Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 03:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe
- Size 512KB
- Sample240614-d9aa4stfng
- SHA256 07a6b7fb56ae07c75033d061a5ea7441d382366c4d4fb29a04c15558cfd7eb44
- MD5 a7e374db5fcc2f63f6032951cf6f6aa9
- SHA1 178a932e93e3d07db05dc0f2fc20e142bd3532e1
- SHA512 7db2f8d19cd93d68c8b98df841fbe454823943afcbab1ddecbc3672d5d6a74e8e437d6bcd39fb447f2fadc34d2c8d518f791519bc373a5815ee4f13fc4d56751
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" aoojjjrhmb.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aoojjjrhmb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aoojjjrhmb.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" aoojjjrhmb.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 1260 aoojjjrhmb.exe 4336 vgmmklwdxhelkco.exe 4400 quxmkamf.exe 1132 npkukenkyuqgj.exe 3732 quxmkamf.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aoojjjrhmb.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hwhewcxd = "aoojjjrhmb.exe" vgmmklwdxhelkco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dpexjora = "vgmmklwdxhelkco.exe" vgmmklwdxhelkco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "npkukenkyuqgj.exe" vgmmklwdxhelkco.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: quxmkamf.exe File opened (read-only) \??\a: aoojjjrhmb.exe File opened (read-only) \??\e: aoojjjrhmb.exe File opened (read-only) \??\o: aoojjjrhmb.exe File opened (read-only) \??\q: aoojjjrhmb.exe File opened (read-only) \??\b: quxmkamf.exe File opened (read-only) \??\i: quxmkamf.exe File opened (read-only) \??\q: quxmkamf.exe File opened (read-only) \??\u: aoojjjrhmb.exe File opened (read-only) \??\i: quxmkamf.exe File opened (read-only) \??\s: quxmkamf.exe File opened (read-only) \??\x: quxmkamf.exe File opened (read-only) \??\n: quxmkamf.exe File opened (read-only) \??\u: quxmkamf.exe File opened (read-only) \??\l: aoojjjrhmb.exe File opened (read-only) \??\z: quxmkamf.exe File opened (read-only) \??\p: aoojjjrhmb.exe File opened (read-only) \??\a: quxmkamf.exe File opened (read-only) \??\n: quxmkamf.exe File opened (read-only) \??\e: quxmkamf.exe File opened (read-only) \??\t: quxmkamf.exe File opened (read-only) \??\w: quxmkamf.exe File opened (read-only) \??\v: aoojjjrhmb.exe File opened (read-only) \??\z: aoojjjrhmb.exe File opened (read-only) \??\y: quxmkamf.exe File opened (read-only) \??\g: quxmkamf.exe File opened (read-only) \??\n: aoojjjrhmb.exe File opened (read-only) \??\t: aoojjjrhmb.exe File opened (read-only) \??\m: quxmkamf.exe File opened (read-only) \??\r: quxmkamf.exe File opened (read-only) \??\v: quxmkamf.exe File opened (read-only) \??\z: quxmkamf.exe File opened (read-only) \??\b: aoojjjrhmb.exe File opened (read-only) \??\s: aoojjjrhmb.exe File opened (read-only) \??\e: quxmkamf.exe File opened (read-only) \??\h: aoojjjrhmb.exe File opened (read-only) \??\u: quxmkamf.exe File opened (read-only) \??\m: quxmkamf.exe File opened (read-only) \??\l: quxmkamf.exe File opened (read-only) \??\r: aoojjjrhmb.exe File opened (read-only) \??\r: quxmkamf.exe File opened (read-only) \??\k: quxmkamf.exe File opened (read-only) \??\l: quxmkamf.exe File opened (read-only) \??\v: quxmkamf.exe File opened (read-only) \??\y: quxmkamf.exe File opened (read-only) \??\o: quxmkamf.exe File opened (read-only) \??\y: aoojjjrhmb.exe File opened (read-only) \??\o: quxmkamf.exe File opened (read-only) \??\h: quxmkamf.exe File opened (read-only) \??\a: quxmkamf.exe File opened (read-only) \??\x: aoojjjrhmb.exe File opened (read-only) \??\g: quxmkamf.exe File opened (read-only) \??\b: quxmkamf.exe File opened (read-only) \??\i: aoojjjrhmb.exe File opened (read-only) \??\j: aoojjjrhmb.exe File opened (read-only) \??\k: aoojjjrhmb.exe File opened (read-only) \??\p: quxmkamf.exe File opened (read-only) \??\w: aoojjjrhmb.exe File opened (read-only) \??\q: quxmkamf.exe File opened (read-only) \??\x: quxmkamf.exe File opened (read-only) \??\g: aoojjjrhmb.exe File opened (read-only) \??\m: aoojjjrhmb.exe File opened (read-only) \??\j: quxmkamf.exe File opened (read-only) \??\p: quxmkamf.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" aoojjjrhmb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" aoojjjrhmb.exe - AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2472-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0008000000023412-5.dat autoit_exe behavioral2/files/0x000b0000000233fa-18.dat autoit_exe behavioral2/files/0x0008000000023413-27.dat autoit_exe behavioral2/files/0x0007000000023414-32.dat autoit_exe behavioral2/files/0x000a000000016fda-64.dat autoit_exe behavioral2/files/0x000400000001e57e-89.dat autoit_exe behavioral2/files/0x000400000001e57e-94.