Analysis
- max time kernel
149s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe
- Size 512KB
- Sample240614-erwxtsydln
- SHA256 0e333114fef4436026c1932416ef457977d52a55bee38da00f66e75c0527ec72
- MD5 a7f625eea1bd1e2ee0693e93c949b48b
- SHA1 0803fee37334788921e9db44b1b68b53939f0575
- SHA512 e01c63468a08d1e920b6156a22f1c498fe755576a753a506411c983dca2201b8b552d2b9f0e9a32102abb1132c01f98e2ec29b5331199a3e363dcae27d872491
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hnhlssydkp.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hnhlssydkp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hnhlssydkp.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hnhlssydkp.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 2904 hnhlssydkp.exe 4360 hdattrglndjnyij.exe 1100 rfmubjgf.exe 2280 kdxalyhojxzui.exe 4812 rfmubjgf.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hnhlssydkp.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gekjqpjw = "hnhlssydkp.exe" hdattrglndjnyij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gyrvaxcr = "hdattrglndjnyij.exe" hdattrglndjnyij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kdxalyhojxzui.exe" hdattrglndjnyij.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: hnhlssydkp.exe File opened (read-only) \??\t: rfmubjgf.exe File opened (read-only) \??\q: rfmubjgf.exe File opened (read-only) \??\q: rfmubjgf.exe File opened (read-only) \??\j: hnhlssydkp.exe File opened (read-only) \??\i: rfmubjgf.exe File opened (read-only) \??\u: rfmubjgf.exe File opened (read-only) \??\v: rfmubjgf.exe File opened (read-only) \??\w: rfmubjgf.exe File opened (read-only) \??\a: hnhlssydkp.exe File opened (read-only) \??\b: hnhlssydkp.exe File opened (read-only) \??\r: hnhlssydkp.exe File opened (read-only) \??\r: rfmubjgf.exe File opened (read-only) \??\s: rfmubjgf.exe File opened (read-only) \??\s: rfmubjgf.exe File opened (read-only) \??\i: hnhlssydkp.exe File opened (read-only) \??\t: hnhlssydkp.exe File opened (read-only) \??\o: rfmubjgf.exe File opened (read-only) \??\p: rfmubjgf.exe File opened (read-only) \??\n: hnhlssydkp.exe File opened (read-only) \??\o: hnhlssydkp.exe File opened (read-only) \??\u: hnhlssydkp.exe File opened (read-only) \??\x: hnhlssydkp.exe File opened (read-only) \??\b: rfmubjgf.exe File opened (read-only) \??\b: rfmubjgf.exe File opened (read-only) \??\j: rfmubjgf.exe File opened (read-only) \??\x: rfmubjgf.exe File opened (read-only) \??\p: hnhlssydkp.exe File opened (read-only) \??\a: rfmubjgf.exe File opened (read-only) \??\l: rfmubjgf.exe File opened (read-only) \??\m: rfmubjgf.exe File opened (read-only) \??\p: rfmubjgf.exe File opened (read-only) \??\y: rfmubjgf.exe File opened (read-only) \??\g: hnhlssydkp.exe File opened (read-only) \??\k: hnhlssydkp.exe File opened (read-only) \??\z: hnhlssydkp.exe File opened (read-only) \??\j: rfmubjgf.exe File opened (read-only) \??\e: hnhlssydkp.exe File opened (read-only) \??\s: hnhlssydkp.exe File opened (read-only) \??\v: hnhlssydkp.exe File opened (read-only) \??\w: hnhlssydkp.exe File opened (read-only) \??\n: rfmubjgf.exe File opened (read-only) \??\o: rfmubjgf.exe File opened (read-only) \??\u: rfmubjgf.exe File opened (read-only) \??\x: rfmubjgf.exe File opened (read-only) \??\n: rfmubjgf.exe File opened (read-only) \??\v: rfmubjgf.exe File opened (read-only) \??\w: rfmubjgf.exe File opened (read-only) \??\e: rfmubjgf.exe File opened (read-only) \??\g: rfmubjgf.exe File opened (read-only) \??\y: hnhlssydkp.exe File opened (read-only) \??\e: rfmubjgf.exe File opened (read-only) \??\g: rfmubjgf.exe File opened (read-only) \??\k: rfmubjgf.exe File opened (read-only) \??\z: rfmubjgf.exe File opened (read-only) \??\a: rfmubjgf.exe File opened (read-only) \??\r: rfmubjgf.exe File opened (read-only) \??\h: rfmubjgf.exe File opened (read-only) \??\k: rfmubjgf.exe File opened (read-only) \??\m: rfmubjgf.exe File opened (read-only) \??\m: hnhlssydkp.exe File opened (read-only) \??\q: hnhlssydkp.exe File opened (read-only) \??\h: rfmubjgf.exe File opened (read-only) \??\i: rfmubjgf.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" hnhlssydkp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" hnhlssydkp.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3080-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023415-5.dat autoit_exe behavioral2/files/0x00080000000232a4-19.dat autoit_exe behavioral2/files/0x0007000000023416-26.dat autoit_exe behavioral2/files/0x0007000000023417-32.dat autoit_exe behavioral2/files/0x000a000000016fda-64.dat autoit_exe behavioral2/files/0x000400000001e0b6-70.dat autoit_exe behavioral2/files/0x000400000001e57f-90.dat autoit_exe behavioral2/files/0x000400000001e57f-96.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfmubjgf.exe File created C:\Windows\SysWOW64\hdattrglndjnyij.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File created C:\Windows\SysWOW64\rfmubjgf.