Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 22:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe
- Size 512KB
- Sample240612-125hlssdrd
- SHA256 8cf252c6764331bbcb37abe4fb8484bc22d2e51edf9b9eae55be69025201ef04
- MD5 a2a071b6451c3f392b3cd99c7b22c636
- SHA1 ed985f99334cea75693cd98f2fb76b2aaaf97714
- SHA512 6fa7b08635e6ddb456c40e38abab3587d49317df2b4981a9421074779c757b6b7f97c15982acff326da2b3c829b4f39a3e34d90b3f856c58101f880f0ab8de1f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6l:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ckspqtlkug.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ckspqtlkug.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ckspqtlkug.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ckspqtlkug.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 4456 ckspqtlkug.exe 4920 vbhnficppyvyhqs.exe 2296 regajffd.exe 3568 kvhbfeckxduts.exe 3540 regajffd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ckspqtlkug.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fcpmodjz = "ckspqtlkug.exe" vbhnficppyvyhqs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mecclxmc = "vbhnficppyvyhqs.exe" vbhnficppyvyhqs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kvhbfeckxduts.exe" vbhnficppyvyhqs.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: regajffd.exe File opened (read-only) \??\i: ckspqtlkug.exe File opened (read-only) \??\r: regajffd.exe File opened (read-only) \??\u: regajffd.exe File opened (read-only) \??\a: regajffd.exe File opened (read-only) \??\h: regajffd.exe File opened (read-only) \??\z: regajffd.exe File opened (read-only) \??\g: regajffd.exe File opened (read-only) \??\t: regajffd.exe File opened (read-only) \??\m: regajffd.exe File opened (read-only) \??\w: regajffd.exe File opened (read-only) \??\x: regajffd.exe File opened (read-only) \??\e: ckspqtlkug.exe File opened (read-only) \??\y: ckspqtlkug.exe File opened (read-only) \??\e: regajffd.exe File opened (read-only) \??\p: regajffd.exe File opened (read-only) \??\y: regajffd.exe File opened (read-only) \??\v: regajffd.exe File opened (read-only) \??\a: regajffd.exe File opened (read-only) \??\i: regajffd.exe File opened (read-only) \??\l: regajffd.exe File opened (read-only) \??\q: regajffd.exe File opened (read-only) \??\r: regajffd.exe File opened (read-only) \??\a: ckspqtlkug.exe File opened (read-only) \??\h: ckspqtlkug.exe File opened (read-only) \??\w: ckspqtlkug.exe File opened (read-only) \??\q: regajffd.exe File opened (read-only) \??\s: regajffd.exe File opened (read-only) \??\b: regajffd.exe File opened (read-only) \??\j: ckspqtlkug.exe File opened (read-only) \??\p: ckspqtlkug.exe File opened (read-only) \??\q: ckspqtlkug.exe File opened (read-only) \??\t: ckspqtlkug.exe File opened (read-only) \??\j: regajffd.exe File opened (read-only) \??\z: regajffd.exe File opened (read-only) \??\z: ckspqtlkug.exe File opened (read-only) \??\j: regajffd.exe File opened (read-only) \??\m: regajffd.exe File opened (read-only) \??\o: regajffd.exe File opened (read-only) \??\y: regajffd.exe File opened (read-only) \??\e: regajffd.exe File opened (read-only) \??\k: regajffd.exe File opened (read-only) \??\n: regajffd.exe File opened (read-only) \??\b: ckspqtlkug.exe File opened (read-only) \??\k: ckspqtlkug.exe File opened (read-only) \??\m: ckspqtlkug.exe File opened (read-only) \??\n: ckspqtlkug.exe File opened (read-only) \??\u: ckspqtlkug.exe File opened (read-only) \??\x: regajffd.exe File opened (read-only) \??\u: regajffd.exe File opened (read-only) \??\l: ckspqtlkug.exe File opened (read-only) \??\s: ckspqtlkug.exe File opened (read-only) \??\v: ckspqtlkug.exe File opened (read-only) \??\i: regajffd.exe File opened (read-only) \??\w: regajffd.exe File opened (read-only) \??\r: ckspqtlkug.exe File opened (read-only) \??\b: regajffd.exe File opened (read-only) \??\g: regajffd.exe File opened (read-only) \??\s: regajffd.exe File opened (read-only) \??\g: ckspqtlkug.exe File opened (read-only) \??\h: regajffd.exe File opened (read-only) \??\l: regajffd.exe File opened (read-only) \??\v: regajffd.exe File opened (read-only) \??\t: regajffd.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ckspqtlkug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ckspqtlkug.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4604-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000800000002344d-5.dat autoit_exe behavioral2/files/0x00050000000232b2-19.dat autoit_exe behavioral2/files/0x0007000000023451-27.dat autoit_exe behavioral2/files/0x0007000000023452-32.dat autoit_exe behavioral2/files/0x0002000000022a04-62.dat autoit_exe behavioral2/files/0x000800000002343d-65.dat autoit_exe behavioral2/files/0x001b000000023467-557.dat autoit_exe behavioral2/files/0x001b000000023467-561.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe regajffd.exe File created C:\Windows\SysWOW64\regajffd.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\regajffd.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File created C:\Windows\SysWOW64\kvhbfeckxduts.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vbhnficppyvyhqs.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kvhbfeckxduts.