Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 06:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe
- Size 512KB
- Sample240614-graeyaxfkh
- SHA256 f4291431298329d0c6089e917d4e4e77d875a1ebabf209bda780830babdd7262
- MD5 a83e138554be7d3cd18bb3ad304c97f4
- SHA1 24465caecaf6b673c399cd1f3533aebce1558f74
- SHA512 5994af5bd6c1a3d5e26a518de0c1b5c8335d9cb89392e5a306f8b3f4c6ad1cd1d952d5bb08124638eee770b6a4eb53645f16cca8f58e7565f592c9cf20f58f2f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" pdkxhusgzg.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pdkxhusgzg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pdkxhusgzg.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" pdkxhusgzg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 4576 pdkxhusgzg.exe 3384 fccknslxphrpobq.exe 788 bvmmcedt.exe 2156 vnjwqkcrrvmdl.exe 1068 bvmmcedt.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" pdkxhusgzg.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yuhyyrki = "fccknslxphrpobq.exe" fccknslxphrpobq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "vnjwqkcrrvmdl.exe" fccknslxphrpobq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pardmkfz = "pdkxhusgzg.exe" fccknslxphrpobq.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: bvmmcedt.exe File opened (read-only) \??\e: bvmmcedt.exe File opened (read-only) \??\p: bvmmcedt.exe File opened (read-only) \??\n: pdkxhusgzg.exe File opened (read-only) \??\q: pdkxhusgzg.exe File opened (read-only) \??\m: bvmmcedt.exe File opened (read-only) \??\i: pdkxhusgzg.exe File opened (read-only) \??\j: pdkxhusgzg.exe File opened (read-only) \??\b: pdkxhusgzg.exe File opened (read-only) \??\a: bvmmcedt.exe File opened (read-only) \??\e: bvmmcedt.exe File opened (read-only) \??\j: bvmmcedt.exe File opened (read-only) \??\n: bvmmcedt.exe File opened (read-only) \??\g: bvmmcedt.exe File opened (read-only) \??\s: pdkxhusgzg.exe File opened (read-only) \??\u: bvmmcedt.exe File opened (read-only) \??\z: bvmmcedt.exe File opened (read-only) \??\p: bvmmcedt.exe File opened (read-only) \??\g: pdkxhusgzg.exe File opened (read-only) \??\l: pdkxhusgzg.exe File opened (read-only) \??\k: pdkxhusgzg.exe File opened (read-only) \??\y: pdkxhusgzg.exe File opened (read-only) \??\t: bvmmcedt.exe File opened (read-only) \??\w: pdkxhusgzg.exe File opened (read-only) \??\i: bvmmcedt.exe File opened (read-only) \??\m: bvmmcedt.exe File opened (read-only) \??\v: bvmmcedt.exe File opened (read-only) \??\w: bvmmcedt.exe File opened (read-only) \??\b: bvmmcedt.exe File opened (read-only) \??\i: bvmmcedt.exe File opened (read-only) \??\l: bvmmcedt.exe File opened (read-only) \??\x: bvmmcedt.exe File opened (read-only) \??\r: pdkxhusgzg.exe File opened (read-only) \??\t: pdkxhusgzg.exe File opened (read-only) \??\v: pdkxhusgzg.exe File opened (read-only) \??\r: bvmmcedt.exe File opened (read-only) \??\s: bvmmcedt.exe File opened (read-only) \??\q: bvmmcedt.exe File opened (read-only) \??\t: bvmmcedt.exe File opened (read-only) \??\p: pdkxhusgzg.exe File opened (read-only) \??\y: bvmmcedt.exe File opened (read-only) \??\k: bvmmcedt.exe File opened (read-only) \??\b: bvmmcedt.exe File opened (read-only) \??\y: bvmmcedt.exe File opened (read-only) \??\m: pdkxhusgzg.exe File opened (read-only) \??\u: pdkxhusgzg.exe File opened (read-only) \??\a: bvmmcedt.exe File opened (read-only) \??\h: bvmmcedt.exe File opened (read-only) \??\u: bvmmcedt.exe File opened (read-only) \??\k: bvmmcedt.exe File opened (read-only) \??\o: bvmmcedt.exe File opened (read-only) \??\v: bvmmcedt.exe File opened (read-only) \??\e: pdkxhusgzg.exe File opened (read-only) \??\z: pdkxhusgzg.exe File opened (read-only) \??\q: bvmmcedt.exe File opened (read-only) \??\o: bvmmcedt.exe File opened (read-only) \??\w: bvmmcedt.exe File opened (read-only) \??\h: pdkxhusgzg.exe File opened (read-only) \??\o: pdkxhusgzg.exe File opened (read-only) \??