Analysis
- max time kernel
149s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 10:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe
- Size 512KB
- Sample240611-me273stbre
- SHA256 ba8fec3700bb4428d3909a583256058beb8357b6e6a90c6fc2eea557265c1a94
- MD5 9dda1889b5084777dc7a1756c4420d30
- SHA1 b7504bd046115e88adfccdaa235fcbae1fba743d
- SHA512 d98cc81ff610fd033373752a962a31f07100f26119aeca2ea27a8e5dd0bfe140bbadde7cbabae07c08320c64cd1161d71bc7daa1b6c863e6aac906bb44fb0460
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ktwroklvaw.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ktwroklvaw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ktwroklvaw.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ktwroklvaw.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 528 ktwroklvaw.exe 216 yzsqsadzgreleno.exe 2460 iofypcnf.exe 668 xjiadmlyetecv.exe 2012 iofypcnf.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ktwroklvaw.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rbbmhezu = "ktwroklvaw.exe" yzsqsadzgreleno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gnvbzcwl = "yzsqsadzgreleno.exe" yzsqsadzgreleno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xjiadmlyetecv.exe" yzsqsadzgreleno.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: iofypcnf.exe File opened (read-only) \??\y: iofypcnf.exe File opened (read-only) \??\j: iofypcnf.exe File opened (read-only) \??\n: iofypcnf.exe File opened (read-only) \??\w: iofypcnf.exe File opened (read-only) \??\e: ktwroklvaw.exe File opened (read-only) \??\s: ktwroklvaw.exe File opened (read-only) \??\y: ktwroklvaw.exe File opened (read-only) \??\m: iofypcnf.exe File opened (read-only) \??\l: iofypcnf.exe File opened (read-only) \??\m: iofypcnf.exe File opened (read-only) \??\v: iofypcnf.exe File opened (read-only) \??\i: ktwroklvaw.exe File opened (read-only) \??\n: ktwroklvaw.exe File opened (read-only) \??\o: ktwroklvaw.exe File opened (read-only) \??\q: ktwroklvaw.exe File opened (read-only) \??\v: ktwroklvaw.exe File opened (read-only) \??\j: iofypcnf.exe File opened (read-only) \??\a: ktwroklvaw.exe File opened (read-only) \??\x: iofypcnf.exe File opened (read-only) \??\g: ktwroklvaw.exe File opened (read-only) \??\k: ktwroklvaw.exe File opened (read-only) \??\b: ktwroklvaw.exe File opened (read-only) \??\e: iofypcnf.exe File opened (read-only) \??\h: iofypcnf.exe File opened (read-only) \??\y: iofypcnf.exe File opened (read-only) \??\q: iofypcnf.exe File opened (read-only) \??\x: iofypcnf.exe File opened (read-only) \??\p: iofypcnf.exe File opened (read-only) \??\r: iofypcnf.exe File opened (read-only) \??\m: ktwroklvaw.exe File opened (read-only) \??\r: iofypcnf.exe File opened (read-only) \??\a: iofypcnf.exe File opened (read-only) \??\h: iofypcnf.exe File opened (read-only) \??\n: iofypcnf.exe File opened (read-only) \??\g: iofypcnf.exe File opened (read-only) \??\l: iofypcnf.exe File opened (read-only) \??\o: iofypcnf.exe File opened (read-only) \??\p: ktwroklvaw.exe File opened (read-only) \??\b: iofypcnf.exe File opened (read-only) \??\o: iofypcnf.exe File opened (read-only) \??\b: iofypcnf.exe File opened (read-only) \??\i: iofypcnf.exe File opened (read-only) \??\i: iofypcnf.exe File opened (read-only) \??\e: iofypcnf.exe File opened (read-only) \??\t: iofypcnf.exe File opened (read-only) \??\v: iofypcnf.exe File opened (read-only) \??\z: iofypcnf.exe File opened (read-only) \??\l: ktwroklvaw.exe File opened (read-only) \??\z: ktwroklvaw.exe File opened (read-only) \??\g: iofypcnf.exe File opened (read-only) \??\u: iofypcnf.exe File opened (read-only) \??\r: ktwroklvaw.exe File opened (read-only) \??\t: ktwroklvaw.exe File opened (read-only) \??\k: iofypcnf.exe File opened (read-only) \??\s: iofypcnf.exe File opened (read-only) \??\t: iofypcnf.exe File opened (read-only) \??\z: iofypcnf.exe File opened (read-only) \??\h: ktwroklvaw.exe File opened (read-only) \??\x: ktwroklvaw.exe File opened (read-only) \??\s: iofypcnf.exe File opened (read-only) \??\w: ktwroklvaw.exe File opened (read-only) \??\a: iofypcnf.exe File opened (read-only) \??\u: iofypcnf.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ktwroklvaw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ktwroklvaw.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1580-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023413-5.dat autoit_exe behavioral2/files/0x000800000002340f-18.dat autoit_exe behavioral2/files/0x0007000000023414-27.dat autoit_exe behavioral2/files/0x0007000000023415-31.dat autoit_exe behavioral2/files/0x0006000000016952-57.dat autoit_exe behavioral2/files/0x000a000000016fb1-63.dat autoit_exe behavioral2/files/0x001500000001e09e-83.dat autoit_exe behavioral2/files/0x001500000001e09e-87.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\xjiadmlyetecv.