Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 07:11
Behavioral task
behavioral1
Sample
ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
26 signatures
150 seconds
General
-
Target
ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe
-
Size
255KB
-
MD5
ae49a2f7ce8873cf5c58b23ac2e0310b
-
SHA1
684f8e90196bab6f4e8add725b97d55b33064b1d
-
SHA256
2d8241aae53734f0fcc2b875d13cbbed3bca3bb96e3cca0610462c5eb52581b2
-
SHA512
1852ebae2e44414dc9ea9c408f4c9d2c109ba87866b01db3c4055a416930c68a805c25a6f0b67e58c1be06de249282bb0e050edfef4e29fb4480b20f23da4a1c
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIQ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" casbjdnskb.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" casbjdnskb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" casbjdnskb.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" casbjdnskb.exe -
Executes dropped EXE 5 IoCs
pid Process 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2756 casbjdnskb.exe 2680 vieffgbl.exe 2580 vieffgbl.exe -
Loads dropped DLL 5 IoCs
pid Process 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2756 casbjdnskb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2608-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x0007000000018702-9.dat upx behavioral1/files/0x000600000001875f-31.dat upx behavioral1/files/0x00070000000120fe-42.dat upx behavioral1/files/0x00070000000186cb-40.dat upx behavioral1/memory/2680-39-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-38-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-37-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-35-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2580-46-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2608-48-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x0007000000014188-63.dat upx behavioral1/files/0x00340000000186be-69.dat upx behavioral1/memory/2788-75-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-76-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-77-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2680-78-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2580-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2580-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-82-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2680-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-80-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-79-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2580-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2680-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2680-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2580-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-98-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-102-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-101-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-100-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-105-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-104-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-103-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-109-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-108-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-107-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-112-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-111-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-110-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-114-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-115-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-113-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-118-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-117-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-116-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-139-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-138-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-137-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-140-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-142-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-141-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2788-144-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2660-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-143-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2756-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" casbjdnskb.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gjawdixshjnwx.exe" jzrzfwbkurbezli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\icgxvccg = "casbjdnskb.exe" jzrzfwbkurbezli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tjkwfxvo = "jzrzfwbkurbezli.exe" jzrzfwbkurbezli.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: casbjdnskb.exe File opened (read-only) \??\i: vieffgbl.exe File opened (read-only) \??\j: vieffgbl.exe File opened (read-only) \??\z: vieffgbl.exe File opened (read-only) \??\m: vieffgbl.exe File opened (read-only) \??\o: vieffgbl.exe File opened (read-only) \??\s: vieffgbl.exe File opened (read-only) \??\j: casbjdnskb.exe File opened (read-only) \??\h: vieffgbl.exe File opened (read-only) \??\y: vieffgbl.exe File opened (read-only) \??\v: vieffgbl.exe File opened (read-only) \??\t: casbjdnskb.exe File opened (read-only) \??\e: vieffgbl.exe File opened (read-only) \??\n: vieffgbl.exe File opened (read-only) \??\v: vieffgbl.exe File opened (read-only) \??\m: casbjdnskb.exe File opened (read-only) \??\l: vieffgbl.exe File opened (read-only) \??\q: vieffgbl.exe File opened (read-only) \??\t: vieffgbl.exe File opened (read-only) \??\u: vieffgbl.exe File opened (read-only) \??\l: casbjdnskb.exe File opened (read-only) \??\r: vieffgbl.exe File opened (read-only) \??\b: vieffgbl.exe File opened (read-only) \??\p: vieffgbl.exe File opened (read-only) \??\e: casbjdnskb.exe File opened (read-only) \??\g: casbjdnskb.exe File opened (read-only) \??\b: vieffgbl.exe File opened (read-only) \??\m: vieffgbl.exe File opened (read-only) \??\h: vieffgbl.exe File opened (read-only) \??\z: vieffgbl.exe File opened (read-only) \??\a: casbjdnskb.exe File opened (read-only) \??\q: casbjdnskb.exe File opened (read-only) \??\s: casbjdnskb.exe File opened (read-only) \??\v: casbjdnskb.exe File opened (read-only) \??\a: vieffgbl.exe File opened (read-only) \??\g: vieffgbl.exe File opened (read-only) \??\k: vieffgbl.exe File opened (read-only) \??\x: vieffgbl.exe File opened (read-only) \??\o: casbjdnskb.exe File opened (read-only) \??\e: vieffgbl.exe File opened (read-only) \??\l: vieffgbl.exe File opened (read-only) \??\t: vieffgbl.exe File opened (read-only) \??\x: vieffgbl.exe File opened (read-only) \??