\r: bvmmcedt.exe File opened (read-only) \??\h: bvmmcedt.exe File opened (read-only) \??\j: bvmmcedt.exe File opened (read-only) \??\a: pdkxhusgzg.exe File opened (read-only) \??\x: pdkxhusgzg.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" pdkxhusgzg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" pdkxhusgzg.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2988-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0008000000023564-5.dat autoit_exe behavioral2/files/0x00060000000233cd-18.dat autoit_exe behavioral2/files/0x0007000000023565-29.dat autoit_exe behavioral2/files/0x0007000000023566-31.dat autoit_exe behavioral2/files/0x0002000000022b07-66.dat autoit_exe behavioral2/files/0x000800000002354d-70.dat autoit_exe behavioral2/files/0x000f0000000234be-85.dat autoit_exe behavioral2/files/0x000f0000000234be-90.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\pdkxhusgzg.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File created C:\Windows\SysWOW64\bvmmcedt.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bvmmcedt.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll pdkxhusgzg.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bvmmcedt.exe File created C:\Windows\SysWOW64\pdkxhusgzg.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File created C:\Windows\SysWOW64\fccknslxphrpobq.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File created C:\Windows\SysWOW64\vnjwqkcrrvmdl.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vnjwqkcrrvmdl.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification C:\Windows\SysWOW64\fccknslxphrpobq.exe a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bvmmcedt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bvmmcedt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bvmmcedt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bvmmcedt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bvmmcedt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bvmmcedt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bvmmcedt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bvmmcedt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bvmmcedt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bvmmcedt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bvmmcedt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bvmmcedt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bvmmcedt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bvmmcedt.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification C:\Windows\mydoc.rtf a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bvmmcedt.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bvmmcedt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bvmmcedt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bvmmcedt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bvmmcedt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bvmmcedt.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bvmmcedt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bvmmcedt.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bvmmcedt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432C7C9C2282576A3477D577252CD97C8464DE" a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" pdkxhusgzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" pdkxhusgzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" pdkxhusgzg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs pdkxhusgzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C7741593DBB2B9CD7FE6ED9534B9" a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf pdkxhusgzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" pdkxhusgzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B02C47E339EF53CDBAD732EAD4BB" a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8CFF89482A826F9040D72C7D96BCEFE630584167336343D798" a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F16BB4FF6621DCD27DD0A58A7F9060" a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat pdkxhusgzg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh pdkxhusgzg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc pdkxhusgzg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg pdkxhusgzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACAFACEF911F192837E3A4286973E99B38F02FC42110239E1B8429B09D2" a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" pdkxhusgzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" pdkxhusgzg.