Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 14:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe
-
Size
512KB
-
MD5
a10ef426cd0e1cb4bb8ce688a0017a25
-
SHA1
11d5aef2860b4f2cfbd13591800b6a1ff90f2ca1
-
SHA256
ec9e45fbf429dc5c5a12d05f7fba2e9f88031119eb037c66eb6dfa8678abb087
-
SHA512
4e2f7ad4e9c3416150a2e7741db526db619e65dc2cde75d47c23ca632bdae001945363f048253ab8c006ec93f0977830c2ecd1b89b8a8099448f35943cbae4e2
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" duqwxnnnjt.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duqwxnnnjt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" duqwxnnnjt.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" duqwxnnnjt.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 3508 duqwxnnnjt.exe 3708 cwprfrqntdochvl.exe 2296 qjddutpp.exe 4548 dbhltsoabqgea.exe 1796 qjddutpp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" duqwxnnnjt.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oqpnmqda = "duqwxnnnjt.exe" cwprfrqntdochvl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xanujude = "cwprfrqntdochvl.exe" cwprfrqntdochvl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "dbhltsoabqgea.exe" cwprfrqntdochvl.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: qjddutpp.exe File opened (read-only) \??\t: qjddutpp.exe File opened (read-only) \??\z: qjddutpp.exe File opened (read-only) \??\q: qjddutpp.exe File opened (read-only) \??\y: qjddutpp.exe File opened (read-only) \??\v: duqwxnnnjt.exe File opened (read-only) \??\z: duqwxnnnjt.exe File opened (read-only) \??\i: qjddutpp.exe File opened (read-only) \??\m: qjddutpp.exe File opened (read-only) \??\q: qjddutpp.exe File opened (read-only) \??\u: qjddutpp.exe File opened (read-only) \??\v: qjddutpp.exe File opened (read-only) \??\l: qjddutpp.exe File opened (read-only) \??\j: duqwxnnnjt.exe File opened (read-only) \??\n: duqwxnnnjt.exe File opened (read-only) \??\g: qjddutpp.exe File opened (read-only) \??\i: qjddutpp.exe File opened (read-only) \??\v: qjddutpp.exe File opened (read-only) \??\t: duqwxnnnjt.exe File opened (read-only) \??\b: qjddutpp.exe File opened (read-only) \??\j: qjddutpp.exe File opened (read-only) \??\n: qjddutpp.exe File opened (read-only) \??\e: qjddutpp.exe File opened (read-only) \??\k: duqwxnnnjt.exe File opened (read-only) \??\x: qjddutpp.exe File opened (read-only) \??\m: qjddutpp.exe File opened (read-only) \??\b: duqwxnnnjt.exe File opened (read-only) \??\u: duqwxnnnjt.exe File opened (read-only) \??\e: qjddutpp.exe File opened (read-only) \??\l: qjddutpp.exe File opened (read-only) \??\o: qjddutpp.exe File opened (read-only) \??\g: qjddutpp.exe File opened (read-only) \??\o: qjddutpp.exe File opened (read-only) \??\q: duqwxnnnjt.exe File opened (read-only) \??\z: qjddutpp.exe File opened (read-only) \??\k: qjddutpp.exe File opened (read-only) \??\h: qjddutpp.exe File opened (read-only) \??\r: qjddutpp.exe File opened (read-only) \??\s: qjddutpp.exe File opened (read-only) \??\w: qjddutpp.exe File opened (read-only) \??\p: qjddutpp.exe File opened (read-only) \??\g: duqwxnnnjt.exe File opened (read-only) \??\h: duqwxnnnjt.exe File opened (read-only) \??\r: duqwxnnnjt.exe File opened (read-only) \??\p: qjddutpp.exe File opened (read-only) \??\w: qjddutpp.exe File opened (read-only) \??\y: qjddutpp.exe File opened (read-only) \??\a: duqwxnnnjt.exe File opened (read-only) \??\m: duqwxnnnjt.exe File opened (read-only) \??\o: duqwxnnnjt.exe File opened (read-only) \??\p: duqwxnnnjt.exe File opened (read-only) \??\u: qjddutpp.exe File opened (read-only) \??\l: duqwxnnnjt.exe File opened (read-only) \??\w: duqwxnnnjt.exe File opened (read-only) \??\y: duqwxnnnjt.exe File opened (read-only) \??\a: qjddutpp.exe File opened (read-only) \??\b: qjddutpp.exe File opened (read-only) \??\t: qjddutpp.exe File opened (read-only) \??\j: qjddutpp.exe File opened (read-only) \??\e: duqwxnnnjt.exe File opened (read-only) \??\i: duqwxnnnjt.exe File opened (read-only) \??\s: duqwxnnnjt.exe File opened (read-only) \??\a: qjddutpp.exe File opened (read-only) \??\h: qjddutpp.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" duqwxnnnjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" duqwxnnnjt.exe -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2980-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023418-5.dat autoit_exe behavioral2/files/0x00090000000233fd-18.dat autoit_exe behavioral2/files/0x0007000000023419-27.dat autoit_exe behavioral2/files/0x000700000002341a-31.dat autoit_exe behavioral2/files/0x0006000000016952-60.dat autoit_exe behavioral2/files/0x000a000000016fb1-63.dat autoit_exe behavioral2/files/0x001100000001da8e-69.dat autoit_exe behavioral2/files/0x001500000001e09e-86.dat autoit_exe behavioral2/files/0x001500000001e09e-94.dat autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\dbhltsoabqgea.