Analysis
- max time kernel
150s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 02:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe
- Size 512KB
- Sample240614-cffelavejm
- SHA256 fa8abb4f42fe7a8d7bbbc8cae3c67d0906a602dd4dfc2784444d2598f62f7157
- MD5 a7a8112af75efe119efef4d61e3f589f
- SHA1 e0d63447c95252646a0205cadc74dcb9ef0bf589
- SHA512 eb3d66fe1cf18ae279cd88e660e8eb93ec321e17175e07466400be907febcdaacf6d17bc8e481a1edf3b7e4b8bb80746ad575c79de7bd77ef24c77f14738729b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5K
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kgomxxcnys.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kgomxxcnys.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kgomxxcnys.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kgomxxcnys.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2608 kgomxxcnys.exe 1508 tbwfeqybwekeyib.exe 4544 rfcghqlw.exe 1332 yerdwqawduzbo.exe 684 rfcghqlw.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kgomxxcnys.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\evbjvtlt = "kgomxxcnys.exe" tbwfeqybwekeyib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\czrfcjot = "tbwfeqybwekeyib.exe" tbwfeqybwekeyib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "yerdwqawduzbo.exe" tbwfeqybwekeyib.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: rfcghqlw.exe File opened (read-only) \??\h: kgomxxcnys.exe File opened (read-only) \??\v: kgomxxcnys.exe File opened (read-only) \??\g: rfcghqlw.exe File opened (read-only) \??\h: rfcghqlw.exe File opened (read-only) \??\u: rfcghqlw.exe File opened (read-only) \??\t: rfcghqlw.exe File opened (read-only) \??\p: rfcghqlw.exe File opened (read-only) \??\i: rfcghqlw.exe File opened (read-only) \??\s: rfcghqlw.exe File opened (read-only) \??\j: kgomxxcnys.exe File opened (read-only) \??\n: kgomxxcnys.exe File opened (read-only) \??\p: kgomxxcnys.exe File opened (read-only) \??\q: kgomxxcnys.exe File opened (read-only) \??\b: rfcghqlw.exe File opened (read-only) \??\s: rfcghqlw.exe File opened (read-only) \??\b: rfcghqlw.exe File opened (read-only) \??\l: rfcghqlw.exe File opened (read-only) \??\o: rfcghqlw.exe File opened (read-only) \??\r: kgomxxcnys.exe File opened (read-only) \??\n: rfcghqlw.exe File opened (read-only) \??\o: kgomxxcnys.exe File opened (read-only) \??\a: rfcghqlw.exe File opened (read-only) \??\i: rfcghqlw.exe File opened (read-only) \??\x: kgomxxcnys.exe File opened (read-only) \??\m: rfcghqlw.exe File opened (read-only) \??\z: rfcghqlw.exe File opened (read-only) \??\o: rfcghqlw.exe File opened (read-only) \??\r: rfcghqlw.exe File opened (read-only) \??\h: rfcghqlw.exe File opened (read-only) \??\m: kgomxxcnys.exe File opened (read-only) \??\a: rfcghqlw.exe File opened (read-only) \??\w: rfcghqlw.exe File opened (read-only) \??\y: rfcghqlw.exe File opened (read-only) \??\j: rfcghqlw.exe File opened (read-only) \??\r: rfcghqlw.exe File opened (read-only) \??\t: kgomxxcnys.exe File opened (read-only) \??\q: rfcghqlw.exe File opened (read-only) \??\v: rfcghqlw.exe File opened (read-only) \??\z: kgomxxcnys.exe File opened (read-only) \??\t: rfcghqlw.exe File opened (read-only) \??\q: rfcghqlw.exe File opened (read-only) \??\w: rfcghqlw.exe File opened (read-only) \??\z: rfcghqlw.exe File opened (read-only) \??\b: kgomxxcnys.exe File opened (read-only) \??\e: kgomxxcnys.exe File opened (read-only) \??\s: kgomxxcnys.exe File opened (read-only) \??\x: rfcghqlw.exe File opened (read-only) \??\y: rfcghqlw.exe File opened (read-only) \??\w: kgomxxcnys.exe File opened (read-only) \??\l: rfcghqlw.exe File opened (read-only) \??\i: kgomxxcnys.exe File opened (read-only) \??\u: kgomxxcnys.exe File opened (read-only) \??\k: rfcghqlw.exe File opened (read-only) \??\p: rfcghqlw.exe File opened (read-only) \??