\q: vieffgbl.exe File opened (read-only) \??\y: vieffgbl.exe File opened (read-only) \??\r: casbjdnskb.exe File opened (read-only) \??\z: casbjdnskb.exe File opened (read-only) \??\k: vieffgbl.exe File opened (read-only) \??\o: vieffgbl.exe File opened (read-only) \??\w: vieffgbl.exe File opened (read-only) \??\p: casbjdnskb.exe File opened (read-only) \??\u: vieffgbl.exe File opened (read-only) \??\a: vieffgbl.exe File opened (read-only) \??\j: vieffgbl.exe File opened (read-only) \??\r: vieffgbl.exe File opened (read-only) \??\h: casbjdnskb.exe File opened (read-only) \??\s: vieffgbl.exe File opened (read-only) \??\i: vieffgbl.exe File opened (read-only) \??\n: vieffgbl.exe File opened (read-only) \??\w: vieffgbl.exe File opened (read-only) \??\i: casbjdnskb.exe File opened (read-only) \??\n: casbjdnskb.exe File opened (read-only) \??\w: casbjdnskb.exe File opened (read-only) \??\p: vieffgbl.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" casbjdnskb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" casbjdnskb.exe -
AutoIT Executable 58 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2680-39-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-38-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-37-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-35-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2608-48-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-75-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-76-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-77-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2680-78-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2580-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2580-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-82-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2680-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-80-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-79-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2580-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2680-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2680-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2580-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-99-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-98-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-102-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-101-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-100-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-105-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-104-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-103-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-109-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-108-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-107-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-112-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-111-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-110-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-114-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-115-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-113-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-118-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-117-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-116-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-139-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-138-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-137-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-140-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-142-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-141-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-144-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-143-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2756-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2788-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2660-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\gjawdixshjnwx.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\casbjdnskb.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File created C:\Windows\SysWOW64\jzrzfwbkurbezli.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jzrzfwbkurbezli.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File created C:\Windows\SysWOW64\vieffgbl.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vieffgbl.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File created C:\Windows\SysWOW64\gjawdixshjnwx.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll casbjdnskb.exe File created C:\Windows\SysWOW64\casbjdnskb.exe ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vieffgbl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vieffgbl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vieffgbl.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vieffgbl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vieffgbl.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vieffgbl.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vieffgbl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vieffgbl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vieffgbl.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vieffgbl.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vieffgbl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vieffgbl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vieffgbl.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vieffgbl.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vieffgbl.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jzrzfwbkurbezli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gjawdixshjnwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language casbjdnskb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vieffgbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vieffgbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B1584792399D53C8BAD532E8D7CA" ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFF8D4858826F913CD72E7E9DBCEEE143593667326242D69C" ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BB6FE1A22D0D109D0D48A7A9114" ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" casbjdnskb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" casbjdnskb.