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ktwroklvaw.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification C:\Windows\SysWOW64\ktwroklvaw.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File created C:\Windows\SysWOW64\iofypcnf.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iofypcnf.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File created C:\Windows\SysWOW64\xjiadmlyetecv.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File created C:\Windows\SysWOW64\ktwroklvaw.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File created C:\Windows\SysWOW64\yzsqsadzgreleno.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yzsqsadzgreleno.exe 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe iofypcnf.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe iofypcnf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal iofypcnf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe iofypcnf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe iofypcnf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe iofypcnf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal iofypcnf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal iofypcnf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe iofypcnf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal iofypcnf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe iofypcnf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe iofypcnf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe iofypcnf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe iofypcnf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe iofypcnf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe iofypcnf.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe iofypcnf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe iofypcnf.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe iofypcnf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe iofypcnf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification C:\Windows\mydoc.rtf 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe iofypcnf.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe iofypcnf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe iofypcnf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe iofypcnf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FF8D48298569913CD72A7DE0BCE4E137584367426346D6E9" 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ktwroklvaw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332D7C9D5582226A3376A270532DD87D8F65DE" 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC2B15A479338EB52CEBAD1329BD7B9" 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F36BB7FE6621ACD278D0D28B089016" 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ktwroklvaw.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ktwroklvaw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ktwroklvaw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ktwroklvaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCF9BEFE11F29884083B40869F3EE2B088038F4314034CE1CB42EE08A5" 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC67F14E4DAC0B9CE7CE7ECE034BE" 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2076 WINWORD.EXE 2076 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 2460 iofypcnf.exe 216 yzsqsadzgreleno.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 528 ktwroklvaw.exe 2460 iofypcnf.exe 216 yzsqsadzgreleno.exe 2460 iofypcnf.exe 2460 iofypcnf.exe 216 yzsqsadzgreleno.exe 216 yzsqsadzgreleno.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 668 xjiadmlyetecv.exe 2012 iofypcnf.exe 2012 iofypcnf.exe 2012 iofypcnf.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2076 WINWORD.EXE 2076 WINWORD.EXE 2076 WINWORD.EXE 2076 WINWORD.EXE 2076 WINWORD.EXE 2076 WINWORD.EXE 2076 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1580 wrote to memory of 528 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 84 PID 1580 wrote to memory of 528 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 84 PID 1580 wrote to memory of 528 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 84 PID 1580 wrote to memory of 216 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 85 PID 1580 wrote to memory of 216 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 85 PID 1580 wrote to memory of 216 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 85 PID 1580 wrote to memory of 2460 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 86 PID 1580 wrote to memory of 2460 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 86 PID 1580 wrote to memory of 2460 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 86 PID 1580 wrote to memory of 668 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 87 PID 1580 wrote to memory of 668 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 87 PID 1580 wrote to memory of 668 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 87 PID 1580 wrote to memory of 2076 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 88 PID 1580 wrote to memory of 2076 1580 9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe 88 PID 528 wrote to memory of 2012 528 ktwroklvaw.exe 90 PID 528 wrote to memory of 2012 528 ktwroklvaw.exe 90 PID 528 wrote to memory of 2012 528 ktwroklvaw.