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe quxmkamf.exe File created C:\Windows\SysWOW64\vgmmklwdxhelkco.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\quxmkamf.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll aoojjjrhmb.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe quxmkamf.exe File created C:\Windows\SysWOW64\aoojjjrhmb.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\aoojjjrhmb.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vgmmklwdxhelkco.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File created C:\Windows\SysWOW64\npkukenkyuqgj.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe quxmkamf.exe File created C:\Windows\SysWOW64\quxmkamf.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\npkukenkyuqgj.exe a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe quxmkamf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal quxmkamf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal quxmkamf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe quxmkamf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe quxmkamf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe quxmkamf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe quxmkamf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe quxmkamf.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe quxmkamf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe quxmkamf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe quxmkamf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe quxmkamf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification C:\Windows\mydoc.rtf a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe quxmkamf.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe quxmkamf.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe quxmkamf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe quxmkamf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB02F44E639EF53C5BAD33298D7B9" a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78668B2FE6C21DDD10ED0D48B0E9111" a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" aoojjjrhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" aoojjjrhmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf aoojjjrhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" aoojjjrhmb.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33422C779C2683556A3676A177242CD67D8364DB" a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh aoojjjrhmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs aoojjjrhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAFACAF960F194837B3B36819C3995B3FE02FC4314034CE1C5429C08A5" a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" aoojjjrhmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc aoojjjrhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" aoojjjrhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" aoojjjrhmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg aoojjjrhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFCFE482B826D9133D75B7DE2BDE6E640584266466342D79E" a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1844C70E15E7DBB3B8CE7C90ECE734C8" a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat aoojjjrhmb.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4276 WINWORD.EXE 4276 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 1260 aoojjjrhmb.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4400 quxmkamf.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 4336 vgmmklwdxhelkco.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 1132 npkukenkyuqgj.exe 3732 quxmkamf.exe 3732 quxmkamf.exe 3732 quxmkamf.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2472 wrote to memory of 1260 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 82 PID 2472 wrote to memory of 1260 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 82 PID 2472 wrote to memory of 1260 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 82 PID 2472 wrote to memory of 4336 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 83 PID 2472 wrote to memory of 4336 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 83 PID 2472 wrote to memory of 4336 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 83 PID 2472 wrote to memory of 4400 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 84 PID 2472 wrote to memory of 4400 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 84 PID 2472 wrote to memory of 4400 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 84 PID 2472 wrote to memory of 1132 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 85 PID 2472 wrote to memory of 1132 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 85 PID 2472 wrote to memory of 1132 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 85 PID 2472 wrote to memory of 4276 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 86 PID 2472 wrote to memory of 4276 2472 a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe 86 PID 1260 wrote to memory of 3732 1260 aoojjjrhmb.exe 89 PID 1260 wrote to memory of 3732 1260 aoojjjrhmb.exe 89 PID 1260 wrote to memory of 3732 1260 aoojjjrhmb.