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification C:\Windows\SysWOW64\cwprfrqntdochvl.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification C:\Windows\SysWOW64\duqwxnnnjt.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\qjddutpp.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification C:\Windows\SysWOW64\dbhltsoabqgea.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll duqwxnnnjt.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe qjddutpp.exe File created C:\Windows\SysWOW64\duqwxnnnjt.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File created C:\Windows\SysWOW64\cwprfrqntdochvl.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File created C:\Windows\SysWOW64\qjddutpp.exe a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qjddutpp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qjddutpp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qjddutpp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qjddutpp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qjddutpp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qjddutpp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qjddutpp.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qjddutpp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification C:\Windows\mydoc.rtf a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qjddutpp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe qjddutpp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qjddutpp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe qjddutpp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qjddutpp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qjddutpp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe qjddutpp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" duqwxnnnjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" duqwxnnnjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78768B4FF1F21ADD27DD1D68A7D916B" a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" duqwxnnnjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc duqwxnnnjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf duqwxnnnjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs duqwxnnnjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg duqwxnnnjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACDF9CAFE14F2E0830F3A43819A39E6B38B02F04367033AE1BD45E608A6" a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat duqwxnnnjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" duqwxnnnjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB1204795399F52CBB9D633EED4BF" a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1948C60915ECDBBEB8CE7FE1EDE534CC" a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh duqwxnnnjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" duqwxnnnjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" duqwxnnnjt.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472D7D9D5782586D3476A570512CA97D8465DD" a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF5FFFC4828851D903CD65D7DE1BD97E130584667406344D7EC" a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4820 WINWORD.EXE 4820 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3508 duqwxnnnjt.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 3708 cwprfrqntdochvl.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 2296 qjddutpp.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 4548 dbhltsoabqgea.exe 1796 qjddutpp.exe 1796 qjddutpp.exe 1796 qjddutpp.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4820 WINWORD.EXE 4820 WINWORD.EXE 4820 WINWORD.EXE 4820 WINWORD.EXE 4820 WINWORD.EXE 4820 WINWORD.EXE 4820 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3508 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 82 PID 2980 wrote to memory of 3508 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 82 PID 2980 wrote to memory of 3508 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 82 PID 2980 wrote to memory of 3708 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 83 PID 2980 wrote to memory of 3708 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 83 PID 2980 wrote to memory of 3708 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 83 PID 2980 wrote to memory of 2296 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 85 PID 2980 wrote to memory of 2296 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 85 PID 2980 wrote to memory of 2296 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 85 PID 2980 wrote to memory of 4548 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 86 PID 2980 wrote to memory of 4548 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 86 PID 2980 wrote to memory of 4548 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 86 PID 3508 wrote to memory of 1796 3508 duqwxnnnjt.exe 88 PID 3508 wrote to memory of 1796 3508 duqwxnnnjt.exe 88 PID 3508 wrote to memory of 1796 3508 duqwxnnnjt.exe 88 PID 2980 wrote to memory of 4820 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 87 PID 2980 wrote to memory of 4820 2980 a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a10ef426cd0e1cb4bb8ce688a0017a25_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\duqwxnnnjt.exeduqwxnnnjt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\qjddutpp.exeC:\Windows\system32\qjddutpp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1796