\u: rfcghqlw.exe File opened (read-only) \??\x: rfcghqlw.exe File opened (read-only) \??\a: kgomxxcnys.exe File opened (read-only) \??\g: kgomxxcnys.exe File opened (read-only) \??\y: kgomxxcnys.exe File opened (read-only) \??\e: rfcghqlw.exe File opened (read-only) \??\k: rfcghqlw.exe File opened (read-only) \??\e: rfcghqlw.exe File opened (read-only) \??\m: rfcghqlw.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kgomxxcnys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kgomxxcnys.exe - AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2628-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0008000000023411-5.dat autoit_exe behavioral2/files/0x000800000002327a-18.dat autoit_exe behavioral2/files/0x0007000000023412-27.dat autoit_exe behavioral2/files/0x0007000000023413-32.dat autoit_exe behavioral2/files/0x0002000000022953-60.dat autoit_exe behavioral2/files/0x0002000000022994-66.dat autoit_exe behavioral2/files/0x0005000000023091-73.dat autoit_exe behavioral2/files/0x000400000002309c-79.dat autoit_exe behavioral2/files/0x0009000000023425-93.dat autoit_exe behavioral2/files/0x0009000000023425-100.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\kgomxxcnys.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File created C:\Windows\SysWOW64\tbwfeqybwekeyib.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rfcghqlw.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification C:\Windows\SysWOW64\tbwfeqybwekeyib.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File created C:\Windows\SysWOW64\yerdwqawduzbo.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification C:\Windows\SysWOW64\yerdwqawduzbo.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kgomxxcnys.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification C:\Windows\SysWOW64\kgomxxcnys.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File created C:\Windows\SysWOW64\rfcghqlw.exe a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfcghqlw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfcghqlw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rfcghqlw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfcghqlw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfcghqlw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfcghqlw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfcghqlw.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfcghqlw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfcghqlw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification C:\Windows\mydoc.rtf a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfcghqlw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfcghqlw.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfcghqlw.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfcghqlw.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfcghqlw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfcghqlw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfcghqlw.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183AC77B14E0DAC4B8BE7C97ED9137CD" a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kgomxxcnys.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kgomxxcnys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kgomxxcnys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kgomxxcnys.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kgomxxcnys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332C7F9C2683526D3477A770252CA97C8765DA" a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF8FF824F5D856E9046D65F7D94BC95E136584266366345D79B" a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F468B3FE6621A9D109D1D18A759011" a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kgomxxcnys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kgomxxcnys.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kgomxxcnys.