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ckspqtlkug.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe regajffd.exe File created C:\Windows\SysWOW64\ckspqtlkug.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ckspqtlkug.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File created C:\Windows\SysWOW64\vbhnficppyvyhqs.exe a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe regajffd.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe regajffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal regajffd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe regajffd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe regajffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe regajffd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe regajffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe regajffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal regajffd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe regajffd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe regajffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe regajffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal regajffd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe regajffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal regajffd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe regajffd.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe regajffd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe regajffd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe regajffd.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe regajffd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe regajffd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe regajffd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe regajffd.exe File opened for modification C:\Windows\mydoc.rtf a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe regajffd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe regajffd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe regajffd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFCF8482885139145D75B7D96BDE6E643594366426243D6EE" a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F76BB6FF1F21ACD27FD0D18A089060" a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ckspqtlkug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ckspqtlkug.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ckspqtlkug.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ckspqtlkug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ckspqtlkug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402C0A9D5182246D4677D470532CAE7CF464DE" a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAFACDF965F197830F3B3186983E91B38F03FD4215024BE1BD459A09A9" a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ckspqtlkug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ckspqtlkug.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ckspqtlkug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ckspqtlkug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB2B12F479039E353C4BAD43293D7BB" a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ckspqtlkug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ckspqtlkug.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184DC67415E1DAC3B8C87F95ED9334CA" a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ckspqtlkug.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3376 WINWORD.EXE 3376 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 3568 kvhbfeckxduts.exe 2296 regajffd.exe 2296 regajffd.exe 2296 regajffd.exe 2296 regajffd.exe 2296 regajffd.exe 2296 regajffd.exe 2296 regajffd.exe 2296 regajffd.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 3540 regajffd.exe 3540 regajffd.exe 3540 regajffd.exe 3540 regajffd.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 2296 regajffd.exe 3568 kvhbfeckxduts.exe 2296 regajffd.exe 3568 kvhbfeckxduts.exe 2296 regajffd.exe 3568 kvhbfeckxduts.exe 3540 regajffd.exe 3540 regajffd.exe 3540 regajffd.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4456 ckspqtlkug.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 4920 vbhnficppyvyhqs.exe 2296 regajffd.exe 3568 kvhbfeckxduts.exe 2296 regajffd.exe 3568 kvhbfeckxduts.exe 2296 regajffd.exe 3568 kvhbfeckxduts.exe 3540 regajffd.exe 3540 regajffd.exe 3540 regajffd.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3376 WINWORD.EXE 3376 WINWORD.EXE 3376 WINWORD.EXE 3376 WINWORD.EXE 3376 WINWORD.EXE 3376 WINWORD.EXE 3376 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4604 wrote to memory of 4456 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 83 PID 4604 wrote to memory of 4456 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 83 PID 4604 wrote to memory of 4456 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 83 PID 4604 wrote to memory of 4920 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4920 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4920 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 84 PID 4604 wrote to memory of 2296 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 85 PID 4604 wrote to memory of 2296 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 85 PID 4604 wrote to memory of 2296 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 85 PID 4604 wrote to memory of 3568 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 86 PID 4604 wrote to memory of 3568 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 86 PID 4604 wrote to memory of 3568 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 86 PID 4604 wrote to memory of 3376 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 87 PID 4604 wrote to memory of 3376 4604 a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe 87 PID 4456 wrote to memory of 3540 4456 ckspqtlkug.exe 89 PID 4456 wrote to memory of 3540 4456 ckspqtlkug.exe 89 PID 4456 wrote to memory of 3540 4456 ckspqtlkug.