Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 05:42
Behavioral task
behavioral1
Sample
3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
28 signatures
150 seconds
General
-
Target
3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe
-
Size
255KB
-
MD5
3383d302b05d28bc170a5b64a81549d2
-
SHA1
efe9207b79095f0dfba98c3a8b9f74c1cfbe42db
-
SHA256
763f21e8ee3f12d5b44df48d69cb6b8834806f04cdc8c051cb04ada437cb7299
-
SHA512
54f0e9dc5c35166c1dc2087f4826f28e405a92c00f3ba04558f1c47b4c7eacbbe56e511a36e86b4430af34c6b026a48340612a45b0b479fbc88af2c7505afa12
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJe:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" vzloztrnpq.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vzloztrnpq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vzloztrnpq.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vzloztrnpq.exe -
Executes dropped EXE 5 IoCs
pid Process 1908 vzloztrnpq.exe 2700 peftswubsfytzaq.exe 2772 ydvrrrko.exe 1152 mxrhvrovttjsd.exe 1600 ydvrrrko.exe -
Loads dropped DLL 5 IoCs
pid Process 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1908 vzloztrnpq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x0007000000016c7c-9.dat upx behavioral1/files/0x000900000001225f-17.dat upx behavioral1/memory/1908-22-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2360-21-0x0000000003340000-0x00000000033E0000-memory.dmp upx behavioral1/files/0x0008000000016c03-27.dat upx behavioral1/memory/2700-29-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2772-35-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-43-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x0007000000016ca5-42.dat upx behavioral1/memory/1600-47-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2360-49-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x000900000001678f-68.dat upx behavioral1/files/0x000a000000016cbc-74.dat upx behavioral1/files/0x0009000000016cc4-80.dat upx behavioral1/memory/1908-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1600-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2772-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2772-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2772-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1600-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-98-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1600-100-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-101-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2772-103-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1600-105-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-104-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-102-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1600-109-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2772-108-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-110-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-111-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-112-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-114-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-115-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-113-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-119-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-118-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-120-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-124-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-125-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-126-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-128-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-129-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-127-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-130-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-131-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-134-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-135-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-133-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-138-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-137-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-136-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1908-139-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1152-141-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2700-140-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vzloztrnpq.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gebolllp = "vzloztrnpq.exe" peftswubsfytzaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tslpusgq = "peftswubsfytzaq.exe" peftswubsfytzaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mxrhvrovttjsd.exe" peftswubsfytzaq.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: ydvrrrko.exe File opened (read-only) \??\k: ydvrrrko.exe File opened (read-only) \??\l: vzloztrnpq.exe File opened (read-only) \??\r: vzloztrnpq.exe File opened (read-only) \??\j: vzloztrnpq.exe File opened (read-only) \??\p: vzloztrnpq.exe File opened (read-only) \??\g: ydvrrrko.exe File opened (read-only) \??\z: ydvrrrko.exe File opened (read-only) \??\m: vzloztrnpq.exe File opened (read-only) \??\n: ydvrrrko.exe File opened (read-only) \??\i: vzloztrnpq.exe File opened (read-only) \??\o: vzloztrnpq.exe File opened (read-only) \??\s: vzloztrnpq.exe File opened (read-only) \??\b: ydvrrrko.exe File opened (read-only) \??\n: ydvrrrko.exe File opened (read-only) \??\h: ydvrrrko.exe File opened (read-only) \??\l: ydvrrrko.exe File opened (read-only) \??\v: ydvrrrko.exe File opened (read-only) \??\x: ydvrrrko.exe File opened (read-only) \??\x: vzloztrnpq.exe File opened (read-only) \??\z: vzloztrnpq.exe File opened (read-only) \??\j: ydvrrrko.exe File opened (read-only) \??\g: ydvrrrko.exe File opened (read-only) \??\u: ydvrrrko.exe File opened (read-only) \??\t: vzloztrnpq.exe File opened (read-only) \??\a: ydvrrrko.exe File opened (read-only) \??\k: ydvrrrko.exe File opened (read-only) \??\y: ydvrrrko.exe File opened (read-only) \??\y: ydvrrrko.exe File opened (read-only) \??\i: ydvrrrko.exe File opened (read-only) \??\o: ydvrrrko.exe File opened (read-only) \??\v: vzloztrnpq.exe File opened (read-only) \??\s: ydvrrrko.exe File opened (read-only) \??\j: ydvrrrko.exe File opened (read-only) \??\n: vzloztrnpq.exe File opened (read-only) \??\v: ydvrrrko.exe File opened (read-only) \??\w: ydvrrrko.exe File opened (read-only) \??\h: vzloztrnpq.exe File opened (read-only) \??