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File created C:\Windows\SysWOW64\kdxalyhojxzui.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hnhlssydkp.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfmubjgf.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification C:\Windows\SysWOW64\kdxalyhojxzui.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll hnhlssydkp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rfmubjgf.exe File created C:\Windows\SysWOW64\hnhlssydkp.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hdattrglndjnyij.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rfmubjgf.exe a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfmubjgf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfmubjgf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rfmubjgf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfmubjgf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfmubjgf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfmubjgf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfmubjgf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rfmubjgf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfmubjgf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rfmubjgf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfmubjgf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rfmubjgf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rfmubjgf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rfmubjgf.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfmubjgf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfmubjgf.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfmubjgf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfmubjgf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfmubjgf.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification C:\Windows\mydoc.rtf a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe rfmubjgf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfmubjgf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe rfmubjgf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C769C2183536D3F77D3772F2CDA7D8565D9" a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC77814E0DBC4B8BC7F95EDE437CB" a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh hnhlssydkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs hnhlssydkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" hnhlssydkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB2B12C47E3389853CCBAA73292D7B9" a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" hnhlssydkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc hnhlssydkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" hnhlssydkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg hnhlssydkp.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BB0FE6F21A9D108D1D58A089014" a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABDFAB0F917F2E284743A43869C39E4B08102F04362034EE2BE42E908A0" a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFF834F2885699134D62E7D9DBDE2E141583066366244D79D" a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat hnhlssydkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" hnhlssydkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" hnhlssydkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf hnhlssydkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" hnhlssydkp.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3012 WINWORD.EXE 3012 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 2904 hnhlssydkp.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 4360 hdattrglndjnyij.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 1100 rfmubjgf.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 2280 kdxalyhojxzui.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe 4812 rfmubjgf.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3012 WINWORD.EXE 3012 WINWORD.EXE 3012 WINWORD.EXE 3012 WINWORD.EXE 3012 WINWORD.EXE 3012 WINWORD.EXE 3012 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3080 wrote to memory of 2904 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 82 PID 3080 wrote to memory of 2904 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 82 PID 3080 wrote to memory of 2904 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 82 PID 3080 wrote to memory of 4360 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 83 PID 3080 wrote to memory of 4360 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 83 PID 3080 wrote to memory of 4360 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 83 PID 3080 wrote to memory of 1100 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 84 PID 3080 wrote to memory of 1100 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 84 PID 3080 wrote to memory of 1100 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 84 PID 3080 wrote to memory of 2280 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 85 PID 3080 wrote to memory of 2280 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 85 PID 3080 wrote to memory of 2280 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 85 PID 3080 wrote to memory of 3012 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 86 PID 3080 wrote to memory of 3012 3080 a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe 86 PID 2904 wrote to memory of 4812 2904 hnhlssydkp.exe 88 PID 2904 wrote to memory of 4812 2904 hnhlssydkp.exe 88 PID 2904 wrote to memory of 4812 2904 hnhlssydkp.