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2a071b6451c3f392b3cd99c7b22c636_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\ckspqtlkug.execkspqtlkug.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\regajffd.exeC:\Windows\system32\regajffd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3540
-
-
-
C:\Windows\SysWOW64\vbhnficppyvyhqs.exevbhnficppyvyhqs.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4920
-
-
C:\Windows\SysWOW64\regajffd.exeregajffd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2296
-
-
C:\Windows\SysWOW64\kvhbfeckxduts.exekvhbfeckxduts.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3568
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3376
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 47fd0b28f4810e18ff28f764e9665d9fb2dac82539f30230e740746964c5e1a3
- MD5 7fc898be0ef4ca9bc6147cbec6ac2b8f
- SHA1 fec6f8784f4c38d5a832cb0968d81cca2f043a73
- SHA512 257d1ca114a54ecdc874ef86152b8befb0a3fa56d3a75c578fd0d6ea05313cb654a6fd72b2f5ac34809036a0367786b9b51fab0beffeb7689b477f2a15cd2535
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 32fe791d7398422f829e276e361ea02a1a07e0481125b936fe838f7bec9ab83f
- MD5 369df5901ab3bf84e333c94de160d2df
- SHA1 9e592c90b348ba0951b608319910aacfff424464
- SHA512 dab796405351fd211cc552f7d03c43db9e8c22481d857b35789542bd97e2cc180d5d168f2ed48cb34539d036a7148edec7cad95772c6dfce323e100f659fe6bb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD9704.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IX0OIXUYTS1F7TE1JABM.temp
- Size 3KB
- SHA256 deb3272b02f300edde6413d56a44cb9e9bd3584496dafb60ce66f53e03b587c5
- MD5 735352b71162859939cfe502ac23a760
- SHA1 ef4a35dd214bd61db4bf2d18398e01b37f0aae20
- SHA512 d83b795f70201c8529679c87dff9323fe1243919614734c7151b2d7c144165c042f19dbca0b5dbe984ee08f3915c5306bda794e37e192e85ee0a192fb0efbd6d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 d74c9b368084028149673dae46bf80ecf6d4d083aee3d7aeef52d38fd5e33437
- MD5 3fa24831351d8a4a7c99d26e2abc0049
- SHA1 a8e0580acae9b8735404856d4aa97e35fca11328
- SHA512 663f78b701e0b1fbe8ac4741ccd5c3a47a27dca5d1cdbdc03ca1ed74329f308264278727a53d12d878a7bed7268360d02520dd2e424e34829d1a98c8fe931c57
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\ckspqtlkug.exe
- Size 512KB
- SHA256 ade36bb773b5dbf80be1622406147c9683805d3f43eb6f74994b45dd3eaa85ac
- MD5 4239e1d2b72912baf1259391f6248323
- SHA1 de7c2d523183097ce1e5fa9c4aa1b1b88a0f3d76
- SHA512 523c036833f90b88d73301529612402073db413987a5655ea153c8ad003bbb1495dc509b34d12f06d677b573eaeaea014e8bf9e96afbe3eb3d9cd9bdf971ceda
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kvhbfeckxduts.exe
- Size 512KB
- SHA256 091144e547ee5c276a920cebc01d63263f6042c22ee2aaf27124b28104f52b5b
- MD5 28e2a3dbfc3c8e388e016a553167f872
- SHA1 8261012a23e29f94f3b0b1c316e02b1e88a6f9a1
- SHA512 4a6d93123f55664ce56b6f75ca54926ab7d1fcd7817583c60645e197cdb7ae935e89100c00a952070874a895d6df5c98b3b3d3d170be107c95142725be73f5a1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\regajffd.exe
- Size 512KB
- SHA256 1c4296c5bb4e535d12860d1dd6826887be6c140c9fca9513b271e7d7662c8e01
- MD5 b44462624f5266cc6a2353e90f109c81
- SHA1 56a91a8744700e82d796fde1ca31a1e3e1e51194
- SHA512 e5d9ee10927909b794bc46b4508ae312255e262fd2ce23b8c256dc251b3ec898d59b984bd8040cfb9b09993dbfb4e70f6c5b79a46bf1abc983aa1125eedd6105
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vbhnficppyvyhqs.exe
- Size 512KB
- SHA256 20e815c5ec14675936e9e202834266acbc2d9d68450a1b188ac7c4ced18368a3
- MD5 1efa0fd34f9b19233f607d994d4cf0fc
- SHA1 45696779bc50945c650f8cee294707e906fc2ab2
- SHA512 8ac91bc26cf3463331e609c5662693a765564134c1f75aa4484fe315d9508c543bc528e96e92e96bf4084a1d0adb2240c76b4100ce7ed30dc2e87466dd7c9b93
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 cacba10531b5bf6a34ab39975ed194f948dc6e96ec6eccf292ccd36470d83326
- MD5 309d826910815fdf4292cb9a01fc8795
- SHA1 dbf27119278d94edcf53ed9bc3994313b5f21695
- SHA512 d83022413599a952c1efc582749c12c0dafe8c250faa2161a8dcf3f4fa20186f87c2d5d06c1eb74957eb171f9fffafb71f571ae0907f83c628595cab38955484
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 bc4ac7d2b88ce09a3d75006b8ee6accee8b49c09719ec611240550344ec79973
- MD5 30e9dc8917f04f4b76eee3e057fef6be
- SHA1 69a2c758d59f32a1cba95290d2517ae488872c09
- SHA512 1de596e455dcc3335141424da112e9803a9b16d61a566cf68bacb4df41d35b9186a93e8dda3412a1bc3661ca3243e0a11c64c3e2026ce647921edec03c0dfa8a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- MD5 SHA1 SHA512 SSDEEP