\h: ydvrrrko.exe File opened (read-only) \??\q: ydvrrrko.exe File opened (read-only) \??\e: vzloztrnpq.exe File opened (read-only) \??\p: ydvrrrko.exe File opened (read-only) \??\t: ydvrrrko.exe File opened (read-only) \??\w: ydvrrrko.exe File opened (read-only) \??\b: ydvrrrko.exe File opened (read-only) \??\q: vzloztrnpq.exe File opened (read-only) \??\i: ydvrrrko.exe File opened (read-only) \??\u: vzloztrnpq.exe File opened (read-only) \??\y: vzloztrnpq.exe File opened (read-only) \??\z: ydvrrrko.exe File opened (read-only) \??\k: vzloztrnpq.exe File opened (read-only) \??\u: ydvrrrko.exe File opened (read-only) \??\s: ydvrrrko.exe File opened (read-only) \??\x: ydvrrrko.exe File opened (read-only) \??\a: ydvrrrko.exe File opened (read-only) \??\l: ydvrrrko.exe File opened (read-only) \??\m: ydvrrrko.exe File opened (read-only) \??\r: ydvrrrko.exe File opened (read-only) \??\e: ydvrrrko.exe File opened (read-only) \??\m: ydvrrrko.exe File opened (read-only) \??\b: vzloztrnpq.exe File opened (read-only) \??\g: vzloztrnpq.exe File opened (read-only) \??\o: ydvrrrko.exe File opened (read-only) \??\q: ydvrrrko.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" vzloztrnpq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" vzloztrnpq.exe -
AutoIT Executable 61 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2360-21-0x0000000003340000-0x00000000033E0000-memory.dmp autoit_exe behavioral1/memory/2700-29-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-43-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1600-47-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2360-49-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-92-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1600-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-90-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2772-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2772-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2772-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1600-99-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-98-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1600-100-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-101-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2772-103-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1600-105-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-104-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-102-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1600-109-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2772-108-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-110-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-111-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-112-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-114-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-115-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-113-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-119-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-118-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-120-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-124-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-125-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-126-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-128-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-129-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-127-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-130-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-131-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-134-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-135-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-133-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-138-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-137-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-136-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-139-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-141-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-140-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-142-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-143-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-144-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1908-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2700-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1152-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mxrhvrovttjsd.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll vzloztrnpq.exe File opened for modification C:\Windows\SysWOW64\vzloztrnpq.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\peftswubsfytzaq.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\peftswubsfytzaq.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\ydvrrrko.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\vzloztrnpq.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ydvrrrko.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\mxrhvrovttjsd.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal ydvrrrko.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ydvrrrko.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ydvrrrko.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal ydvrrrko.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal ydvrrrko.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ydvrrrko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal ydvrrrko.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFC8F4F5D85199045D65A7DE1BC92E636584367366246D790" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C70B1597DBC2B9C17FE7EDE037C8" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" vzloztrnpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" vzloztrnpq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg vzloztrnpq.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BB0FE6621AED27CD0A28A75906A" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat vzloztrnpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" vzloztrnpq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh vzloztrnpq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs vzloztrnpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" vzloztrnpq.