwouunz.exembzoncxwouunz.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3924
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1772
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 c18dc77c796469984d3f4f4bab377b312d0eb36e1d3ab54dde1a7d9d8eb86086
- MD5 2d7ac6ee435f97bbde46f64ca53e4804
- SHA1 a5c6c75bc71591a7c133451b7737f060d578d435
- SHA512 15a7980b4c057c3011c3118b4eff13185ef9090cb66722d28869f7df750ef22731b7bf052642fd4fc6e60373c4809875039ec38f3fb0c9fe611534312b1b563a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 3c60b4e35b0a07d2c2b3e84e506f725d489500381fb9774d5f027d57787a442a
- MD5 521ae83137294efbb68a6b0484e7724f
- SHA1 5e6db51e3e4f0eb8a27419e9f18708aff508e911
- SHA512 4bd3b905f1e3c3ebd820ca345754a4034ef7dae3248aa039d1aa33a3a5fc64768681a440e9d8199f44405fda29da43f87900b7a21045b847cb6707e4527213c1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 290d83f274dcb9f579d5cd01c92096b32ece09b8080a6a362916e33569a0d97b
- MD5 fc777ec96d83a9dda2df93e421057554
- SHA1 2fcd9fa9d3a46a14daeb71e087f2913b6f062c20
- SHA512 a8c6a8407ff2d87befb4d63b2f776b15155398e729c08cefe343980ab5fbd130a6188d8507bed22e2deb2166cc4aad18b5d3613bb3b021cad687293ae763293f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 51a90533d1584d51d8eaaa01bef14ac77b6ef5a8851834953a3c0d7c63f9501b
- MD5 18692a361b9e2af1a3df859f240dbfd5
- SHA1 4208c521f4ac8dff63f71a76a879fd72e4d679a8
- SHA512 5a22f3b076717da16bed18068604e371fb5931699f54fcdfbe0d39e489005648beef9cb900c12eb2d6dfb9f9ef38eb3af02c02ddc674cc386452ceb5644c4941
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\cgevygiguajeekd.exe
- Size 512KB
- SHA256 959ab634da389bac268835415439398b30bcc34a43a39d268ab27d4af5729bbc
- MD5 1653872fedefc75284bdf51a37bb663c
- SHA1 33fc1f1d3ac15c50c0ce7ba95e7884755404e5cd
- SHA512 19c17a80ba8cc51bb6d6813ef75f2d9bb20fadd6153fe01c2fb99f20a9db8d5bf8ed253a2d902174722f6f8e2ba7e8ccf0b7a155cb90280db200c13e78c2f4dc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kyulatleru.exe
- Size 512KB
- SHA256 972bda60e80fade7b9147743a259fd4f039b3232d5e33afb979fa611c08dfeee
- MD5 ce205d864137c4140fa8c49cb17ddfe8
- SHA1 89c863d809ed9631ff55d8cc694916626c3462eb
- SHA512 023503e8f701dbc6a017275c8d8c504ccfa907d5d3f520327738945f5953abf7d71baec768bc8bb88aa8ef736c63f052dd3a06f4d6f2ad22f000e5929451262b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\lotshhel.exe
- Size 512KB
- SHA256 d6b4a3d93d0e3c92f58eb569674df3eabbdfb218372009803353bd0d3b27eef7
- MD5 e67a7ada3ceac0ebfd93e96dc5f6f6ca
- SHA1 3ffa3c426d390f5917403cebca8f41931ea87e67
- SHA512 ee483c7144e1f2ff68975c45b1dd20f00d1738073c92beb52ad510b9117643711067e123668e330203f4cd7a0de4b69758db52b14cbbf2bb52109479629cfd56
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mbzoncxwouunz.exe
- Size 512KB
- SHA256 b74fb1ed4dcf2cee6ed16c5533e155767ccd08d02822d87b54a32333e616fb76
- MD5 cee81f7b752dd8ed198e787388a084b6
- SHA1 a512333840f04213361c5a1da025aea360066809
- SHA512 ff815fd0ce1e4535605820a8b2acea27c15c0af1b75c6a525c843de6531470a1192a066c9d34706576e81d0196ebef01f43c74cae49a69ba416630d5706956cf
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 5254d7eb1caf44ff5b2bbf300b246050b0bd15b7dbe04e189ae2b9d6330d42f3
- MD5 c993a05f7a745f1e2399723d717bea7d
- SHA1 ef974d8a7cd238c8b674e33be19628bfafa8c48b
- SHA512 3622c62a0554b72c2dd3d31bfbe775ffc2c23c1273b5c685c1584b65fe13eda5b711c81f6273649ef6898fa62385b0a9e4db1e95b66fb3c2c50adcbfe04608c3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 812af27b3795d19c6c4055be8cd270e71238cf83fc66c1fcddd51a9e6094760a
- MD5 4d729917de896b7f9b0632cb5c5b25e1
- SHA1 72c82a059946d38286b5d5874f9957208ce04cf8
- SHA512 044ed7fd6ae90c8b5bc9aeb5821ae47ea98fc979252ce3953b292985effeaf418dd3614747b81f1c9364fef7f6461cb7e2fdfd2fbbeb9065275fede744e0c18f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- MD5 SHA1 SHA512 SSDEEP