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7f625eea1bd1e2ee0693e93c949b48b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\hnhlssydkp.exehnhlssydkp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rfmubjgf.exeC:\Windows\system32\rfmubjgf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4812
-
-
-
C:\Windows\SysWOW64\hdattrglndjnyij.exehdattrglndjnyij.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4360
-
-
C:\Windows\SysWOW64\rfmubjgf.exerfmubjgf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1100
-
-
C:\Windows\SysWOW64\kdxalyhojxzui.exekdxalyhojxzui.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2280
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 706ac04423a893a4b6f78276ca5460e06ac242933b66052e63ff3f8143b53dce
- MD5 05f5c4702feecc29188ac6905dfb0268
- SHA1 2c979a59ebe0f43d0ff7dc544fa2dd56930f1425
- SHA512 8508d572293e3d9903bd1e1117f910eeb71275f2da8fd6bae877971b62b07f21a4901992f93b01de2779e85acdb2c0eaf907e5faec24f3aa19a0c08bbacc0b0c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 df4cf6d946af990cd31a35fc97aa0fffa58801c06461d0bec44e46c330b0f5e2
- MD5 0f294d12bcaaff80829973d3d13126ca
- SHA1 7a692996a0e118eee4febef94b10452857d70243
- SHA512 6adc63b71d8d862364eafc7a5603731fef1dc6bcc5c001d5521bd6301296650cc51a442e409aab000d84a3c41c8e0c086e24b65e7b9a3955d57c1efc6e92b5fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 f0ab7a6399b9798fdbc8b3db7c09e71dbd069cc2e403498f33116bfc740d9c3c
- MD5 e4e8d9b7e159966593e508073f496e26
- SHA1 84fe016bdd889678d8d55f21356b8f9e2942c18a
- SHA512 6405a605e03865506f800eda9404942642ac963d54755daeb7b84a37fc012a4d50e10fc12e18cc5c76ef94b3e63587718b838a4ac43f073710eb4f80218b5cf7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Documents\RenamePush.doc.exe
- Size 512KB
- SHA256 7348986db5dfb4832bf3d7207acb5e107a5323b9518169dd50660c26497d4b8c
- MD5 15a7f93d8cab728c18d8a3f1713be77a
- SHA1 01c92a4f91794ee55f5d61c59d830b7b21283a47
- SHA512 81e964245b9c0bc977e5a15e5607ab08d0a123587c5b69e7aeaff90e78c575bead0387482911a0441be79cb334f02f2d995a9b807f6424799dc5dcd6cc0294ef
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hdattrglndjnyij.exe
- Size 512KB
- SHA256 a5066df53aa8540064b204f5147208b2f97133ab73bda320d32e14412ee014e1
- MD5 2e02980a8d792d70e6c2a666d5973152
- SHA1 5d847d6475dc15f626427af959d602e347e756b8
- SHA512 3b0d84b4a61bc91b31f1e2d4652d6bcd8949ba6d35e34a3a7f62acbd4f09b69606c2a39b0a4f0c3cd186548ea2056f2f6292821cb619152781965fe7ba7d48f3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hnhlssydkp.exe
- Size 512KB
- SHA256 df8dd334832669618b7fc898614d739bdd544f815e4fcd48b75956efa9a32af9
- MD5 1c64ee408365bd0ead471bb4e954958c
- SHA1 2d7017cc48b82bd3a6ccbec2b69be86ee191983c
- SHA512 72aa2029bb8cf166f8f15b6ea77b11e372699f748ea8ee2cdd30a49792b7121f7f1d9082c57195f602030afa00451cd7d00e4a277cd9b17f6be6d769a5555623
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kdxalyhojxzui.exe
- Size 512KB
- SHA256 6b14ab91c8b09c038cc5ee9848cf2fec0b0054c2d9184aef023c62648566d56e
- MD5 9306d3556f8b5ffe5f2bf676a4a17c9c
- SHA1 fc30bec5bd8497dba3c6bcabe16953145cacf9c9
- SHA512 f18a7e3eb8811e26ff775e9a855018a7ee397515369af57d54d6ea7cc82bdc38d51a215702cf7ab7d77bd8ce745f4b5f6f5264d13cd102bec0fe156f9f56ae4c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rfmubjgf.exe
- Size 512KB
- SHA256 7eb7f513ea5d9e7062902e71370e9206b9b5b4c6e85c0dc124ac889c62abe7e2
- MD5 0dda127f0208dbec9da251d3c78023ba
- SHA1 972e5058614f9fdd66d896b6f1c09588455a6455
- SHA512 a52044992d78bf5e71fe79daf78ab08d861c0f870041df9ec8d08c4e130c7d666e86dccc7a0d6d7f98b481abdc4ea3fadcc6d909bcccea19de3140fa4865e336
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 69717cb5cacba51389e03657244a7bd7439444e25b7484c5c79282869f4e335f
- MD5 75adb569b08de3e5b8f9695c3330392b
- SHA1 af32126084d3777209a8dc57e7d7c2468cd46c0c
- SHA512 4b173261db406a1990a8ad465a94620422a3362ffebb65ca7cf4af5ea4d710e410429a19e53819161a12fb49f6af19ed3a3a5beb7031d40d85bee149ca78606e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 d7b93e53f6e6011cb01427d0cb516c72f34a3de65dd6d3d41541143a90f558f7
- MD5 6312177c711723f2b0fff0c8b53293e5
- SHA1 72a3c8030a4e580be93262f5d1a06a964dcdafb8
- SHA512 dc809b58365c35bb44e9dcb2b10545c5b5c7056c34d5a6f4b98124a58d16676955e83eb8b7068d5cc9c1770b57419b77d445dddd43ff6e489f5eaba122f63fee
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- MD5 SHA1 SHA512 SSDEEP