Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 15:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe
- Size 512KB
- Sample240612-sp43batdnq
- SHA256 3fba82c9506b2b4e792d16d971366e05caa2d4aafd21322b89c4404d07c30532
- MD5 a120dcf7c405ae2e17543de36536d26e
- SHA1 f9f21ae0016146d75cc23f24541c41ef90e6af67
- SHA512 b833b933b3c8c535d9d384afd69d3d7e1394661c2c458d75d7d99204ae9389393e975c1641849e4d42be1b5e59832c52cbfbd11c380f47dbd693c806aa8c59be
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" opeyxvcsjx.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" opeyxvcsjx.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" opeyxvcsjx.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" opeyxvcsjx.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 4864 opeyxvcsjx.exe 4236 mgmoagpxsjjauxr.exe 3176 zpijheug.exe 2496 azusfprxbuxyw.exe 4404 zpijheug.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" opeyxvcsjx.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kmcpfnne = "opeyxvcsjx.exe" mgmoagpxsjjauxr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dudavtcu = "mgmoagpxsjjauxr.exe" mgmoagpxsjjauxr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "azusfprxbuxyw.exe" mgmoagpxsjjauxr.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: opeyxvcsjx.exe File opened (read-only) \??\t: opeyxvcsjx.exe File opened (read-only) \??\i: zpijheug.exe File opened (read-only) \??\y: zpijheug.exe File opened (read-only) \??\l: zpijheug.exe File opened (read-only) \??\a: opeyxvcsjx.exe File opened (read-only) \??\x: opeyxvcsjx.exe File opened (read-only) \??\n: zpijheug.exe File opened (read-only) \??\p: zpijheug.exe File opened (read-only) \??\b: zpijheug.exe File opened (read-only) \??\p: opeyxvcsjx.exe File opened (read-only) \??\v: opeyxvcsjx.exe File opened (read-only) \??\i: zpijheug.exe File opened (read-only) \??\w: opeyxvcsjx.exe File opened (read-only) \??\j: opeyxvcsjx.exe File opened (read-only) \??\q: opeyxvcsjx.exe File opened (read-only) \??\b: zpijheug.exe File opened (read-only) \??\l: zpijheug.exe File opened (read-only) \??\v: zpijheug.exe File opened (read-only) \??\b: opeyxvcsjx.exe File opened (read-only) \??\h: zpijheug.exe File opened (read-only) \??\x: zpijheug.exe File opened (read-only) \??\g: zpijheug.exe File opened (read-only) \??\m: zpijheug.exe File opened (read-only) \??\t: zpijheug.exe File opened (read-only) \??\e: opeyxvcsjx.exe File opened (read-only) \??\o: opeyxvcsjx.exe File opened (read-only) \??\k: zpijheug.exe File opened (read-only) \??\w: zpijheug.exe File opened (read-only) \??\z: zpijheug.exe File opened (read-only) \??\e: zpijheug.exe File opened (read-only) \??\u: zpijheug.exe File opened (read-only) \??\e: zpijheug.exe File opened (read-only) \??\h: zpijheug.exe File opened (read-only) \??\o: zpijheug.exe File opened (read-only) \??\v: zpijheug.exe File opened (read-only) \??\w: zpijheug.exe File opened (read-only) \??\x: zpijheug.exe File opened (read-only) \??\r: zpijheug.exe File opened (read-only) \??\n: zpijheug.exe File opened (read-only) \??\n: opeyxvcsjx.exe File opened (read-only) \??\q: zpijheug.exe File opened (read-only) \??\a: zpijheug.exe File opened (read-only) \??\m: opeyxvcsjx.exe File opened (read-only) \??\i: opeyxvcsjx.exe File opened (read-only) \??\r: opeyxvcsjx.exe File opened (read-only) \??\z: opeyxvcsjx.exe File opened (read-only) \??\s: zpijheug.exe File opened (read-only) \??\k: zpijheug.exe File opened (read-only) \??\y: zpijheug.exe File opened (read-only) \??\l: opeyxvcsjx.exe File opened (read-only) \??\a: zpijheug.exe File opened (read-only) \??\s: zpijheug.exe File opened (read-only) \??\h: opeyxvcsjx.exe File opened (read-only) \??\k: opeyxvcsjx.exe File opened (read-only) \??\y: opeyxvcsjx.exe File opened (read-only) \??\j: zpijheug.exe File opened (read-only) \??\o: zpijheug.exe File opened (read-only) \??\u: zpijheug.exe File opened (read-only) \??\g: zpijheug.exe File opened (read-only) \??\u: opeyxvcsjx.exe File opened (read-only) \??\t: zpijheug.exe File opened (read-only) \??\s: opeyxvcsjx.exe File opened (read-only) \??\p: zpijheug.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" opeyxvcsjx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" opeyxvcsjx.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/636-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000800000002343b-5.dat autoit_exe behavioral2/files/0x0008000000023435-18.dat autoit_exe behavioral2/files/0x000700000002343c-26.dat autoit_exe behavioral2/files/0x000700000002343d-32.dat autoit_exe behavioral2/files/0x0007000000023449-62.dat autoit_exe behavioral2/files/0x000700000002344a-65.dat autoit_exe behavioral2/files/0x000900000002344e-71.dat autoit_exe behavioral2/files/0x000700000001e3f9-86.dat autoit_exe behavioral2/files/0x000700000001e3f9-88.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\opeyxvcsjx.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File created C:\Windows\SysWOW64\mgmoagpxsjjauxr.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File created C:\Windows\SysWOW64\zpijheug.