Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 12:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
25 signatures
150 seconds
General
-
Target
be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe
-
Size
512KB
-
MD5
be8cc6cd32e6a241ea36bb7edf55a80c
-
SHA1
114657fadf4897e5937d58bea4e682ed21044472
-
SHA256
ab7fb752791fd3b916cddc2f2c63688874d7ba552974858fc3a4e185bd971355
-
SHA512
eb3322f5b06c4abf277b3af48b2e5b4594d10cf30c7b349d8fe5a3ba205c23bbfd0cc0014d9009ddfde7638d73d7a1eaeaecbeb6a949dfff6e939435b58ed8f3
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" zxwxesqaxf.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zxwxesqaxf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zxwxesqaxf.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zxwxesqaxf.exe -
Executes dropped EXE 5 IoCs
pid Process 2952 zxwxesqaxf.exe 2932 hcipslwvqfmvlab.exe 2780 vjwqsyko.exe 2636 xmjkghyunlqhk.exe 1624 vjwqsyko.exe -
Loads dropped DLL 5 IoCs
pid Process 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2952 zxwxesqaxf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zxwxesqaxf.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ymkzypny = "zxwxesqaxf.exe" hcipslwvqfmvlab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yfuhgxjh = "hcipslwvqfmvlab.exe" hcipslwvqfmvlab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xmjkghyunlqhk.exe" hcipslwvqfmvlab.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: zxwxesqaxf.exe File opened (read-only) \??\e: vjwqsyko.exe File opened (read-only) \??\u: vjwqsyko.exe File opened (read-only) \??\e: zxwxesqaxf.exe File opened (read-only) \??\l: zxwxesqaxf.exe File opened (read-only) \??\n: zxwxesqaxf.exe File opened (read-only) \??\x: zxwxesqaxf.exe File opened (read-only) \??\y: zxwxesqaxf.exe File opened (read-only) \??\w: vjwqsyko.exe File opened (read-only) \??\b: vjwqsyko.exe File opened (read-only) \??\y: vjwqsyko.exe File opened (read-only) \??\h: zxwxesqaxf.exe File opened (read-only) \??\y: vjwqsyko.exe File opened (read-only) \??\e: vjwqsyko.exe File opened (read-only) \??\n: vjwqsyko.exe File opened (read-only) \??\v: vjwqsyko.exe File opened (read-only) \??\u: zxwxesqaxf.exe File opened (read-only) \??\t: zxwxesqaxf.exe File opened (read-only) \??\j: vjwqsyko.exe File opened (read-only) \??\z: vjwqsyko.exe File opened (read-only) \??\u: vjwqsyko.exe File opened (read-only) \??\g: vjwqsyko.exe File opened (read-only) \??\s: vjwqsyko.exe File opened (read-only) \??\m: zxwxesqaxf.exe File opened (read-only) \??\a: vjwqsyko.exe File opened (read-only) \??\r: vjwqsyko.exe File opened (read-only) \??\r: vjwqsyko.exe File opened (read-only) \??\p: zxwxesqaxf.exe File opened (read-only) \??\q: zxwxesqaxf.exe File opened (read-only) \??\i: vjwqsyko.exe File opened (read-only) \??\x: vjwqsyko.exe File opened (read-only) \??\n: vjwqsyko.exe File opened (read-only) \??\w: zxwxesqaxf.exe File opened (read-only) \??\z: zxwxesqaxf.exe File opened (read-only) \??\a: vjwqsyko.exe File opened (read-only) \??\b: vjwqsyko.exe File opened (read-only) \??\o: vjwqsyko.exe File opened (read-only) \??\q: vjwqsyko.exe File opened (read-only) \??\s: zxwxesqaxf.exe File opened (read-only) \??\v: zxwxesqaxf.exe File opened (read-only) \??\v: vjwqsyko.exe File opened (read-only) \??\q: vjwqsyko.exe File opened (read-only) \??\o: vjwqsyko.exe File opened (read-only) \??\w: vjwqsyko.exe File opened (read-only) \??\a: zxwxesqaxf.exe File opened (read-only) \??\x: vjwqsyko.exe File opened (read-only) \??\p: vjwqsyko.exe File opened (read-only) \??\j: zxwxesqaxf.exe File opened (read-only) \??\m: vjwqsyko.exe File opened (read-only) \??\b: zxwxesqaxf.exe File opened (read-only) \??\g: zxwxesqaxf.exe File opened (read-only) \??