-
-
-
C:\Windows\SysWOW64\cwprfrqntdochvl.execwprfrqntdochvl.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3708
-
-
C:\Windows\SysWOW64\qjddutpp.exeqjddutpp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2296
-
-
C:\Windows\SysWOW64\dbhltsoabqgea.exedbhltsoabqgea.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4548
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4820
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD57e0d292f5342e8d4601cbea7b7e56631
SHA11c0f211bd9323fc693571ea356be192491ae8d12
SHA25685d1b0608f443fe4c9f84731a708fd481ef3eb929215c0276cfb04274d6bb796
SHA51266cce0cf288d1ad47d8b64a8a8548e9e9dfd3ccd06df5c7714b19c6ab50c36fd6a0eb4026928bdc692bab6b0a63fff6bb64369cb4bb09489dea94813a7926a4b
-
Filesize
512KB
MD5a1282df00509ba49a88fe89015f77a36
SHA19b3fe1126c3b58d883cc160fde55eb75edc496a8
SHA256bd012938377724877f5c0a31b67c2760e46b46ef3f8e319342cc1f26f00f2a49
SHA512fd606e68691598039cf1d73be47988a9383cc4a07a34c0eff2f5742d87ad081214b05972732642bd7e3af4c4c3c9d30d2fb3def7a66a6a63904565779b9bcd31
-
Filesize
239B
MD529c06012a024bb04d9da99412a6dec90
SHA1b4bda8f492bed71799b96b43470cb65e724d9f6b
SHA256fc8dc7b910e0f95654329a7cfd24b231b530136b7888b55a12e4a9cfc204f067
SHA51275fab3d4e514be28b392609bca2744702ea4090bf14e96643d8536e22b49dff7c43c4d1bf420499064ac56d67e60a29cfe7de68bb28116af62bb7c7cab1ec88f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD54872f655666dca3ce798abafeeb7beb9
SHA10f8f30a28096ed0878f9d9f3bc735d3c90dbe419
SHA25676f643234e9046fa8d087104111f638570a0132247872d354088d677e939f007
SHA5123630f8e35ea91c103142b2e6ce0477edc1a40452e1fea875cb8d9542ab2268b0bc5d9c4ef6c537d9d611f8c8fd143ce311d718ec44e2e9913b824c6d038b2479
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5c3a1f2dabf2b6c6aad005205fa330a72
SHA145032b346429477898f52473e6c0dc3ea0250a4d
SHA2564eca6e29f34b0f86c055a76da602c6697f595d5a4ad9e64c4977c2f9d701afdc
SHA512eeb108d83f48d24b2ecd51d1cf56c04151ec0abe15d28d8564d87b04c62c82b0934c6161993761d7f31800f60dbf92f72035ceeb92fa028158a15b83d845c14d
-
Filesize
512KB
MD5506481b262681a7f1f650c8093b5e967
SHA105cbd9cb86f5b68a37d44937d4d37e105d7f4589
SHA256df3addc8b19c1f478b5fd0b142d61733a68e98ee9e86a50bce714fc21757b51c
SHA512b242e00db3a2060b89562fbb75a4c2958bd20b8fa75498478e13fd2014929b33c456da2ca7e7369e3f0b630bd5c0c2c71c549d5ed2e565dc3fee175402509328
-
Filesize
512KB
MD5018bfff0f2452432829e5cf721277236
SHA1ffc819cf43dd926eab285ac7bfd20a98f7b76545
SHA256f1b224576e077549eeb4c75b72f4e32cbb10c1bda527581d22366f2829764ca9
SHA51261e4b493f62a729f4f0fbfbdce0db7f8dcb3b236b022630d198e14928786756182d353821b0052b501361479b6903b3c17f9b5569f4be317f909c4ca050a3e2f
-
Filesize
512KB
MD55e0795b837514e610d96558ca7b37d8d
SHA13c83d7e4c3845274e0dd9a03ebc9e1b0dcaa3483
SHA256c3345893eca701e858dc38a2f68870fcff966e9e4f590c39e8fa2a66a6577666
SHA5129c125f3750264dc26b870bf9210db438ae6d4c291c7e36667aecd33fb4476c95f613de7c6cd59de28759092676a2d6e4929727b7e211e176b0831338e93c6848
-
Filesize
512KB
MD52b16b7aa315de4f721eccb8fba95698e
SHA1fdee15b78545873766a3a54e359345c5d5d6b1a1
SHA256b0a406c3bf74404bc42c68d6fb1b70affb950686caf68a68aae2078587c53232
SHA512c2e3b35f5fbd5082174f68e292f8327c98e3565e0d1bf5fbe8d0dd98eb2eebd3f9cd255e066cea23ce4ea61fbe42f25f5cf2ed370db50e58e1d4ecc481bd1cd9
-
Filesize
512KB
MD56c6442c6740365de6b954439ef37ee71
SHA147bd3746902f2ff2be0d2d9717b97c19452a7a93
SHA2563fef3261cd8d3289513de6bd159eb47ac9d583c1657a6662ce58cd9e9ceb7d47
SHA512dc334f4639aafccb64ca72a1b3e065676e1a4247202b1715dd1e03421cd4e3a0e3987d314053009b99512f083c4f22ad58087499db2d666fcf7bae3e2319c0c8
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5f7f3785a1965213afaec20cf07e365b2
SHA1421c4cf6eb22612de7d38afebb189d69ce9b9951
SHA256003bc4d7c096028861c807b266d99abcb7951c6a429c9596160b8f09ae019617
SHA5127ade584cbb9c6f65fa81ed9b7c561fb23ab786b1e5a7c7c4adb563e5fda9cb671a94a5bb5691d07f928e6fdfe8ebe00a06567a2276ff41f138f673eec7424d78
-
Filesize
512KB
MD5a0469a736b5bdc576ea7c533fd2d7e58
SHA17bdc23de7e06f89cd10133920285b27c4a3fe3c6
SHA256143763099698d60e97ab5782662662ed6d494494f9606dbf8eb66c03e9800392
SHA512f3237c34653e137540484c8471ffb25e8411e9e4339e0bbd4341e2c1afcd61295437b6faab690061817aba52478d6e060942ac9ca6e61d0ea3fb58602db79d95