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\azusfprxbuxyw.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zpijheug.exe File created C:\Windows\SysWOW64\opeyxvcsjx.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mgmoagpxsjjauxr.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\zpijheug.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File created C:\Windows\SysWOW64\azusfprxbuxyw.exe a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll opeyxvcsjx.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zpijheug.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zpijheug.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zpijheug.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zpijheug.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zpijheug.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zpijheug.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zpijheug.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zpijheug.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zpijheug.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zpijheug.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zpijheug.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zpijheug.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zpijheug.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zpijheug.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zpijheug.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zpijheug.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification C:\Windows\mydoc.rtf a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zpijheug.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zpijheug.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zpijheug.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zpijheug.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zpijheug.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zpijheug.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zpijheug.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zpijheug.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33372D789C2C82566D3477D670252DDD7D8465A8" a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E89FC8D4F5C82129145D65C7E97BCE5E1305842664F6237D6EA" a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg opeyxvcsjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB8FACAF960F196830E3B46819B3E99B38C02FE43620338E2CB45E809A8" a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC1B02A47E739E853BDBAD733E9D7BE" a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1844C77415E6DAC5B9B97FE0EDE437CC" a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh opeyxvcsjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" opeyxvcsjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" opeyxvcsjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" opeyxvcsjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" opeyxvcsjx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc opeyxvcsjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" opeyxvcsjx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs opeyxvcsjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" opeyxvcsjx.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7836BB8FE6722D8D209D0A08A0C9116" a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat opeyxvcsjx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf opeyxvcsjx.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5008 WINWORD.EXE 5008 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4404 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4236 mgmoagpxsjjauxr.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 4864 opeyxvcsjx.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 2496 azusfprxbuxyw.exe 3176 zpijheug.exe 3176 zpijheug.exe 3176 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe 4404 zpijheug.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE 5008 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 636 wrote to memory of 4864 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 83 PID 636 wrote to memory of 4864 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 83 PID 636 wrote to memory of 4864 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 83 PID 636 wrote to memory of 4236 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 84 PID 636 wrote to memory of 4236 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 84 PID 636 wrote to memory of 4236 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 84 PID 636 wrote to memory of 3176 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 85 PID 636 wrote to memory of 3176 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 85 PID 636 wrote to memory of 3176 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 85 PID 636 wrote to memory of 2496 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 86 PID 636 wrote to memory of 2496 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 86 PID 636 wrote to memory of 2496 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 86 PID 636 wrote to memory of 5008 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 87 PID 636 wrote to memory of 5008 636 a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe 87 PID 4864 wrote to memory of 4404 4864 opeyxvcsjx.exe 89 PID 4864 wrote to memory of 4404 4864 opeyxvcsjx.exe 89 PID 4864 wrote to memory of 4404 4864 opeyxvcsjx.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a120dcf7c405ae2e17543de36536d26e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\opeyxvcsjx.exeopeyxvcsjx.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\zpijheug.exeC:\Windows\system32\zpijheug.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4404