\t: vjwqsyko.exe File opened (read-only) \??\r: zxwxesqaxf.exe File opened (read-only) \??\p: vjwqsyko.exe File opened (read-only) \??\s: vjwqsyko.exe File opened (read-only) \??\o: zxwxesqaxf.exe File opened (read-only) \??\j: vjwqsyko.exe File opened (read-only) \??\k: vjwqsyko.exe File opened (read-only) \??\m: vjwqsyko.exe File opened (read-only) \??\z: vjwqsyko.exe File opened (read-only) \??\k: zxwxesqaxf.exe File opened (read-only) \??\g: vjwqsyko.exe File opened (read-only) \??\i: vjwqsyko.exe File opened (read-only) \??\k: vjwqsyko.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" zxwxesqaxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" zxwxesqaxf.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0008000000016d29-5.dat autoit_exe behavioral1/files/0x000c000000012283-17.dat autoit_exe behavioral1/files/0x0008000000016d31-28.dat autoit_exe behavioral1/files/0x0008000000016d3a-35.dat autoit_exe behavioral1/files/0x0029000000016cdf-68.dat autoit_exe behavioral1/files/0x0008000000013437-66.dat autoit_exe behavioral1/files/0x0007000000016d65-82.dat autoit_exe behavioral1/files/0x0008000000016dcb-84.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\vjwqsyko.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vjwqsyko.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File created C:\Windows\SysWOW64\xmjkghyunlqhk.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll zxwxesqaxf.exe File created C:\Windows\SysWOW64\zxwxesqaxf.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\zxwxesqaxf.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File created C:\Windows\SysWOW64\hcipslwvqfmvlab.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hcipslwvqfmvlab.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xmjkghyunlqhk.exe be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vjwqsyko.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vjwqsyko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vjwqsyko.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vjwqsyko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vjwqsyko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vjwqsyko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vjwqsyko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vjwqsyko.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vjwqsyko.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vjwqsyko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vjwqsyko.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vjwqsyko.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vjwqsyko.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vjwqsyko.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjwqsyko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hcipslwvqfmvlab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zxwxesqaxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjwqsyko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xmjkghyunlqhk.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABDFACEF964F29984083B36819C3E97B38E028B4365023FE1B9429A08A8" be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" zxwxesqaxf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302D0B9D5582576A4277D377272CDF7C8664DF" be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C60C14E7DAB3B8BA7F95ED9434BA" be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B120449038E352CDB9A2329ED7C9" be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0816BB8FE6F22A9D179D1D58A0C9063" be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" zxwxesqaxf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" zxwxesqaxf.