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kgomxxcnys.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kgomxxcnys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8FACDFE6AF1E483753A4081EB3993B38802F14363033CE2BE42E908A8" a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB2B12C4794399E53BDB9D33299D4BE" a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kgomxxcnys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kgomxxcnys.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1932 WINWORD.EXE 1932 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 4544 rfcghqlw.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 2608 kgomxxcnys.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1508 tbwfeqybwekeyib.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 1332 yerdwqawduzbo.exe 684 rfcghqlw.exe 684 rfcghqlw.exe 684 rfcghqlw.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1932 WINWORD.EXE 1932 WINWORD.EXE 1932 WINWORD.EXE 1932 WINWORD.EXE 1932 WINWORD.EXE 1932 WINWORD.EXE 1932 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2608 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 81 PID 2628 wrote to memory of 2608 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 81 PID 2628 wrote to memory of 2608 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 81 PID 2628 wrote to memory of 1508 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 82 PID 2628 wrote to memory of 1508 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 82 PID 2628 wrote to memory of 1508 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 82 PID 2628 wrote to memory of 4544 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 83 PID 2628 wrote to memory of 4544 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 83 PID 2628 wrote to memory of 4544 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 83 PID 2628 wrote to memory of 1332 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 84 PID 2628 wrote to memory of 1332 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 84 PID 2628 wrote to memory of 1332 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 84 PID 2628 wrote to memory of 1932 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 86 PID 2628 wrote to memory of 1932 2628 a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe 86 PID 2608 wrote to memory of 684 2608 kgomxxcnys.exe 88 PID 2608 wrote to memory of 684 2608 kgomxxcnys.exe 88 PID 2608 wrote to memory of 684 2608 kgomxxcnys.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7a8112af75efe119efef4d61e3f589f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\kgomxxcnys.exekgomxxcnys.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\rfcghqlw.exeC:\Windows\system32\rfcghqlw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:684
-
-
-
C:\Windows\SysWOW64\tbwfeqybwekeyib.exetbwfeqybwekeyib.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1508
-
-
C:\Windows\SysWOW64\rfcghqlw.exerfcghqlw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4544
-
-
C:\Windows\SysWOW64\yerdwqawduzbo.exeyerdwqawduzbo.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1332
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 ea9a9dbd84fc2c0731a51bbb615b0208d800e8fc38e21f31c4f24520a812da27
- MD5 b32140381e75a0d6d55d7f9604b38688
- SHA1 7ad8c2217a173e95fea3e48473f82181065e6695
- SHA512 8215a01762c92139fe9662d2e955c658187b47e6f6bd1b33dcbbd6f5b89f4243edf521575fbab6b502c638bab5092e01485f66cde6ccf4e1f911fd77a39e38e6
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD83D7.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 6f4e581f129ff7c819aa16b0f0f063c8c2a99c1b13034dc13fe9fa4ce49155fc
- MD5 6c13acb6074cab77b6c6bfe8e4a0daae
- SHA1 62e519841d4b6d07e64d328870c08e47110c5596