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" casbjdnskb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" casbjdnskb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf casbjdnskb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat casbjdnskb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C67B1596DBC7B8B97F95ECE334C6" ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh casbjdnskb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc casbjdnskb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" casbjdnskb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFF9BEFE16F293830F3A46869939E1B38A038F4311033CE2C442EC08A3" ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" casbjdnskb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs casbjdnskb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg casbjdnskb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402C799D5183226A3676D470512DDD7D8564DB" ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2588 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2788 jzrzfwbkurbezli.exe 2788 jzrzfwbkurbezli.exe 2788 jzrzfwbkurbezli.exe 2788 jzrzfwbkurbezli.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2680 vieffgbl.exe 2680 vieffgbl.exe 2680 vieffgbl.exe 2680 vieffgbl.exe 2580 vieffgbl.exe 2580 vieffgbl.exe 2580 vieffgbl.exe 2580 vieffgbl.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2680 vieffgbl.exe 2680 vieffgbl.exe 2680 vieffgbl.exe 2580 vieffgbl.exe 2580 vieffgbl.exe 2580 vieffgbl.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2660 gjawdixshjnwx.exe 2788 jzrzfwbkurbezli.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2756 casbjdnskb.exe 2680 vieffgbl.exe 2680 vieffgbl.exe 2680 vieffgbl.exe 2580 vieffgbl.exe 2580 vieffgbl.exe 2580 vieffgbl.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2588 WINWORD.EXE 2588 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2756 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 31 PID 2608 wrote to memory of 2756 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 31 PID 2608 wrote to memory of 2756 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 31 PID 2608 wrote to memory of 2756 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 31 PID 2608 wrote to memory of 2788 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 32 PID 2608 wrote to memory of 2788 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 32 PID 2608 wrote to memory of 2788 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 32 PID 2608 wrote to memory of 2788 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 32 PID 2608 wrote to memory of 2680 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 33 PID 2608 wrote to memory of 2680 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 33 PID 2608 wrote to memory of 2680 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 33 PID 2608 wrote to memory of 2680 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 33 PID 2608 wrote to memory of 2660 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 34 PID 2608 wrote to memory of 2660 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 34 PID 2608 wrote to memory of 2660 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 34 PID 2608 wrote to memory of 2660 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 34 PID 2756 wrote to memory of 2580 2756 casbjdnskb.exe 35 PID 2756 wrote to memory of 2580 2756 casbjdnskb.exe 35 PID 2756 wrote to memory of 2580 2756 casbjdnskb.exe 35 PID 2756 wrote to memory of 2580 2756 casbjdnskb.exe 35 PID 2608 wrote to memory of 2588 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 36 PID 2608 wrote to memory of 2588 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 36 PID 2608 wrote to memory of 2588 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 36 PID 2608 wrote to memory of 2588 2608 ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe 36 PID 2588 wrote to memory of 2752 2588 WINWORD.EXE 38 PID 2588 wrote to memory of 2752 2588 WINWORD.EXE 38 PID 2588 wrote to memory of 2752 2588 WINWORD.EXE 38 PID 2588 wrote to memory of 2752 2588 WINWORD.EXE 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae49a2f7ce8873cf5c58b23ac2e0310b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\casbjdnskb.execasbjdnskb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\vieffgbl.exeC:\Windows\system32\vieffgbl.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2580
-
-
-
C:\Windows\SysWOW64\jzrzfwbkurbezli.exejzrzfwbkurbezli.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2788
-
-
C:\Windows\SysWOW64\vieffgbl.exevieffgbl.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2680
-
-
C:\Windows\SysWOW64\gjawdixshjnwx.exegjawdixshjnwx.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2660
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5db631c94a3408a6a3bc4dd5c4372f6ca
SHA106dd16adddf07946a23f93de7cecf195b054d5ae
SHA256002ef66eded321052459f672f9229df9a67ac664da724691159e228308be0032
SHA512c3057521461d48bc44df13909e6ea14ae8fb7d3dd3f871ccd0fc6048951bc57bb96fcbd28fd2710412fb108142456885143125e93c936e82f213128900800575
-
Filesize
255KB
MD5d862d7617f9f7b35709fe14f19e0af6a
SHA1ab9af315d5272067e906a57d8e197a54fc5d8b43
SHA256d876259beae0e815b3798cf339e5a75db6d981f014c18b49f0b77b43e6c1a777
SHA5126c312ad1081f3ec367df6b0fb5aaca9158fdb1d5085c8489dd7c6bbf4f685a389fb89444a3cf8b8859f75684e4185e50ca51d840ca301a90121c2338da492797
-
Filesize
19KB
MD51136b976fcde50cf9dcc5cc57a6d9ee6
SHA17e26b505d3f3d860e897d9716775c61ec9694e39
SHA2560a294f9e5ea108e2d71ed7e1610837813f84ed4d55b8ecfed5c05daec7597ff3
SHA512d034a7a76a876c6b683df93e40c8c067120b7d5f671f73e7678e7e47f4797c92f741e568fbd7855e544b2a4f7913c7957e7bd0ab1925ad47e98c79906d792bc8
-
Filesize
255KB
MD5088bee0fb5cecc129a366e8aa24c96d5
SHA17312f49dc0d5f7d93671b0f4da1630a6d7614cd9
SHA25685f21ab54428732d1e329557ddd83d59d2803d794bb8cca0af5f7b55287963f3
SHA5123e42254f9046743840504619794774257ffcea039a7adc888f5ccd7d09157ecd33302ab5ae3bad49578b01049a5927c4ea0775fd19419211f36813833a3368e3
-
Filesize
255KB
MD5d819d36d139d017d273177ee4cbeb146
SHA16218567a21cb0b31d1b42d14cc1490fb4daecef6
SHA25609acb5e408db8f42b9b4c91ac65ab1c5569ab988ab81919560bf30e8642d846a
SHA512fa76e89f73d994670412e8ac4b48eb2fcb006e6059ba7d84bac2298ca525da58e96260b6e5dc92710ea7c1ed763388d254e028672ae70d6644f8dc40834bf5ad
-
Filesize
255KB
MD56b175ce455ee932037c5828e0d5b3f2b
SHA12b38f880969cd011cb86bade43d3c4a184c137c2
SHA256a87bb49237306743b0d5bfabdacd37847335289a3ec1f502030861d90042137f
SHA512ba6a0e519f02a2450d2355b1be90f340d7643e44cdfe6bb95c3d0ca64bbda7586a856e6019aaf3a7c387d05dd259409b7ea45a35f199b8d2db8e6f55220841de
-
Filesize
255KB
MD5d45140dde47fd58162d6c2909bd719f7
SHA1055d54201b10f88e4bfde849af561978f5af615f
SHA256fb0d4d8586997debb7556420abf7de45b1ac55b2322ccc0a10a6b7010f713271
SHA51286f849a181f5d934860c7fda3625b88c3aad6774566e8569d6870ce6d73d42b12d43db7063c23645675a58c21c6c0d3660c976c2017e15f4b6f18be1a8b54cbb
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7