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9dda1889b5084777dc7a1756c4420d30_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\ktwroklvaw.exektwroklvaw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\iofypcnf.exeC:\Windows\system32\iofypcnf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012
-
-
-
C:\Windows\SysWOW64\yzsqsadzgreleno.exeyzsqsadzgreleno.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:216
-
-
C:\Windows\SysWOW64\iofypcnf.exeiofypcnf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2460
-
-
C:\Windows\SysWOW64\xjiadmlyetecv.exexjiadmlyetecv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:668
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2076
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 21bc6077f821a80b55c29ffe74ca3055ffad53210ce555d7e292464ee9b4894e
- MD5 25a14504613780ce9a908aa19ab6fc04
- SHA1 5bc4d4741fda67f32942d4fb7f35de19446cd8e2
- SHA512 05e1563b6f650a63cd1631bbeea72fc74c73535ca04432e0aaac1e2b54505ea725fe70608e054866de75e900f2aeeeb936b2c8ab70d627c8037498af96d7ba4c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 54a3bdd97ac7b58614d40f2e4d449824ca5e594be9324179b2a8bd8043ddf611
- MD5 c9d0b4e73f5158ef4d88a0750c696dfd
- SHA1 015ad36d50d672b51d9366d4a629f20ec303761e
- SHA512 d61ea23ebbb298667c0e00e85fcdc15aa778d75c5564a2b54753aeab1989a6a53db3fa5e871a067b8bfda02ecd5c05f1a3502145ce6cc8d59a20604b5ba1efd1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 102ba56532baaebc9f565b83d4699046ac0af77d35294575a555efb19ca57422
- MD5 33e68ad68462b02c87ea87b415c2d47a
- SHA1 a754e3317fbd6621db043b3fb6cc97e50408426d
- SHA512 ac658bc4bb2b441c44e90f5995cdf2c2b02d662c1fea197e9eb4f0656ffd9a60596503631882d7df774c679742a75ada7a9fbce7d76d9737bdee50635e1db6f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 e121959403cc85430327ee8567c431214cc1be985663a2759595882612dc3195
- MD5 e72e70135be748eed58b95a22654d0eb
- SHA1 d9bb4382246aaa7148e8e3b7887b3d203deeaba9
- SHA512 6ca93ee6499615ed283cd972796c59790018637c22cb7c5d0ca472f6d9d1cd0f10ad76c6dc40e7842372d96b4aa6360abf6007d219ea3b8e3d60e487c5afc1cb
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\iofypcnf.exe
- Size 512KB
- SHA256 0cae5bc8c074afc2f465b4e07f90cebc7cf7e6836c766758dea913946d06dabd
- MD5 7a7d01a2ea09b92783f4e7bbc6381499
- SHA1 419f6a328296f44b980796d68dc065fe2354d8c5
- SHA512 173793b5a8d9b9094dd958deeab88312756e8e540cf2e6f8da5659dbd8fed877be58ef37277a73f0f53e2bef17b37fda53e764db247a41ff01933645c9d8fa09
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ktwroklvaw.exe
- Size 512KB
- SHA256 9e50aa1740359e785a969ecc6738625312459ea71bba4505da2a7578613a21da
- MD5 ac7d4a164e2d7c2d39c4d75bc581c890
- SHA1 6a53a2248090f563eeca060478060c3b84c84b46
- SHA512 4d13f944428e7977e0087a4c84310f7bbcb7938153efd522ac49739b7eedb58e4b05ea41b7bd693dc4ee629428af28627896a6e6643269d864450ddf1b00debd
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xjiadmlyetecv.exe
- Size 512KB
- SHA256 2f3b5032268e9951f615b6af761eb1822019b55f4111b14d5d4a0f71a5dc08f3
- MD5 224062e8123fc7177adda99c794938ff
- SHA1 e1793c671674afca170a35ecad6444ac92a64718
- SHA512 e9a71470872784109420f8035c006245fa014dc4ccc47df80258a74df0ec5e135e9b748121a38af5bb2b1d09d976581dfba254de9e652aa0315fd2b616902fce
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\yzsqsadzgreleno.exe
- Size 512KB
- SHA256 87759e92c7ecb27d8a50755caaf7ce3f2b4703d57ebb85680804c2c2c0cca98b
- MD5 95a601f283955ddc3c5ccc5a71b8eded
- SHA1 3f8cd99970561aa6e18e00df148eebb9ac1a9816
- SHA512 17f78cd75182a0453b71b32a843f42af2e27fd37f82130332c61d9e12ff8b5609085c0869533167f78f82121ff1bfd2acabb5e18ee9bd492ff54d7e697ee0688
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 13165f2d6b9f9f119d730ef7fe997ca27ec389110f59c3dda8d946cf6af59737
- MD5 7c2cf3464243b3a613d99d80762d36cf
- SHA1 b17e330e94c4c5ba956366a9eb6b56a0e6859a08
- SHA512 9b365f0ea0459bb46c730c187b41dea718b16ad801f617350862518e731c18ccde3d5a0f1d0d4db6fd8ffada2c5faf07cbe309d81f36a6d0bf0d1219237a4169
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 388846f9db76a5ff1f3b262fea597f0c8932f07affc9e8a64ddd3408258c4064
- MD5 3526e8b02717af7e2b05fe6771a3a8cc
- SHA1 6bd384733bad7537d28cbbef7435e546ea77f930
- SHA512 716b3db0b08ea0278f06529ea7d1515644f238e399c43d9c8fcc9346917b1554e38735d257b5c17e57e692145f12c058b824b4e4dce9310ffc7679216d4fac9d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- MD5 SHA1 SHA512 SSDEEP