Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 10:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
25 signatures
150 seconds
General
-
Target
d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe
-
Size
512KB
-
MD5
d1b632acb8299cbf118409ac37fbf4e6
-
SHA1
1c345f2734f89acfab9dd133eca74098a063287e
-
SHA256
6d1365bfdacd234e776a85cca76185e107b69565d65be9144b78be44baa0f47f
-
SHA512
d17bf731cb98686e3a021421460edab03a18b896a51e31ca5ad5637486c354deb6be04e2832c7d34a8a7dd2d5c3ca158a9baf7974734ec6fb093db34caee6d61
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" upnetarrei.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" upnetarrei.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" upnetarrei.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" upnetarrei.exe -
Executes dropped EXE 5 IoCs
pid Process 2952 upnetarrei.exe 2980 yzikyauwmrijogj.exe 2832 tlebglqo.exe 3020 oiukviwuexgla.exe 2760 tlebglqo.exe -
Loads dropped DLL 5 IoCs
pid Process 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 2952 upnetarrei.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" upnetarrei.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rlfbmlzv = "upnetarrei.exe" yzikyauwmrijogj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\drexjluw = "yzikyauwmrijogj.exe" yzikyauwmrijogj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "oiukviwuexgla.exe" yzikyauwmrijogj.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: tlebglqo.exe File opened (read-only) \??\q: tlebglqo.exe File opened (read-only) \??\x: tlebglqo.exe File opened (read-only) \??\h: tlebglqo.exe File opened (read-only) \??\i: tlebglqo.exe File opened (read-only) \??\m: tlebglqo.exe File opened (read-only) \??\r: tlebglqo.exe File opened (read-only) \??\v: tlebglqo.exe File opened (read-only) \??\t: upnetarrei.exe File opened (read-only) \??\x: upnetarrei.exe File opened (read-only) \??\k: tlebglqo.exe File opened (read-only) \??\i: upnetarrei.exe File opened (read-only) \??\j: upnetarrei.exe File opened (read-only) \??\b: tlebglqo.exe File opened (read-only) \??\p: upnetarrei.exe File opened (read-only) \??\s: upnetarrei.exe File opened (read-only) \??\t: tlebglqo.exe File opened (read-only) \??\v: tlebglqo.exe File opened (read-only) \??\e: upnetarrei.exe File opened (read-only) \??\v: upnetarrei.exe File opened (read-only) \??\y: upnetarrei.exe File opened (read-only) \??\b: tlebglqo.exe File opened (read-only) \??\u: tlebglqo.exe File opened (read-only) \??\r: upnetarrei.exe File opened (read-only) \??\w: tlebglqo.exe File opened (read-only) \??\z: tlebglqo.exe File opened (read-only) \??\j: tlebglqo.exe File opened (read-only) \??\l: tlebglqo.exe File opened (read-only) \??\n: tlebglqo.exe File opened (read-only) \??\u: tlebglqo.exe File opened (read-only) \??\n: upnetarrei.exe File opened (read-only) \??\q: upnetarrei.exe File opened (read-only) \??\w: upnetarrei.exe File opened (read-only) \??\g: upnetarrei.exe File opened (read-only) \??\u: upnetarrei.exe File opened (read-only) \??\l: tlebglqo.exe File opened (read-only) \??\q: tlebglqo.exe File opened (read-only) \??\z: tlebglqo.exe File opened (read-only) \??\o: upnetarrei.exe File opened (read-only) \??\h: tlebglqo.exe File opened (read-only) \??\o: tlebglqo.exe File opened (read-only) \??\e: tlebglqo.exe File opened (read-only) \??\j: tlebglqo.exe File opened (read-only) \??\h: upnetarrei.exe File opened (read-only) \??\a: tlebglqo.exe File opened (read-only) \??\s: tlebglqo.exe File opened (read-only) \??\a: tlebglqo.exe File opened (read-only) \??\k: tlebglqo.exe File opened (read-only) \??\x: tlebglqo.exe File opened (read-only) \??\z: upnetarrei.exe File opened (read-only) \??\r: tlebglqo.exe File opened (read-only) \??\w: tlebglqo.exe File opened (read-only) \??\g: tlebglqo.exe File opened (read-only) \??\i: tlebglqo.exe File opened (read-only) \??\y: tlebglqo.exe File opened (read-only) \??\b: upnetarrei.exe File opened (read-only) \??\k: upnetarrei.exe File opened (read-only) \??\l: upnetarrei.exe File opened (read-only) \??\m: upnetarrei.exe File opened (read-only) \??\g: tlebglqo.exe File opened (read-only) \??\s: tlebglqo.exe File opened (read-only) \??\y: tlebglqo.exe File opened (read-only) \??\e: tlebglqo.exe File opened (read-only) \??\m: tlebglqo.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" upnetarrei.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" upnetarrei.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1172-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0007000000019608-5.dat autoit_exe behavioral1/files/0x00080000000120fd-17.dat autoit_exe behavioral1/files/0x000700000001960a-28.dat autoit_exe behavioral1/files/0x000700000001961c-34.dat autoit_exe behavioral1/files/0x0007000000015c88-62.dat autoit_exe behavioral1/files/0x002e000000019604-73.dat autoit_exe behavioral1/files/0x00060000000196a1-77.dat autoit_exe behavioral1/files/0x000500000001a4c7-87.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\upnetarrei.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File created C:\Windows\SysWOW64\yzikyauwmrijogj.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yzikyauwmrijogj.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File created C:\Windows\SysWOW64\oiukviwuexgla.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\oiukviwuexgla.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll upnetarrei.exe File opened for modification C:\Windows\SysWOW64\upnetarrei.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tlebglqo.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tlebglqo.exe d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification \??\c:\Program Files\SearchUse.doc.exe tlebglqo.exe File opened for modification C:\Program Files\SearchUse.doc.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal tlebglqo.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal tlebglqo.exe File created \??\c:\Program Files\SearchUse.doc.exe tlebglqo.exe File opened for modification C:\Program Files\SearchUse.doc.exe tlebglqo.exe File opened for modification C:\Program Files\SearchUse.nal tlebglqo.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tlebglqo.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal tlebglqo.exe File opened for modification \??\c:\Program Files\SearchUse.doc.exe tlebglqo.exe File opened for modification C:\Program Files\SearchUse.nal tlebglqo.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal tlebglqo.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tlebglqo.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tlebglqo.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tlebglqo.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language upnetarrei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yzikyauwmrijogj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlebglqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oiukviwuexgla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlebglqo.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFEFF8E4F5C851A9045D72E7E92BC93E137583067406332D7EC" d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1844C70815E7DBB3B8CE7CE8ECE237CE" d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat upnetarrei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh upnetarrei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" upnetarrei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf upnetarrei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" upnetarrei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462D789C2783236D4176D177242DDC7DF464AB" d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" upnetarrei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs upnetarrei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" upnetarrei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB0B15F4792399953C9BAA533EDD7C9" d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCF9BEF964F19284793B40819E3E96B0F9038F43610333E1B842E708A0" d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" upnetarrei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc upnetarrei.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" upnetarrei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg upnetarrei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F36BB9FE1D21DAD27DD0A28B089017" d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2736 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2832 tlebglqo.exe 2832 tlebglqo.exe 2832 tlebglqo.exe 2832 tlebglqo.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2760 tlebglqo.exe 2760 tlebglqo.exe 2760 tlebglqo.exe 2760 tlebglqo.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2980 yzikyauwmrijogj.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2832 tlebglqo.exe 2832 tlebglqo.exe 2832 tlebglqo.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2760 tlebglqo.exe 2760 tlebglqo.exe 2760 tlebglqo.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2952 upnetarrei.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2980 yzikyauwmrijogj.exe 2832 tlebglqo.exe 2832 tlebglqo.exe 2832 tlebglqo.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 3020 oiukviwuexgla.exe 2760 tlebglqo.exe 2760 tlebglqo.exe 2760 tlebglqo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2736 WINWORD.EXE 2736 WINWORD.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1172 wrote to memory of 2952 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 30 PID 1172 wrote to memory of 2952 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 30 PID 1172 wrote to memory of 2952 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 30 PID 1172 wrote to memory of 2952 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 30 PID 1172 wrote to memory of 2980 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 31 PID 1172 wrote to memory of 2980 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 31 PID 1172 wrote to memory of 2980 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 31 PID 1172 wrote to memory of 2980 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 31 PID 1172 wrote to memory of 2832 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 32 PID 1172 wrote to memory of 2832 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 32 PID 