Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 12:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe
- Size 512KB
- Sample240613-p11bqazalg
- SHA256 1abedde5d5674c4a8e6d6d3d81477368cc6f7b3e7e7aad902564b2c3adecc0d6
- MD5 a59d40b4b965b3f166485f57ba76d880
- SHA1 517e323c46210fa2a4064d2d25e959a2bc91ca8e
- SHA512 14da9526cfd55531d0a0d5dacc5333b2be76ad6766ca2ec661036cbbcbdc8546060438ad47096cd1be6e02bba747a5a555bd893fd546b8dc1ce15ce3e728e93f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cbvamlhjkl.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cbvamlhjkl.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cbvamlhjkl.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cbvamlhjkl.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 4436 cbvamlhjkl.exe 4840 pdatlzxmpzltsjd.exe 3524 hequqqro.exe 2532 msoqfaurxidev.exe 1220 hequqqro.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cbvamlhjkl.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "msoqfaurxidev.exe" pdatlzxmpzltsjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfrtsxba = "cbvamlhjkl.exe" pdatlzxmpzltsjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\buzkegoy = "pdatlzxmpzltsjd.exe" pdatlzxmpzltsjd.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: hequqqro.exe File opened (read-only) \??\a: hequqqro.exe File opened (read-only) \??\e: hequqqro.exe File opened (read-only) \??\r: hequqqro.exe File opened (read-only) \??\a: cbvamlhjkl.exe File opened (read-only) \??\e: hequqqro.exe File opened (read-only) \??\k: hequqqro.exe File opened (read-only) \??\s: hequqqro.exe File opened (read-only) \??\v: cbvamlhjkl.exe File opened (read-only) \??\t: hequqqro.exe File opened (read-only) \??\q: hequqqro.exe File opened (read-only) \??\g: cbvamlhjkl.exe File opened (read-only) \??\s: cbvamlhjkl.exe File opened (read-only) \??\m: hequqqro.exe File opened (read-only) \??\w: hequqqro.exe File opened (read-only) \??\o: cbvamlhjkl.exe File opened (read-only) \??\w: cbvamlhjkl.exe File opened (read-only) \??\i: hequqqro.exe File opened (read-only) \??\l: hequqqro.exe File opened (read-only) \??\x: hequqqro.exe File opened (read-only) \??\j: cbvamlhjkl.exe File opened (read-only) \??\q: cbvamlhjkl.exe File opened (read-only) \??\w: hequqqro.exe File opened (read-only) \??\k: cbvamlhjkl.exe File opened (read-only) \??\t: cbvamlhjkl.exe File opened (read-only) \??\i: hequqqro.exe File opened (read-only) \??\v: hequqqro.exe File opened (read-only) \??\i: cbvamlhjkl.exe File opened (read-only) \??\o: hequqqro.exe File opened (read-only) \??\s: hequqqro.exe File opened (read-only) \??\u: hequqqro.exe File opened (read-only) \??\y: cbvamlhjkl.exe File opened (read-only) \??\h: hequqqro.exe File opened (read-only) \??\r: cbvamlhjkl.exe File opened (read-only) \??\a: hequqqro.exe File opened (read-only) \??\g: hequqqro.exe File opened (read-only) \??\j: hequqqro.exe File opened (read-only) \??\l: hequqqro.exe File opened (read-only) \??\n: hequqqro.exe File opened (read-only) \??\g: hequqqro.exe File opened (read-only) \??\j: hequqqro.exe File opened (read-only) \??\p: hequqqro.exe File opened (read-only) \??\e: cbvamlhjkl.exe File opened (read-only) \??\b: hequqqro.exe File opened (read-only) \??\y: hequqqro.exe File opened (read-only) \??\m: cbvamlhjkl.exe File opened (read-only) \??\u: cbvamlhjkl.exe File opened (read-only) \??\p: hequqqro.exe File opened (read-only) \??\z: hequqqro.exe File opened (read-only) \??\o: hequqqro.exe File opened (read-only) \??\h: cbvamlhjkl.exe File opened (read-only) \??\h: hequqqro.exe File opened (read-only) \??\k: hequqqro.exe File opened (read-only) \??\t: hequqqro.exe File opened (read-only) \??\z: hequqqro.exe File opened (read-only) \??\v: hequqqro.exe File opened (read-only) \??\n: hequqqro.exe File opened (read-only) \??\x: hequqqro.exe File opened (read-only) \??\u: hequqqro.exe File opened (read-only) \??\m: hequqqro.exe File opened (read-only) \??\b: cbvamlhjkl.exe File opened (read-only) \??\n: cbvamlhjkl.exe File opened (read-only) \??\p: cbvamlhjkl.exe File opened (read-only) \??\b: hequqqro.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" cbvamlhjkl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" cbvamlhjkl.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4628-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000b000000023575-5.dat autoit_exe behavioral2/files/0x0006000000023077-18.dat autoit_exe behavioral2/files/0x000700000002357e-26.dat autoit_exe behavioral2/files/0x000700000002357f-31.dat autoit_exe behavioral2/files/0x0002000000022b05-65.dat autoit_exe behavioral2/files/0x0008000000023567-68.dat autoit_exe behavioral2/files/0x000a00000000073b-76.dat autoit_exe behavioral2/files/0x0008000000023594-104.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification C:\Windows\SysWOW64\pdatlzxmpzltsjd.