-
-
-
C:\Windows\SysWOW64\mgmoagpxsjjauxr.exemgmoagpxsjjauxr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4236
-
-
C:\Windows\SysWOW64\zpijheug.exezpijheug.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3176
-
-
C:\Windows\SysWOW64\azusfprxbuxyw.exeazusfprxbuxyw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2496
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5008
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 603e1ee0fa420e8089ff59afecc8ef87695572b905fa9ed4328f3da46d51436b
- MD5 4ad4914d79a40c26dc5baf0c348e2d7a
- SHA1 0131c10a0a1ba59dcb6d710fd51fdc99414cf557
- SHA512 384e987fe012a4908139d3cbe36ef4f80bb43fb4f6c3cbd15d3cb67fd87cd1e4a2b2235626a914a2987961aa2a7ded762f01f2f51df21ac4c867132829fcf83f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 f037db983fde3139294a2a6866c97521bbfbd6acdc32cfa882b104843b4bba5a
- MD5 a582acc856f435ca49cb17e68ea1cfbc
- SHA1 796d103b36565c181ed5821b8a67f9c0e6bda65d
- SHA512 7de4dc1a1b1928d047787c7241c1b0abc92369d4f2d6ec5b07ab26236b3d348d504d051aac4dcc92b12d8b1b32f2c5234df1dbb764953a0046c576a80c23d792
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 8e2bf72872d410b5e25080611cbd2a68058ae3b8b10388f12fdf2bdb02825e92
- MD5 8eaefa2b4a17ccc2ea0cb45269e00619
- SHA1 39073bb31f3ef6b6b6e8bb761aeaa9d942247d3b
- SHA512 9dcd7d79768ed809c376b42588c442aaf86ad77ac8e96f345f3a1aeb04924688d34bd80d907673a4391c1711ee161f91597aad34b0c002166ff5fdc47a089404
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 4f50e93c5ba9859de0d6fbcea42503312e6916295417e7f51d7e51ac5c5ea06a
- MD5 646adb6495682f59ff6beb8628272129
- SHA1 f06c1bac1f96a3e2b6310a950feddf2d18fd1cb0
- SHA512 46a7a11833ff429b67f6fac5d3d542befa463a94bc87e53e971226951fda91de746c3c8f380c21263e3f77332d13d78544ee712ae241ee2381b5cbfc275c4aa9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\ConvertFromComplete.doc.exe
- Size 512KB
- SHA256 82ff0087269b0222aef57d9164f74b520f99e7a1f4d900c8bd57762303edfe74
- MD5 e601b304f6ca5c3f22fdb78231227aec
- SHA1 9da6e03ac495e8d16719be548219ddb37e1f560e
- SHA512 a8c67e219ab7b85001b6445353acd27163c0d1bb638af09b2c0f342b8ea0683d02cb17e519e325233d680cf603b61761da70e7915247305e0881f66b952ae6f9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\azusfprxbuxyw.exe
- Size 512KB
- SHA256 69140f77ec4cc54c1b0804a712bb210695f8ab3ccd71f6388b1b43e6210655cf
- MD5 901c8d0a5af3950b395ef65f47848b38
- SHA1 3e35bf1d268f70fa472b891bd42fa23d96acf3d0
- SHA512 7116cf1a9a19a637796024bdfb0fd92a9c5c619189a6e39d59f7e25ca7bac40312331cbf98a8560659129506261d4bc205fdd7be2ea10bca4ed2b5c6306e4f24
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mgmoagpxsjjauxr.exe
- Size 512KB
- SHA256 11e06f252efe5e4794ae43c78e16cb723d75bb5f2fcc1a8133a1e51a1a25714a
- MD5 5ebab8efd012dad6ec3b71aae49f811c
- SHA1 b6a37431e206b2b2fed81faf865f863bb95b597e
- SHA512 add9b5a5537e72feaa0fa25e525212da0967ff7d99970f490afca8f8210e99eb0e05349f23dbf01e70d3b687b73ad07bbb0858cfe4a0546210e1481499a3298e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\opeyxvcsjx.exe
- Size 512KB
- SHA256 77668898cbf37a61fc033a7a6ae09e154a73d497dcf1a4fc6ffde0b65ef37665
- MD5 9baad65607c35aaac49119946ddab831
- SHA1 766407b44f76b1fb6c792aa5b47c28e06f60b9b4
- SHA512 3135400881548484e35c57edeb39670b185e7cea0755dc10826a862d2589b6307b7c21279d145c16c12d82f2f0b5f30512bdea4e2b2ea43febb59a19d80ab849
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\zpijheug.exe
- Size 512KB
- SHA256 d123831aa3b447fea44335854bbffe18620f59601b635fbd0f32df9f971bc71d
- MD5 7bf5003d080bdedf321cb3f98d8f05b1
- SHA1 f8b24d00e48256c51532960c7eaca683d512290d
- SHA512 895036d61f17dcfd956eac15ceaf5b45755a50c8daba25ffcf78b6182ac30728610a8320a411479c78d15704418058bd20d619fbf36bce88c11601d989940c46
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 4f022afcef14085fa48a70f52d11deb5a1dd12d3497734d6fa1518f7c936db2d
- MD5 0afe54bef3aa1c8a7d252db448617a04
- SHA1 0175d51b654ef0a37ec3c5c19e16c845c7ab193d
- SHA512 46de5ab7517ed0c7c254e0b8b20640842a5a801c21d8f321219f6c5df365f3b8bfcd92dcb168122d666d6da6d957521612ce2c7b5e376c4327fcdb6fdfa92783
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 d5cae3033edb3cc4af04a6ecadaf717472c5bc114670caae9610a40fb0215be3
- MD5 3b16b2d66a0ee7d578bd14bb227dc378
- SHA1 3ed1fe9ab9f8a964e531ac9a7d3732133f0bb095
- SHA512 0e8631855b192e9f271952c9469965ecdd0b9788490216a63421c6c6977955cad0977017e8f76f0823b2f730ac575a7fec8c9dad197426df0e86497bf5cb74c5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- MD5 SHA1 SHA512 SSDEEP