- SHA512 bddc253d3c4b0067995d175aaad9034c43e0ce92b669292cc9db717da6824b2d77c356f236743828162f27dc3c9abc904b52175697beb2734f80b208882d50dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 827614267cc7e9a8c6fbae45dfbb54907742ce9a70d3f19f55f09574a0755488
- MD5 908d1c2fcd60d64536bd7570c49af2d0
- SHA1 62eb1a9c6094b1559d155597dce7f90ed42b6a50
- SHA512 b8d7c9d36d0cca4e345b05403b5b0e1f2d0ef6864aa276ef4a37686e80b55f9401e52bc054ffeb3b6a0ad08169272b34c9196d3bd342893e4f06a1a4d10d464d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Documents\ProtectEnter.doc.exe
- Size 512KB
- SHA256 50de07a15e74654d80b4290d4005fbbfd681b14e8ff2b76010de44db9ac02265
- MD5 a11d73fbc0629ff7aa728732fc015c1b
- SHA1 d9d7429b9f5d428bec64bde587510f3fa9409e00
- SHA512 f658fcf4f45fd7eed7f6d0db1360a70f882fc0a2b1a3bc53c6e9670a2c9ab54b82a4428aca1ab1707d52008ed6190033c75af105f67cc9cfc84f7e55ec3ff8a4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\ConvertFromConfirm.doc.exe
- Size 512KB
- SHA256 619be4a96f1db27ba04e26c85e2ed6d0b720ae9d86e8f46fe53770b8dec77309
- MD5 1ae6247715f692287651601afcf21b46
- SHA1 946131699c1f35804039e024c93400dbf373320b
- SHA512 5e895caed00e8469dc22cc0012d5c8b8bb7ff8b115a813a69296bfb812efbf9820bf5144af07a796795f60449599786d05483b02f5f64b8e4bf16715a70c9681
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kgomxxcnys.exe
- Size 512KB
- SHA256 f8e435dedd1d96466b6ae90ef13a61bf7554b2538dd4662984e646e7772f8356
- MD5 b2fadae32a055e16cff2f366d3992232
- SHA1 de7feb73f98835b8208be0318451b30beaadb409
- SHA512 19f151546f06921c04f9948a1b32c412d5f80ca84079247bd1b2a57bbba22a6744d9e587c92f2b3001845d6cdfbef3b929074a0c33ff8bb1369eb3817c9889e9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rfcghqlw.exe
- Size 512KB
- SHA256 47950485d22facabf91b6b7fad36e7070e6d250d99e73356d2a1de7e0e1fd896
- MD5 09a90c377c970cf754455c65f7e35e65
- SHA1 dea1d84052999ebddf1871075dc9000b5b4aa7ea
- SHA512 aa464181fee38a0d16bcb8547f2b0f467f56aa8721652581db732474e22b60b462a9fe2686a4f746c759a8cadeb29b8b669b44366d70a3c76b2786f14ba67a88
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tbwfeqybwekeyib.exe
- Size 512KB
- SHA256 5852a1c4e6cfbcde9fd51342eeb0bd67738e7cfed42de4c7c98df393659c1070
- MD5 b658eca2f85072a43095fb1e7025a7a2
- SHA1 11f544f856e6d5191c4154f952927364202bae50
- SHA512 0aa964923f8e4254dd38d0c481dc4ed3c9a0a24daf5786f2de1fc3cc5d8a0959733e57700ca2bf36e84320a708486c9e1830002409ca8f11d2d329a087cf521b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\yerdwqawduzbo.exe
- Size 512KB
- SHA256 af531030ba3d83155bb7e082869f736b6ada80a578c388e69b4e63db7e72ea6a
- MD5 a3118f2e33fbe5bd7675ab2fed39be1a
- SHA1 dafc79581d92e8d5303e628e6bcf37c81c21fcf1
- SHA512 cee99c1bddbb69f70e568df3397bba97e36b0d23b3db1ba87837c75ccf0e765a29cee57f80c04d45e33bfdb1cd377108f8ef1c4f44f43043487f3d8b80957cf2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 ca18585d5196b37106106ecd8fc129a0365d9bee26caeca77a8504cfe3564da0
- MD5 19fdfd99fdb5bb502d995afa6910b73f
- SHA1 a4630c5a80f6f14825e2c9e5f0bf51b1999ee509
- SHA512 698cde17530bc6b9c69ebdead9a549d1875835b3ad90c13ec8cff3175f747c7d6a5d8bf2c38a91a9c1d182e01c3f27a7be740afb24324d692cb3b3dff7a74dc7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 72a76e8d9a075b6d6a93711ad86bbe6eff823d3b04316d2a6f027e607baf65cd
- MD5 94d069b629ac0bbc46264204f2b530f8
- SHA1 5525633e3c982aecee14ef153ba93bf46ae2b340
- SHA512 abe1f8f566baf8508b18a95641511be7f64bc1c15033e641b634d533f6818a3bbe173c0293011d77f3c16c60006d8b4ea4a68d7662bdf92c10d3acb29dd489bc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 4b5366f3940817e13bc892509c7dc65a0d3bc67e1caf12e7c2e8e52c8e816a32
- MD5 d68d535c7ce6ffcf3d76accdb73788d8
- SHA1 f5ee6cea2edd54011cf2ca83fe71eee4ad385888
- SHA512 255eaafa1c68b65decb2a2e7aad8b457478ecc82f3aaee707e15c5f9e537d7d8d233310cc69bde9a2435effa0955ebd3c54677b91f98d0a54045295275b5a7ca
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP