Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 22:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
25 signatures
150 seconds
General
-
Target
d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe
-
Size
512KB
-
MD5
d0901274aa7c321903124f1ad9096c69
-
SHA1
a54ef8d4ac46693775d0c4eb8dc79bef055d22be
-
SHA256
2d96443c35b8d0c00d70e6bc92bcd3d23ef4bfed55397b8957d0e126517da59b
-
SHA512
6c744c9e1c852bdc72029eeb78cb3ee931a646b487ca657c36e88f3c2efd0686809174be8c42906516e08fd45b012578ece6e8b2d2ff87e70ce906305b06b5ab
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tzgprkmzcw.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tzgprkmzcw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tzgprkmzcw.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tzgprkmzcw.exe -
Executes dropped EXE 5 IoCs
pid Process 2736 tzgprkmzcw.exe 2900 jsumvruwkvxybas.exe 2872 yemuiltw.exe 2696 kgbualpffaclp.exe 2980 yemuiltw.exe -
Loads dropped DLL 5 IoCs
pid Process 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2736 tzgprkmzcw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" tzgprkmzcw.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hvysfyre = "jsumvruwkvxybas.exe" jsumvruwkvxybas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kgbualpffaclp.exe" jsumvruwkvxybas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ljphwffs = "tzgprkmzcw.exe" jsumvruwkvxybas.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: yemuiltw.exe File opened (read-only) \??\o: tzgprkmzcw.exe File opened (read-only) \??\h: tzgprkmzcw.exe File opened (read-only) \??\p: tzgprkmzcw.exe File opened (read-only) \??\u: tzgprkmzcw.exe File opened (read-only) \??\h: yemuiltw.exe File opened (read-only) \??\e: tzgprkmzcw.exe File opened (read-only) \??\x: tzgprkmzcw.exe File opened (read-only) \??\n: yemuiltw.exe File opened (read-only) \??\o: yemuiltw.exe File opened (read-only) \??\v: yemuiltw.exe File opened (read-only) \??\s: tzgprkmzcw.exe File opened (read-only) \??\p: yemuiltw.exe File opened (read-only) \??\w: yemuiltw.exe File opened (read-only) \??\t: yemuiltw.exe File opened (read-only) \??\n: tzgprkmzcw.exe File opened (read-only) \??\v: yemuiltw.exe File opened (read-only) \??\k: yemuiltw.exe File opened (read-only) \??\a: yemuiltw.exe File opened (read-only) \??\a: yemuiltw.exe File opened (read-only) \??\x: yemuiltw.exe File opened (read-only) \??\e: yemuiltw.exe File opened (read-only) \??\u: yemuiltw.exe File opened (read-only) \??\w: tzgprkmzcw.exe File opened (read-only) \??\k: yemuiltw.exe File opened (read-only) \??\o: yemuiltw.exe File opened (read-only) \??\q: yemuiltw.exe File opened (read-only) \??\q: tzgprkmzcw.exe File opened (read-only) \??\y: yemuiltw.exe File opened (read-only) \??\h: yemuiltw.exe File opened (read-only) \??\n: yemuiltw.exe File opened (read-only) \??\q: yemuiltw.exe File opened (read-only) \??\l: tzgprkmzcw.exe File opened (read-only) \??\m: tzgprkmzcw.exe File opened (read-only) \??\t: tzgprkmzcw.exe File opened (read-only) \??\m: yemuiltw.exe File opened (read-only) \??\j: yemuiltw.exe File opened (read-only) \??\r: yemuiltw.exe File opened (read-only) \??\i: tzgprkmzcw.exe File opened (read-only) \??\p: yemuiltw.exe File opened (read-only) \??\l: yemuiltw.exe File opened (read-only) \??\v: tzgprkmzcw.exe File opened (read-only) \??\t: yemuiltw.exe File opened (read-only) \??\w: yemuiltw.exe File opened (read-only) \??\k: tzgprkmzcw.exe File opened (read-only) \??\j: tzgprkmzcw.exe File opened (read-only) \??\r: tzgprkmzcw.exe File opened (read-only) \??\z: tzgprkmzcw.exe File opened (read-only) \??\i: yemuiltw.exe File opened (read-only) \??\j: yemuiltw.exe File opened (read-only) \??\r: yemuiltw.exe File opened (read-only) \??\l: yemuiltw.exe File opened (read-only) \??\a: tzgprkmzcw.exe File opened (read-only) \??\s: yemuiltw.exe File opened (read-only) \??\m: yemuiltw.exe File opened (read-only) \??\e: yemuiltw.exe File opened (read-only) \??\z: yemuiltw.exe File opened (read-only) \??\g: yemuiltw.exe File opened (read-only) \??\i: yemuiltw.exe File opened (read-only) \??\y: yemuiltw.exe File opened (read-only) \??\g: tzgprkmzcw.exe File opened (read-only) \??\g: yemuiltw.exe File opened (read-only) \??\b: yemuiltw.exe File opened (read-only) \??\x: yemuiltw.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tzgprkmzcw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tzgprkmzcw.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2652-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0007000000016d31-9.dat autoit_exe behavioral1/files/0x000900000001683c-17.dat autoit_exe behavioral1/files/0x0007000000016d29-25.dat autoit_exe behavioral1/files/0x0007000000016d45-37.dat autoit_exe behavioral1/files/0x00050000000193f7-66.dat autoit_exe behavioral1/files/0x000500000001949e-72.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\tzgprkmzcw.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tzgprkmzcw.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File created C:\Windows\SysWOW64\jsumvruwkvxybas.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yemuiltw.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File created C:\Windows\SysWOW64\kgbualpffaclp.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kgbualpffaclp.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tzgprkmzcw.exe File opened for modification C:\Windows\SysWOW64\jsumvruwkvxybas.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File created C:\Windows\SysWOW64\yemuiltw.exe d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal yemuiltw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe yemuiltw.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe yemuiltw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe yemuiltw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe yemuiltw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe yemuiltw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe yemuiltw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe yemuiltw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal yemuiltw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe yemuiltw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal yemuiltw.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe yemuiltw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe yemuiltw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal yemuiltw.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jsumvruwkvxybas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yemuiltw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kgbualpffaclp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yemuiltw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tzgprkmzcw.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472D0D9C5582246D3E76A270542DAD7DF665DE" d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tzgprkmzcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tzgprkmzcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tzgprkmzcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFF9CEFE13F194840F3A43819E3E96B0FB038B4260024BE1CC429A09A9" d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC2B12F47E3389853BEBAA533EAD4BE" d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFFFB485D826D9140D72B7E95BD92E134594667446332D6EB" d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C70C1490DBC3B8B97F92ECE734CC" d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tzgprkmzcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tzgprkmzcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tzgprkmzcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tzgprkmzcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tzgprkmzcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tzgprkmzcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tzgprkmzcw.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FD6BC6FF1F21D0D10ED0A88A7F9010" d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tzgprkmzcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tzgprkmzcw.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1396 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2872 yemuiltw.exe 2872 yemuiltw.exe 2872 yemuiltw.exe 2872 yemuiltw.exe 2980 yemuiltw.exe 2980 yemuiltw.exe 2980 yemuiltw.exe 2980 yemuiltw.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2900 jsumvruwkvxybas.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2696 kgbualpffaclp.exe 2872 yemuiltw.exe 2872 yemuiltw.exe 2872 yemuiltw.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2980 yemuiltw.exe 2980 yemuiltw.exe 2980 yemuiltw.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2900 jsumvruwkvxybas.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2736 tzgprkmzcw.exe 2696 kgbualpffaclp.exe 2872 yemuiltw.exe 2872 yemuiltw.exe 2872 yemuiltw.exe 2696 kgbualpffaclp.exe 2696 kgbualpffaclp.exe 2980 yemuiltw.exe 2980 yemuiltw.exe 2980 yemuiltw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1396 WINWORD.EXE 1396 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2736 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 31 PID 2652 wrote to memory of 2736 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 31 PID 2652 wrote to memory of 2736 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 31 PID 2652 wrote to memory of 2736 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 31 PID 2652 wrote to memory of 2900 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 32 PID 2652 wrote to memory of 2900 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 32 PID 2652 wrote to memory of 2900 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 32 PID 2652 wrote to memory of 2900 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 32 PID 2652 wrote to memory of 2872 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 33 PID 2652 wrote to memory of 2872 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 33 PID 2652 wrote to memory of 2872 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 33 PID 2652 wrote to memory of 2872 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 33 PID 2652 wrote to memory of 2696 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 34 PID 2652 wrote to memory of 2696 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 34 PID 2652 wrote to memory of 2696 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 34 PID 2652 wrote to memory of 2696 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 34 PID 2736 wrote to memory of 2980 2736 tzgprkmzcw.exe 35 PID 2736 wrote to memory of 2980 2736 tzgprkmzcw.exe 35 PID 2736 wrote to memory of 2980 2736 tzgprkmzcw.exe 35 PID 2736 wrote to memory of 2980 2736 tzgprkmzcw.exe 35 PID 2652 wrote to memory of 1396 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 36 PID 2652 wrote to memory of 1396 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 36 PID 2652 wrote to memory of 1396 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 36 PID 2652 wrote to memory of 1396 2652 d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe 36 PID 1396 wrote to memory of 2384 1396 WINWORD.EXE 38 PID 1396 wrote to memory of 2384 1396 WINWORD.EXE 38 PID 1396 wrote to memory of 2384 1396 WINWORD.EXE 38 PID 1396 wrote to memory of 2384 1396 WINWORD.EXE 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0901274aa7c321903124f1ad9096c69_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\tzgprkmzcw.exetzgprkmzcw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\yemuiltw.exeC:\Windows\system32\yemuiltw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2980
-
-
-
C:\Windows\SysWOW64\jsumvruwkvxybas.exejsumvruwkvxybas.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2900
-
-
C:\Windows\SysWOW64\yemuiltw.exeyemuiltw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2872
-
-
C:\Windows\SysWOW64\kgbualpffaclp.exekgbualpffaclp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2696
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2384
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5269fd07c7190eac47e41705648182a1f
SHA13f467e55d1a47761dc48cbf06dd607f10df05dd4
SHA2562ee5b98674d245c0c0aa172097441c3c4250b801f3399722c89c140372f0c770
SHA512704a4bf37e47c72ba8b8c7dc6d4d9fa27d82c90566eeff2459ef9e78e8caba8fd5b38d96080f4bbdb5f95f6dcdf3d088a1e85f65300de7939e967247c69521ac
-
Filesize
512KB
MD5b379ba36f869ab7a8568d397ce752904
SHA15ce57733e1363c3491ef9773569a3ce97f84cc3f
SHA256af1f29b9a4127de7c91a185b6053f39b2bbe8ac5bb9cd9f20fb4850b341c5c83
SHA51213b6c8c228987e770f7ed7e87029ea57dd1f8843935f00bf2f0587e2b5c25a0f5ccc63f648d843481af39d0fe176c3ef9f8746f7b6709660beb440a0b64b6fb9
-
Filesize
19KB
MD500c9b4bc75e186d1abd98e36809ef986
SHA19ca7b48ac0d7d7998948c6842c9b2aa2dd1c34a6
SHA256e57786fee9766f301b01b1b0979169fb2e9cb59ff83d74c3f9d2a6ce1a03a038
SHA512ab9848300d1130d0b2895b8fd2f50bb8d6bbe2179a655339ec7cf38a5991d0568729f254eb2879c24a76a98b5dca8e56182be98f3af5e92d4ac582e52fb1b2e4
-
Filesize
512KB
MD57b1d3bdba3adf7e19e3a858ff75a7ac5
SHA1f559c682f1cc3b9ded3f4637504695906ae713e2
SHA2565e01ab2a2ab52a7274aac42a5988cb7f5f7b8ec06f7fc69fae13a40e7d44fe1c
SHA512ddc17cc6522413b68517547520e39bf908d1050110c681cefb5a348df9f7f3f6915141821e4b12261b8a269320c9f41d90965608126244ac78bdd9db56b4b0b2
-
Filesize
512KB
MD597ec2e847c87706640d4941aecb9b202
SHA114ed763e34867f98ff0c9e9222b081d28d8c5f6f
SHA256b7416908a2a51255f0ca3b8ddd8e8fe94a741e95c92c115f95c02f7223597d69
SHA5120a520da1f60c62529ebfeba8fe7743466f3936db05b1c13d3d25ccbad8e2a8393b9d7c3d21bcfb96c0cedac3ff9c2e3cc8f6cbb413b4d71229c3034649a350ee
-
Filesize
512KB
MD59cbb193b5e5693045a6dada18f94eeb6
SHA16074f43ac6c75ed997a8ed8ae3b0ae8775cb73d5
SHA256f55da5eaf2a5756adea8e46dfa90104ca6a4d4eb160d8e03364b8776699754a5
SHA512b0481dbef5965e089fbaea363f5c00496daf1c2a650663bc70bdd0249a4b0cdfad6065c1594b57b0c12c55ea1ffbdf744931b21fdb4f94000360fcf74c212dbb
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD547032e0cf91a61b4f3ef681eff0fbe0a
SHA10f3d813ea2ea12374e391b590eed0654f9a4b9bb
SHA2563fd11ff07be6d7a1ff548f26a556e710fbc406e2d79197baffac30cc2bdf2528
SHA512786ec633233aca5b89e203acdf842b8484accf99834c09e66856ba1d2ac7122dce22b6e212cfc25b3edd4309d1969b31e1a1ed32afe616e8d76c5a1fc3197ab4