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7e374db5fcc2f63f6032951cf6f6aa9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\aoojjjrhmb.exeaoojjjrhmb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\quxmkamf.exeC:\Windows\system32\quxmkamf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3732
-
-
-
C:\Windows\SysWOW64\vgmmklwdxhelkco.exevgmmklwdxhelkco.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4336
-
-
C:\Windows\SysWOW64\quxmkamf.exequxmkamf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4400
-
-
C:\Windows\SysWOW64\npkukenkyuqgj.exenpkukenkyuqgj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1132
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4276
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 982d7635913fb73daf22cd278b9f6915a3a1477c6871abb8b9327bb6110b4bfb
- MD5 8f6255012bd8eef28b26ff49cb2b6cf2
- SHA1 53aaeebd8b2f4edd9a5a6bf46876efb37a1542fb
- SHA512 bc65661f6916f9c85cc700b23259e68429d147ead82472888361e04f11a9e8989339f3d63cf4f7b879f43cd25b519c627593d729b964e3567959f0f0dd5dec85
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 57c9ec7a110cd70c9277230d962815fd16f126250d170e1759c0a496e015fc54
- MD5 ca8bc7ce1cf1921492963fc7fbbd4554
- SHA1 2a33e6c5013d53bf79cf9ea88dbb2eb73972f70a
- SHA512 e907719cfa4e6454d48bff02f0b5c094ca4d8a9a0aaa69c778cb96898400b9504f642a8f7c59e7fdce426ef1d2389c06333a78eed001a970d1274148afc54e9b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 db579ad410b6412ddce82b5e1da177b10879fe0defcf4488796192847cb6703f
- MD5 d9d8e56f1a41e689cec1bfdf9603107a
- SHA1 0d1272fb69e48f41aaa03747b80b351fca8a08c9
- SHA512 69e17ca6bd49b6ea6aabeee05bbe7a4b8b9acfaffb3720309ac044b3e7ad7f50e0bff8d354d59050cb6b88fbab8c26d5226be4d3c9087fb94d3ae6fbeadae5d5
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\aoojjjrhmb.exe
- Size 512KB
- SHA256 953282c26e74820363750da4e0c6e61d20d9859fb329f5dbf9c8cec1d591d9ee
- MD5 7d5b6e01fa33dafc3cbccb0cc3e7a0b8
- SHA1 837227f2932e5619b8edd66ade17df87762e059d
- SHA512 27d157adc83971623659d65668dcd3582c546ea9c9c4c1bdfe093315f87c16d4b323c45db72f192165a67b4c3e304c5894e9bc6a3eca11ad634d069105c5516e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\npkukenkyuqgj.exe
- Size 512KB
- SHA256 b7e7c38e4222858a4eca47ece1f2ab522b8de76e6f403171b67ab5caef42d809
- MD5 606ea4e30cdf2fa2795a8f0b4b2a154a
- SHA1 5a0183721e4f51750854cfa83b695407c400f346
- SHA512 b99c76d5ace39e6afda5a6b6b5c5875b89bfe0a8f78e9043347146426fccef7979a19daddbf7d181ba0126689747226f948a86dd6a7b071b4cf41bc5923a4765
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\quxmkamf.exe
- Size 512KB
- SHA256 1e09cab9af456b061b2c174cd4d5b75b74905eed44b1ce3715453ac8728ab877
- MD5 3ef3dad0299e2acf2edc2a7176049ff0
- SHA1 b10352c17983f0df0c4d2fd85d594b9f0f2ac2ad
- SHA512 0eb514dc4c6af92e9374ff938cbb4ebebc2dc06701f65c808c1fd6143752ff8751dd6cd3cd34c1dc50ab166c0be52b0e0813164dbeec6e39125493182accf3fc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vgmmklwdxhelkco.exe
- Size 512KB
- SHA256 477fe0691862457e63a6cdbeadd3660e944f6f6f7a96d656d257f3d38479e6a5
- MD5 e8620b72f62801e1a4f7939a42390c99
- SHA1 b76291895a3c0b31bb5ad24e759b34d55c914b5b
- SHA512 a3e031bae1fb73e33873467686d2e5b963faddd1b1e18edac11b7badf52af34fb2d1a27fdd392bf93ecad15d1d26b007590c1960aa104151e1d2f20c72999efe
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 102c6b8405d13b917ac034493178b2c5e062ad523406e3a9f0a462e6127b3ff1
- MD5 13f096881b655cae29bea4e442609170
- SHA1 7377f5a5a95172d1fee392874caab4cff300ec8c
- SHA512 f6de50c703795d8c35c2e55b361c72a37a92d9274faf42e4a2358a0d9ea25180e39e9dc9ea700680c1009d74f8f524e2f154c849265ee9fddddad182271a97a9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 fed1c2e8734b6d1b71df99e83056d05c0f9325fd26430e7d2548ce1374ec1e4b
- MD5 17bd9ffcbf86234e80bd7ddf689c9752
- SHA1 44ae2a7802b597535afb502e46d147cb38e2856b
- SHA512 ef9908acff3bd5c7b7404a01b6fe1380556bb2dd62ddac91494304be62b1cfa26c4fd0a092ab35e132cbe73aac46cfd3cff281163da2cb2e507aed140a671763
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F
- MD5 SHA1 SHA512 SSDEEP