1172 wrote to memory of 2832 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 32 PID 1172 wrote to memory of 2832 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 32 PID 1172 wrote to memory of 3020 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 33 PID 1172 wrote to memory of 3020 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 33 PID 1172 wrote to memory of 3020 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 33 PID 1172 wrote to memory of 3020 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 33 PID 2980 wrote to memory of 2796 2980 yzikyauwmrijogj.exe 34 PID 2980 wrote to memory of 2796 2980 yzikyauwmrijogj.exe 34 PID 2980 wrote to memory of 2796 2980 yzikyauwmrijogj.exe 34 PID 2980 wrote to memory of 2796 2980 yzikyauwmrijogj.exe 34 PID 2952 wrote to memory of 2760 2952 upnetarrei.exe 36 PID 2952 wrote to memory of 2760 2952 upnetarrei.exe 36 PID 2952 wrote to memory of 2760 2952 upnetarrei.exe 36 PID 2952 wrote to memory of 2760 2952 upnetarrei.exe 36 PID 1172 wrote to memory of 2736 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 37 PID 1172 wrote to memory of 2736 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 37 PID 1172 wrote to memory of 2736 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 37 PID 1172 wrote to memory of 2736 1172 d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe 37 PID 2736 wrote to memory of 1960 2736 WINWORD.EXE 39 PID 2736 wrote to memory of 1960 2736 WINWORD.EXE 39 PID 2736 wrote to memory of 1960 2736 WINWORD.EXE 39 PID 2736 wrote to memory of 1960 2736 WINWORD.EXE 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1b632acb8299cbf118409ac37fbf4e6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\upnetarrei.exeupnetarrei.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\tlebglqo.exeC:\Windows\system32\tlebglqo.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760
-
-
-
C:\Windows\SysWOW64\yzikyauwmrijogj.exeyzikyauwmrijogj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.execmd.exe /c oiukviwuexgla.exe3⤵PID:2796
-
-
-
C:\Windows\SysWOW64\tlebglqo.exetlebglqo.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2832
-
-
C:\Windows\SysWOW64\oiukviwuexgla.exeoiukviwuexgla.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3020
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1960
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD57f2a5418467cb24a3882239e377546f2
SHA1d4e60f35b1798f9cca911fc38419fc24add1a833
SHA2568f70c62e531faceb3d6c2aeba38373066c0b643142c7d2a72e7b807faac5a08c
SHA512b512f619c517894b9d63e5ee5b1ea88ed804e2098538eaf39108d16025ab4e8d8709201c8856d6880484886bd298405c97e267d051d035215b828e8e1b7bc35a
-
Filesize
512KB
MD56a1fcae75fd7cc66f7a7cc61cccb752b
SHA1d6e800f89aefdd8251cdfb41b42f2fed7acfee12
SHA256983a641dfd4165fe5412e2a82a9ac07dbaf823a45b5b0632947c292bcbb0b934
SHA5121062361acd499bed1aeb0f43025fb74ffcff8e3e3cede4c874cee3be1bdce40596a219fa00e50483dab83ffe4de32c0857c4595f72e604103f2391d8baa8ad0a
-
Filesize
19KB
MD574cbd03ba735821cc2f80df564b58933
SHA1e8a3e729f94728d334daa4f0d699af741b95cc2d
SHA2569d0385cbbf93c2557b38673b8803a4a6e0e004800b5673d765ba9734783a8a1d
SHA5129057219bb029b4ef6dd8520435f0112ce7356d57c0229d59931840d25a055dfbc9f1d0acac1b3f4f4991821fb91d21790feadcd170602b3dcbe980d6ddbb0683
-
Filesize
512KB
MD5b41ec04123b39639d5dd89d0806ac3b5
SHA1019312cc33f5acd801b48bfdd6989ad51afa551e
SHA2563b7acb8dd842424a121df2c465699739fb11f427c043082900805530d9f6fd89
SHA5123a0be1c18d5ebfa0b8435b0d051d353f15fd8044fcd55cda149bfd6b70aa50396e91e36b96f6443377133b32d7d4f90eb78826fd8bf4d099b76fe3cc950b8dad
-
Filesize
512KB
MD5a702d4409cea52c639a759b41ddff05f
SHA16f80e10c469157bd3daab9d634769fb8921535ef
SHA256dc195cabdd73d3772137bac16af34de0a211df95123ca28a1b3120aad846b3bc
SHA51209dbc02078722731b5fcdf95c3e854d94908cb365de9d8081615680808e64391bdaeafe211ff577b1b37681cf1c9fab5595d2fbe823bb2c86d0527e427258e4b
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5ab73d50e873ac6d476989634cd5f279d
SHA1c8e266e93475b2365a1ad942316e8ad4dc0f23bf
SHA25680613ddf73230456a0bd47476d56975a6befed65b61efc5a5fa7d75cb3a7968c
SHA51230ff1b59eba3c326aa948d6a414cf6b69cde18b5153ded791feb054a5ef0cc2b5bf71be41493f9bc00a9e259edddaa1eecdbc82c1eab2b2d24c9ff2ff10020e9
-
Filesize
512KB
MD51cacedd7f614a9b4a6f59b7c09c613ec
SHA1c26dd57962ca5dd498d6e119308c1151431768c9
SHA256a569ec371d67ade9cfd636672f5aa3a157db3702de06092b7727f599ce62dd47
SHA512522bb705fefc0a8aba74cf7eec05c4b6bb20fba83d2dd692568cc3499806c21f52a67d215a2f94beccf93b166f46ab53f4e74e636c16d410d4a87f517c7b625a
-
Filesize
512KB
MD590b9b4d63af83dc9c73faf399e8bdcf7
SHA156239417a80e9dcc0f9af78fa6e29a26dcb3877c
SHA256475c4b8666418e3f3f8ffdce472993965e344dee573f6645dbdf611dd7d3126b
SHA5126a25f7e26c3e012610274faa483b05f8181817ef894e451e9102be324896c514d18fd79c08c436f9a63e5a8cd5ac85f9029d4173aa64f3a7c64870001be792fa
-
Filesize
512KB
MD599a2a16e0009a97ae4208c3bef030843
SHA1cdfa424470d89f15bacd37f13260886a13e16d6d
SHA25615bdbe4bf19e6a84e85a7f50cdb829e74259a4031bbfb0d2b133dc6cf6e9a474
SHA512ca939cc2623c16bd3728657242b32584d3a139b060632e4b5df601348ab9255e74a3fb97d2b56fa9d9924cca2a945813e45117918942f4291bdd2df142077576