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB5FAB1F96BF2E284083A46819E3993B38C028B4261023DE2C4429A09D2" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC2B12E4493389952CCB9D0329ED7C9" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" vzloztrnpq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc vzloztrnpq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf vzloztrnpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" vzloztrnpq.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32452D0D9C2583506D3677D477242CA97C8E65D8" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2780 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2772 ydvrrrko.exe 2772 ydvrrrko.exe 2772 ydvrrrko.exe 2772 ydvrrrko.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1600 ydvrrrko.exe 1600 ydvrrrko.exe 1600 ydvrrrko.exe 1600 ydvrrrko.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 2700 peftswubsfytzaq.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe Token: SeShutdownPrivilege 1628 explorer.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 2772 ydvrrrko.exe 2772 ydvrrrko.exe 2772 ydvrrrko.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1600 ydvrrrko.exe 1600 ydvrrrko.exe 1600 ydvrrrko.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 1908 vzloztrnpq.exe 2772 ydvrrrko.exe 2772 ydvrrrko.exe 2772 ydvrrrko.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 2700 peftswubsfytzaq.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1152 mxrhvrovttjsd.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2780 WINWORD.EXE 2780 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1908 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 1908 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 1908 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 1908 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2700 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 32 PID 2360 wrote to memory of 2700 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 32 PID 2360 wrote to memory of 2700 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 32 PID 2360 wrote to memory of 2700 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 32 PID 2360 wrote to memory of 2772 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 33 PID 2360 wrote to memory of 2772 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 33 PID 2360 wrote to memory of 2772 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 33 PID 2360 wrote to memory of 2772 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 33 PID 2360 wrote to memory of 1152 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 34 PID 2360 wrote to memory of 1152 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 34 PID 2360 wrote to memory of 1152 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 34 PID 2360 wrote to memory of 1152 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 34 PID 1908 wrote to memory of 1600 1908 vzloztrnpq.exe 35 PID 1908 wrote to memory of 1600 1908 vzloztrnpq.exe 35 PID 1908 wrote to memory of 1600 1908 vzloztrnpq.exe 35 PID 1908 wrote to memory of 1600 1908 vzloztrnpq.exe 35 PID 2360 wrote to memory of 2780 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 36 PID 2360 wrote to memory of 2780 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 36 PID 2360 wrote to memory of 2780 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 36 PID 2360 wrote to memory of 2780 2360 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 36 PID 2780 wrote to memory of 2532 2780 WINWORD.EXE 39 PID 2780 wrote to memory of 2532 2780 WINWORD.EXE 39 PID 2780 wrote to memory of 2532 2780 WINWORD.EXE 39 PID 2780 wrote to memory of 2532 2780 WINWORD.EXE 39 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\vzloztrnpq.exevzloztrnpq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\ydvrrrko.exeC:\Windows\system32\ydvrrrko.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1600
-
-
-
C:\Windows\SysWOW64\peftswubsfytzaq.exepeftswubsfytzaq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2700
-
-
C:\Windows\SysWOW64\ydvrrrko.exeydvrrrko.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2772
-
-
C:\Windows\SysWOW64\mxrhvrovttjsd.exemxrhvrovttjsd.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1152
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2532
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1628
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD54ecf02f901dddf0bd501d118b509e510
SHA1eb1621bcfe2846ea3680944bcf8ca2fe6213451c
SHA256f2b3691fb76b5eac12a3a5bd618b1c4bd7b704b016edf18a18ee876e514e290a
SHA51261ec0160b48f54eddfbe9c0e0566d6c95adf454fb02dcc44956d8b3a7cfe4ec9a581544645d86c212494869d19d39a3d0655dfce0b31439dfdeab77fa2cf9a4f
-
Filesize
255KB
MD546a87c37dc0e3e6e4f9c8edf8bf2f66b
SHA1be1b4d58d751dfb4420cb06478804b8be99140e3
SHA256db9511e8640d846c4108c779c23fcf507caecd94ca05d8eab415a8d6f973efae
SHA512123a25ee48f886c209a58c343caefc167b5fd11fdfb89789b80b08ccf1b5a85e19e1736880ac24a0be45847f2ecac383edcb3f87d3a23e0d1a7c4d714029ddaf
-
Filesize
255KB
MD598ad2e36e8d1d1547e759d96132937f1
SHA18de3472e626844342d419c3d28f6717711beb714
SHA256b13b3ef5e7f064738b918a3f47726433b3c3064340cf1a3ec08b06739c3a580b
SHA5125148727f3d69631e7bcfe9f9f7037aa28cc054da084551aa78c9066f0d9f5b51c35ff462694284f08b62169e361fd87e942e79e99a76b6c91a9fa6ed3213d3b7
-
Filesize
255KB
MD5d894905bdc9978bc0ff69098182d5992
SHA10f938c01c4d3f353bb32cfc690fbfbbdac670bb3
SHA256845c81b5593fc82a8602e3e9d2aad01ec3d7035c7dcadcd7168bc3d3d896bcab
SHA512e89b642233b07ab02093728a6577f82aad20358637ae3563e74c6fcac91357814583064f0334dca8d4e9d43becc54a70e46d88b5ed2780e4f67f8d9b53d517f8
-
Filesize
255KB
MD5900d56d80fcdbf05ec5b502644709531
SHA1afcc4566bfa254db0493a11699cd0ca66c48ae68
SHA256c3205c0c5a7de718bef37c16b81a41ebf2aab2209f71559b02c8d4e100a5379d
SHA5129f11753d90a3bff5cf29036370be3442d9002ccf9f1dc50741c0e31db36fcb0b9de65cb03e66efef9be31e5ba10fe456b6c7c6922ed7dcb6cf0e4fb1a72add72
-
Filesize
255KB
MD537d5953af2aa8bef14ab5990aec1188b
SHA1734755db9e733cba473fc66ba555347e1256236c
SHA256318f49e023c19077941ddad34a0a1104060d33804b163d1742cbc49998733f7d
SHA5120b753db45b175ee4c2c8a5f0585b21b5eea8ead636d4d51e4f92e7d27760b1a6d53beae09f4cea0efb67005bfd285e405a8f7847b1ec771be560e1db70a8ed04
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5934f7536e2741fd7043d0c872083b2c9
SHA147b83e0b0a9f99f4900e5d011267b52f46dd16ca
SHA256df8e11006c2a38d1c95e3d224020b17ecfe16e106fae693ef09e1bb0a623b3cf
SHA512cec32eda60725095c464836fefbdabe3aed7fc512f9b08b3ccdc30fdb14d1e3df585770ea3a6c05003278d14234af653d9e179a5f70618d14e15eccbf9dea40c