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FF8A482A851A9146D72F7E9CBC93E13C594B66466336D79F" be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat zxwxesqaxf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc zxwxesqaxf.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2260 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2932 hcipslwvqfmvlab.exe 2932 hcipslwvqfmvlab.exe 2932 hcipslwvqfmvlab.exe 2932 hcipslwvqfmvlab.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2780 vjwqsyko.exe 2780 vjwqsyko.exe 2780 vjwqsyko.exe 2780 vjwqsyko.exe 2952 zxwxesqaxf.exe 2952 zxwxesqaxf.exe 2952 zxwxesqaxf.exe 2952 zxwxesqaxf.exe 2952 zxwxesqaxf.exe 1624 vjwqsyko.exe 1624 vjwqsyko.exe 1624 vjwqsyko.exe 1624 vjwqsyko.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 2932 hcipslwvqfmvlab.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2932 hcipslwvqfmvlab.exe 2952 zxwxesqaxf.exe 2780 vjwqsyko.exe 2636 xmjkghyunlqhk.exe 2952 zxwxesqaxf.exe 2780 vjwqsyko.exe 2932 hcipslwvqfmvlab.exe 2952 zxwxesqaxf.exe 2780 vjwqsyko.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 1624 vjwqsyko.exe 1624 vjwqsyko.exe 1624 vjwqsyko.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 2932 hcipslwvqfmvlab.exe 2952 zxwxesqaxf.exe 2780 vjwqsyko.exe 2636 xmjkghyunlqhk.exe 2952 zxwxesqaxf.exe 2780 vjwqsyko.exe 2932 hcipslwvqfmvlab.exe 2952 zxwxesqaxf.exe 2780 vjwqsyko.exe 2932 hcipslwvqfmvlab.exe 2636 xmjkghyunlqhk.exe 2636 xmjkghyunlqhk.exe 1624 vjwqsyko.exe 1624 vjwqsyko.exe 1624 vjwqsyko.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2260 WINWORD.EXE 2260 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2952 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2952 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2952 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2952 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2932 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 31 PID 2396 wrote to memory of 2932 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 31 PID 2396 wrote to memory of 2932 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 31 PID 2396 wrote to memory of 2932 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 31 PID 2396 wrote to memory of 2780 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 32 PID 2396 wrote to memory of 2780 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 32 PID 2396 wrote to memory of 2780 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 32 PID 2396 wrote to memory of 2780 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 32 PID 2396 wrote to memory of 2636 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 33 PID 2396 wrote to memory of 2636 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 33 PID 2396 wrote to memory of 2636 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 33 PID 2396 wrote to memory of 2636 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 33 PID 2396 wrote to memory of 2260 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 34 PID 2396 wrote to memory of 2260 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 34 PID 2396 wrote to memory of 2260 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 34 PID 2396 wrote to memory of 2260 2396 be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe 34 PID 2952 wrote to memory of 1624 2952 zxwxesqaxf.exe 35 PID 2952 wrote to memory of 1624 2952 zxwxesqaxf.exe 35 PID 2952 wrote to memory of 1624 2952 zxwxesqaxf.exe 35 PID 2952 wrote to memory of 1624 2952 zxwxesqaxf.exe 35 PID 2260 wrote to memory of 2028 2260 WINWORD.EXE 37 PID 2260 wrote to memory of 2028 2260 WINWORD.EXE 37 PID 2260 wrote to memory of 2028 2260 WINWORD.EXE 37 PID 2260 wrote to memory of 2028 2260 WINWORD.EXE 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\be8cc6cd32e6a241ea36bb7edf55a80c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\zxwxesqaxf.exezxwxesqaxf.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\vjwqsyko.exeC:\Windows\system32\vjwqsyko.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1624