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msoqfaurxidev.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll cbvamlhjkl.exe File created C:\Windows\SysWOW64\cbvamlhjkl.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File created C:\Windows\SysWOW64\msoqfaurxidev.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hequqqro.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hequqqro.exe File created C:\Windows\SysWOW64\hequqqro.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification C:\Windows\SysWOW64\cbvamlhjkl.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File created C:\Windows\SysWOW64\pdatlzxmpzltsjd.exe a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hequqqro.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hequqqro.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal hequqqro.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hequqqro.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hequqqro.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal hequqqro.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hequqqro.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification C:\Windows\mydoc.rtf a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe hequqqro.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe hequqqro.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe hequqqro.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F56BB3FF6622DCD173D1A68A7B916B" a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc cbvamlhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" cbvamlhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" cbvamlhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" cbvamlhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFCFF482F82699145D75F7E90BCEFE643593767436344D6E9" a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1839C7741491DAB0B8C17CE3ED9137B9" a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat cbvamlhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" cbvamlhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" cbvamlhjkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg cbvamlhjkl.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB5FAB0F917F2E2837C3A4B81EC39E3B38F03FE4364023DE2CD42EA08D5" a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" cbvamlhjkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf cbvamlhjkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs cbvamlhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402C7A9D5683276A3176DC702E2CAD7D8564AC" a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC3B12F44EF389852CFB9D333E8D7C9" a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh cbvamlhjkl.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3936 WINWORD.EXE 3936 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 1220 hequqqro.exe 1220 hequqqro.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4436 cbvamlhjkl.exe 4840 pdatlzxmpzltsjd.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 1220 hequqqro.exe 1220 hequqqro.exe 1220 hequqqro.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 4436 cbvamlhjkl.exe 4840 pdatlzxmpzltsjd.exe 4436 cbvamlhjkl.exe 4436 cbvamlhjkl.exe 4840 pdatlzxmpzltsjd.exe 4840 pdatlzxmpzltsjd.exe 3524 hequqqro.exe 3524 hequqqro.exe 3524 hequqqro.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 2532 msoqfaurxidev.exe 1220 hequqqro.exe 1220 hequqqro.exe 1220 hequqqro.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3936 WINWORD.EXE 3936 WINWORD.EXE 3936 WINWORD.EXE 3936 WINWORD.EXE 3936 WINWORD.EXE 3936 WINWORD.EXE 3936 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4436 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 83 PID 4628 wrote to memory of 4436 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 83 PID 4628 wrote to memory of 4436 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 83 PID 4628 wrote to memory of 4840 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 85 PID 4628 wrote to memory of 4840 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 85 PID 4628 wrote to memory of 4840 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 85 PID 4628 wrote to memory of 3524 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 86 PID 4628 wrote to memory of 3524 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 86 PID 4628 wrote to memory of 3524 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 86 PID 4628 wrote to memory of 2532 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 87 PID 4628 wrote to memory of 2532 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 87 PID 4628 wrote to memory of 2532 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 87 PID 4628 wrote to memory of 3936 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 88 PID 4628 wrote to memory of 3936 4628 a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe 88 PID 4436 wrote to memory of 1220 4436 cbvamlhjkl.exe 90 PID 4436 wrote to memory of 1220 4436 cbvamlhjkl.exe 90 PID 4436 wrote to memory of 1220 4436 cbvamlhjkl.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a59d40b4b965b3f166485f57ba76d880_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cbvamlhjkl.execbvamlhjkl.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\hequqqro.exeC:\Windows\system32\hequqqro.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1220