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 740 WINWORD.EXE 740 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 4576 pdkxhusgzg.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 3384 fccknslxphrpobq.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 1068 bvmmcedt.exe 1068 bvmmcedt.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 3384 fccknslxphrpobq.exe 4576 pdkxhusgzg.exe 3384 fccknslxphrpobq.exe 4576 pdkxhusgzg.exe 3384 fccknslxphrpobq.exe 4576 pdkxhusgzg.exe 1068 bvmmcedt.exe 1068 bvmmcedt.exe 1068 bvmmcedt.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 788 bvmmcedt.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 2156 vnjwqkcrrvmdl.exe 3384 fccknslxphrpobq.exe 4576 pdkxhusgzg.exe 3384 fccknslxphrpobq.exe 4576 pdkxhusgzg.exe 3384 fccknslxphrpobq.exe 4576 pdkxhusgzg.exe 1068 bvmmcedt.exe 1068 bvmmcedt.exe 1068 bvmmcedt.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 740 WINWORD.EXE 740 WINWORD.EXE 740 WINWORD.EXE 740 WINWORD.EXE 740 WINWORD.EXE 740 WINWORD.EXE 740 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2988 wrote to memory of 4576 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 81 PID 2988 wrote to memory of 4576 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 81 PID 2988 wrote to memory of 4576 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 81 PID 2988 wrote to memory of 3384 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 82 PID 2988 wrote to memory of 3384 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 82 PID 2988 wrote to memory of 3384 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 82 PID 2988 wrote to memory of 788 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 83 PID 2988 wrote to memory of 788 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 83 PID 2988 wrote to memory of 788 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 83 PID 2988 wrote to memory of 2156 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 84 PID 2988 wrote to memory of 2156 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 84 PID 2988 wrote to memory of 2156 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 84 PID 2988 wrote to memory of 740 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 86 PID 2988 wrote to memory of 740 2988 a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe 86 PID 4576 wrote to memory of 1068 4576 pdkxhusgzg.exe 89 PID 4576 wrote to memory of 1068 4576 pdkxhusgzg.exe 89 PID 4576 wrote to memory of 1068 4576 pdkxhusgzg.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a83e138554be7d3cd18bb3ad304c97f4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\pdkxhusgzg.exepdkxhusgzg.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\bvmmcedt.exeC:\Windows\system32\bvmmcedt.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1068
-
-
-
C:\Windows\SysWOW64\fccknslxphrpobq.exefccknslxphrpobq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3384
-
-
C:\Windows\SysWOW64\bvmmcedt.exebvmmcedt.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:788
-
-
C:\Windows\SysWOW64\vnjwqkcrrvmdl.exevnjwqkcrrvmdl.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2156
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:740
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 bb7518c607b6d72668a786954f802ace9b019e31f7b8e4363427f268dd522c0f
- MD5 6edc19251d56c38a99b40d41f0639389
- SHA1 6e654a03de3fc34bb41ae450a461f9580f8a06b9