-
-
-
C:\Windows\SysWOW64\hcipslwvqfmvlab.exehcipslwvqfmvlab.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2932
-
-
C:\Windows\SysWOW64\vjwqsyko.exevjwqsyko.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2780
-
-
C:\Windows\SysWOW64\xmjkghyunlqhk.exexmjkghyunlqhk.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2636
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2028
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD59896b83f92bdc6cdf0821b10b180a19e
SHA16211b0e1fca23d34de149ec076257a63c4f928a9
SHA25656a81b12fd86cad9b019955a81c41a91b679a16a586f2849af553deafb77ccc6
SHA512cf6020c125bd29dfec8aece7f3b5b74ba722b766d77597eabc429ccf0807cf0b7393af07b55482b601b00feac04ab4f70abcd9891e0894956b82cd49ee4ff78d
-
Filesize
512KB
MD58971180673d4f3911d523eb52d810e02
SHA16e7424800f83191b6790d5c95dec278affa14f90
SHA256de57ae2be20bbf7ac8009b734300b65e2040c751f59f8230d701704faa546ff9
SHA512933ccecc223fc38a5b2f60cb0434c309fe2948bd0849973993473f7084ef9e11d7587e6e201e21ccdaabc650a77d689543a161b8a134e880f1310e4398abda9d
-
Filesize
316B
MD50d7a078858d87770e3dd017437a87806
SHA1b0c361a1b21a0e7a06a1d3fe8ae9651457191108
SHA256d2fde6e5b3a8385aa4763ec902f52edd301ef8a918c55b07baf91dcaba7936ed
SHA512a87efb781405c1c7d3444b18fb060e0f41b028023237498ad3cff032c9334ab0193fa4a6ebb903b46d1adcb234e6ea5f43be2a943a55fa2695f1ce36eded7355
-
Filesize
19KB
MD57d6732221d1816cba951572040c44442
SHA16bfb6358123cf6fa553831999df544b02e7d1557
SHA256c5a275890389aedb0a853dbb71af640b95475a09316da42376eb9005a675654f
SHA51233aef71b276d4ddb43ad4d05021230e57cc8bc423837bd436c35d92b04ec0263208fae53ca52b6848e41d514db571e54636f314e510b20d707dafad40917ac18
-
Filesize
512KB
MD5ea718990234d5e12216e2808809ad113
SHA102a2d9194252784ee2e351470c25b4301b9a7a2d
SHA256db87ace2711acbb253a1b4c3310770fafe7cf6c0aae0e1828a66c52ec84121f9
SHA51225ace1e495b28bc8909237fa33092ab4c43cc31e4c951c0b80129359f708f1b5206128accc6d8f360d8264298532e6a716db1fdd47a736c09f7b89e9131a8dea
-
Filesize
512KB
MD57cdd70b353f4a407ea253dc121124b3a
SHA1aac191d309cc34da5acd396e9ea5fb0c7c551368
SHA2560a69a4ba8a6dcf6f82d54606a56fb59ad03cfd877ccbfa3357a79779bdf0b69f
SHA512c3147564fb995de21e94cae85b415435972f3e60d41cbfc6d371dc3baf11812c0b3cbf0bb0d9440b735091cae81bc7b2905b0b59270a1c153217c3060a50d9f1
-
Filesize
512KB
MD52c744308145d2f2db7491316c7796e1a
SHA165e285f176aeb7db2c33763243c14db0eb7cccd1
SHA2568b1201725fd41d610dff348d82ae4fbace4f8c7e54c3973e53e5d027c5bfa56e
SHA5125583f02575988da4dc3245e96fff85c5fd57fcd83eccd8ea3a6dafaa341c5d6e0fdc192d9f693eec52d48a01db782c52bd37d10a851ead9c95a2a4270d7b7172
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5f42b6294f4bf3e1c6d0c5a3a9a9b9392
SHA1fcb8ce6bba7d27b5bd3938522f43a862331566ac
SHA256bae27bcf03cf21d06189a962433a9a8f53ac04cb1d0e449e7b0cbe6d059544a1
SHA51230c722b23521fa65814d5eb90db461e9753edd0ad43cb52af8acb38433b7b74fe6f6136d293be958fef9f7a191c990faa4acf8c9231c16a1295037a0c63c3ecf
-
Filesize
512KB
MD50aeaa41a2f89af456773d835662e054c
SHA1e438d5547458912a098d688951ee6c80b01b533a
SHA256b813328cdf711477b562dbd45910386d0a79a0d30b0f9ebbfdad61512a990ccd
SHA512e432a128d29e2725053d7d5b979e43c4488798537ea69915e6f902e7b33cbd146dfcfea61d0ec47e0e0fed53a607277c29dfef0fa0ba2d0596bb6554da2bb338
-
Filesize
512KB
MD553cba235bd5412ee4f978b3d80d524a5
SHA15a21a87486994951aa37affcd3ea01e66384dec6
SHA2565c29a33787c9b20a4d21a07e5b92e986124dff542040a9c9aab7cd87f4929aff
SHA5120f286b31ffd159ab998020b03138d9e272dfd21d6c735da380be4ea4b0483a3689ff3073cf4d343f2001e554eaee901c197d3c81831b55956b12443472ad15bd