-
-
-
C:\Windows\SysWOW64\pdatlzxmpzltsjd.exepdatlzxmpzltsjd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4840
-
-
C:\Windows\SysWOW64\hequqqro.exehequqqro.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3524
-
-
C:\Windows\SysWOW64\msoqfaurxidev.exemsoqfaurxidev.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2532
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3936
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 bb00e4d7b2a2c3c6f4bb702dd881747593d953ff1f7323e9498eac10a44f6d2a
- MD5 8a837b2fbe9d6c61446eb6f51bd39bd8
- SHA1 45a62d7a5b08314cbf190770d3f8169191841acb
- SHA512 db9ec6afbd8e00c003f0e005fd24088b6bb8cae38f61cf27bc4ac76d7ed170ad6a95ac11a403a9c79ac7989c20f16107dfc8e552b401b9ea59ac062b3ff753a3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6H:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 e0bc7e995eee66d4c9cbd4c5ce568db84a08c5b40de0d818c876b241d04870ee
- MD5 3b7ce5c5d92d66d483e83a3af3e53236
- SHA1 58f9d74745bb356ba28a2205ba791203757a49a6
- SHA512 0a866bd92c7b6521f8d5087c4754d33dc377e417c728af7afe3ed823663b760ced28b8f4d6cea6976bcb3449cd7a7107012f4a4ec8b5c5492aff0b8bc31fea20
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD8E7A.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 ae9f56ebd867d2f1809982ed7b2d230fbc7343a60aca63c5c7d9d46feeee4af6
- MD5 272459ded7c55e9fe9bfad2d640bd238
- SHA1 5b23904bdc530ed61de6293b69125388f0e4cd84
- SHA512 64c1d2ca71b83d8f1c38cb5df8d07a79a67a586c07dd90b6ef19b90da1c707c3d043e558d66ba60462967003b1a26257cc97f3bf4e82792c2c3e619063d9d7ee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RFe576b3d.TMP
- Size 3KB
- SHA256 61447bd639e0e870c95237b1472a9525a744289ff2c6f75833986ef120955b6e
- MD5 34a74c8d310cd0a1b40a35e9fd4da9fd
- SHA1 f1d752b63b6fd23dde75920b2dec2e2d6c239385
- SHA512 9ccc0c9c4bc2d5efb74e750133ab91a5ac6a0b56c3b83b013fc4f6b759781bced79a73fc3519254134625c6c057ae87c1f424b4f7d79875e57dfe8f53893e6d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\GrantEdit.doc.exe
- Size 512KB
- SHA256 5a334710bb8ed1448e1ec7178776a6599f007f3458cacce85616b1edb1c55208
- MD5 a41908ee50c80720737d55b7e54754c2
- SHA1 443b0f2ba055d137549523ff047bbef140d63e01
- SHA512 481ac50580da3b5a3e340978b985262da8b50098d9bbd43b07f1f8391820a1307df8c63f5891ab2c819fc0cffe268a21149e702bf3e0b071ba9faa44c3298213
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\cbvamlhjkl.exe
- Size 512KB
- SHA256 88e127002d8fcd23eb9008fb264240117e37c35491ef1e6fb1554fee05a73d30
- MD5 102b17dc875f587ca99ae5e1945d0ef2
- SHA1 4b157f943c797c2918611b459f6cdbb5b2d33ce3
- SHA512 0097b4b009af7e1c459c03e12d6b6ef688aa4f6e6e82f0474eee17e8ce26288c97ca13c3d2590ed7e4e6fe7a7da1072d40a53d3e8ef9f0ae8cebf74952032c03
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hequqqro.exe
- Size 512KB
- SHA256 8edd0360cd2c8c5f6c5e7182e3664efe5fed595e4c378f37da4bf4efaf5c33bf
- MD5 fa55209e304be6c4e7a81e4f5f13b6be
- SHA1 3c55480c4fe95639d7f5f7e3b9fb177d02535f95
- SHA512 47e17d85b9c3f88f854b700811029fde92ba4324b9e64bd9239345021e45b46e5590fa15f5b1b0f167a5cb5d0fdd4c0561993c5aa581c838ce424892580aa79e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\msoqfaurxidev.exe
- Size 512KB
- SHA256 d40e82604e2131500b9a9cc1fc144e90b61d9fe7909b9ad455da7f9abed40230
- MD5 041ebef5a622621caa48a9698168d146
- SHA1 9c8efeca400ea38929f52f170601c3dbaa72b9b7
- SHA512 55360bcc81c2d74bd3692ff0270300e2eda9329771110cfea26a53baab43c150e638a128292ff1f7916b2324163026a13f96054458df3799c786e6f34cf9b6c7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pdatlzxmpzltsjd.exe
- Size 512KB
- SHA256 5a0cc507ef2b033482ba9900df29c13b625cf6415bb3e9752f13a3ee4739e5d8
- MD5 eae9117d672f35f32a9ca46e64611417
- SHA1 8d4ee1fac0a098e2474b0c9e59adedfed4867f26
- SHA512 c70e2ca8a7a1b11efe8286dda365190dceab9e721f531fc98f2d9627d1fc79c1b059e3139c86ecf4943ee007dc3201ed9a1d0d4bbe142d260bb7f18090f70f10
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 614db59f950c9096f790e1b271ffabc40e9b87d269d7784e69a29f1fa14dc0f5
- MD5 fac40ddafcf390cb7a058db45e06820d
- SHA1 3ed49e1b30ddc50bdbe4071b8c79701b007045ab
- SHA512 6cd9512cc339d954f9fa7ee24b366fd20d3b38d35c7952c8da13f55a0755617d07bc474b0af9db902d86ffb8d593be5beb4ff73d149462454cd73b2946280b62
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V
- MD5 SHA1 SHA512 SSDEEP