- SHA512 4b5ae7684c023c94b69d519390cc80fbc864fbea091595a00bea268f4bfb86890dadc2120182ed8cafa27f54fb68039b10ed7023d59dc2ae32a7bf54557a6ddd
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCD7FDF.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 7f418960bedd2f787ddffced8647021d08a07fd59577d0f2d012035779122e62
- MD5 69ab36f887c9aebc03cf2b9924e9af1a
- SHA1 e89545bd4d84ee79b970724d81406111054e5ede
- SHA512 dc8ae47740aa9109b9646d40500529aeda9c71421f5586f2d6c45a96cdf5a10dd7a4ae45193fbb58d6b3ef918d476af02f699111a1280ddd71cc1f65af38d653
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 ea3fda6345d9590b5fff4de3927a178d15f58b3e5685c078dbfd0996dd9b2244
- MD5 efa9bcbf435c15a84ffd11f5d6c32ae0
- SHA1 8ebf378743d6356f676f6fd28847d301d187bf37
- SHA512 e7bc7959d59be7473897e0f4bc78f5c8ee71f00fc6600d62af287c5ce1b194a659e8c7c76fdaea6b53456fc3d00340e15b7223ac506b23ac42f8e43af7bb31b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 036d09ca8a14d451728613415c124a3482d5dc8aed76768094cff1ce41532514
- MD5 0e5588ab70b3dfa48902ea9db0bf622f
- SHA1 8fa7313320b4177f7027f4a70f080d2e60cb1bdf
- SHA512 d6dc5225ae1aa537521208574d59109185a23ae0059666419a6861a08f4b1092437b61855e9e5873b6b7d837e0407ae6bd56b5b5bbd9acf597a7fc2b7ca7dd9a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\bvmmcedt.exe
- Size 512KB
- SHA256 c54a649e31ce8df4c58f8fe71f5e7d1ecd642978b944f1b4aef47fd193695f2c
- MD5 f2aaa7dd48539679594b3f15e6a2fc12
- SHA1 116b514bec528e1bc00c268a5c5b3285f56c71e5
- SHA512 4d2b1a1c60c12fd6c5ad5c5d126ad736dded1becf411ac20653475628b05f88be693d9b730093728373c39579de192cea73c08cc615bb15c9f2aa178b5fc7fcf
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\fccknslxphrpobq.exe
- Size 512KB
- SHA256 f74a36e634be6221f8d9977bd0149408cb05795d2e80cfc3ee1c59d1274cbde6
- MD5 95b9d31682e08508d332ce93ca414ff3
- SHA1 a629dc523c14d9c57c370d4b382e6442185a176c
- SHA512 a8cc8e5d019f803851683fb3f39b1c414af919848352f9708698bc84a96210e6e582c6e01b34f9fa5dc428c10dd23c31c361a6ab724db5ceb626353eb27fb967
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pdkxhusgzg.exe
- Size 512KB
- SHA256 dd551d47a3d957e87b22c077e840543c6114c1284943422bc1c2171b69296f56
- MD5 5d60d4999f817172c22ea6abf17571ad
- SHA1 46213a266e8a6c696a71183abdbff8e9f2f106c9
- SHA512 af457f8c92b29be7ad54890115e72734be13efe5d0fa1e7c016531128a5710430887bf01096401a7c49f8bada96a35b5e9c33d66c777a08e59aac72d2a548542
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vnjwqkcrrvmdl.exe
- Size 512KB
- SHA256 7c2d284a783ec1816ba3fae0c32acd7540f8b2e7e384df7a207cc58383a715d3
- MD5 8944dcc3372bca5008687ade1a9fda62
- SHA1 e13ea5346f59473131c88cdda902227b6dcb8c46
- SHA512 a7e5682ea708b9c8114d53d4027d1e06ec44475a917f4c6faaca02556710298126066e5ea4674513cfe89deb2fe1abe46931fb8a8395bc0a59897989fcfcc3f9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 743ca4159fd2685dd3bc447e1dcf0961f1bb8b43d243d362f1a59b4089f19890
- MD5 9238d3d49cc190fc9f908e08f1fc1973
- SHA1 c1cb04de3868273e22065be39b933a1207793412
- SHA512 f1583e02d78ac1e4a5f9079c92d5b4012763feaef72899fd6d981a0a10f1060390e975a72437e19b52205a9e01f5af52a4b0f189b3a1bb8c2352a81df22e57e9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 0364e64811877992ec71aa146932e7be6995b13b2f04df7b4a80f60184c01bc6
- MD5 cd355dd61f0f4f7febfe145f1fa98a35
- SHA1 eabbb53d26ccdd9ca544d2700815ca5ef322400f
- SHA512 bcb7bdd9d1ef32608b5773c58f2dca4f38ebfa7141bd6c42b7aed704964c40fdf4655a09a2d71e61f0bcec42fd9e20b298107986ac3e8db70c76c0fefc847664
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6+:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 9c04952b95b37913da14fae33c9179fc7ec4fec65bf3856334cb98b9aaae15c9
- MD5 42f697e4d3acfc8b7b152575518f9f43
- SHA1 9edab942a1b074b48995b2232718f957c010e95e
- SHA512 b77a6adba812e74c403b19a03bd69d22d64d8a5b3f96de0502a6c40b770be85976eb3954192dfda0fa6036c247c6d4a2c3d98d6d726612d2ef31df93da949dd6
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- MD5 SHA1 SHA512 SSDEEP