Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 03:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
25 signatures
150 seconds
General
-
Target
eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe
-
Size
512KB
-
MD5
eccbf884c07fbcb4bca01da23b37fc7c
-
SHA1
2089fcaed9844fe8e99ca91b4125176f425a23fb
-
SHA256
f0e56e43e1e13274643bbf83eac6e2c109d9564e395fe8a89bb5732a00ec6271
-
SHA512
21b7ebee3acea2405bd35eb974af38084590fde0e48241818faa75843f7f702508273eb1b9e1cb0d3fce611e100b001acf34cd91b2a9572fde70150316640dcd
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" nmvifryviw.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nmvifryviw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" nmvifryviw.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nmvifryviw.exe -
Executes dropped EXE 5 IoCs
pid Process 2408 nmvifryviw.exe 2916 ufkzqmucumtvhxq.exe 584 lmesmklv.exe 2808 ozwksogefqcng.exe 2964 lmesmklv.exe -
Loads dropped DLL 5 IoCs
pid Process 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2408 nmvifryviw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nmvifryviw.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ozwksogefqcng.exe" ufkzqmucumtvhxq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xishbifx = "nmvifryviw.exe" ufkzqmucumtvhxq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yiceehdg = "ufkzqmucumtvhxq.exe" ufkzqmucumtvhxq.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: lmesmklv.exe File opened (read-only) \??\t: lmesmklv.exe File opened (read-only) \??\b: lmesmklv.exe File opened (read-only) \??\o: lmesmklv.exe File opened (read-only) \??\z: nmvifryviw.exe File opened (read-only) \??\y: lmesmklv.exe File opened (read-only) \??\q: lmesmklv.exe File opened (read-only) \??\k: lmesmklv.exe File opened (read-only) \??\m: lmesmklv.exe File opened (read-only) \??\g: nmvifryviw.exe File opened (read-only) \??\j: nmvifryviw.exe File opened (read-only) \??\q: nmvifryviw.exe File opened (read-only) \??\x: nmvifryviw.exe File opened (read-only) \??\t: nmvifryviw.exe File opened (read-only) \??\p: lmesmklv.exe File opened (read-only) \??\g: lmesmklv.exe File opened (read-only) \??\s: lmesmklv.exe File opened (read-only) \??\h: lmesmklv.exe File opened (read-only) \??\m: nmvifryviw.exe File opened (read-only) \??\v: nmvifryviw.exe File opened (read-only) \??\u: lmesmklv.exe File opened (read-only) \??\a: lmesmklv.exe File opened (read-only) \??\z: lmesmklv.exe File opened (read-only) \??\i: nmvifryviw.exe File opened (read-only) \??\s: nmvifryviw.exe File opened (read-only) \??\y: nmvifryviw.exe File opened (read-only) \??\n: lmesmklv.exe File opened (read-only) \??\x: lmesmklv.exe File opened (read-only) \??\l: nmvifryviw.exe File opened (read-only) \??\n: lmesmklv.exe File opened (read-only) \??\o: lmesmklv.exe File opened (read-only) \??\w: lmesmklv.exe File opened (read-only) \??\u: nmvifryviw.exe File opened (read-only) \??\g: lmesmklv.exe File opened (read-only) \??\h: lmesmklv.exe File opened (read-only) \??\r: lmesmklv.exe File opened (read-only) \??\a: nmvifryviw.exe File opened (read-only) \??\h: nmvifryviw.exe File opened (read-only) \??\m: lmesmklv.exe File opened (read-only) \??\e: lmesmklv.exe File opened (read-only) \??\o: nmvifryviw.exe File opened (read-only) \??\r: lmesmklv.exe File opened (read-only) \??\t: lmesmklv.exe File opened (read-only) \??\u: lmesmklv.exe File opened (read-only) \??\r: nmvifryviw.exe File opened (read-only) \??\i: lmesmklv.exe File opened (read-only) \??\q: lmesmklv.exe File opened (read-only) \??\y: lmesmklv.exe File opened (read-only) \??\e: nmvifryviw.exe File opened (read-only) \??\b: lmesmklv.exe File opened (read-only) \??\z: lmesmklv.exe File opened (read-only) \??\l: lmesmklv.exe File opened (read-only) \??\j: lmesmklv.exe File opened (read-only) \??\b: nmvifryviw.exe File opened (read-only) \??\k: nmvifryviw.exe File opened (read-only) \??\p: nmvifryviw.exe File opened (read-only) \??\v: lmesmklv.exe File opened (read-only) \??\a: lmesmklv.exe File opened (read-only) \??\w: lmesmklv.exe File opened (read-only) \??\p: lmesmklv.exe File opened (read-only) \??\v: lmesmklv.exe File opened (read-only) \??\i: lmesmklv.exe File opened (read-only) \??\w: nmvifryviw.exe File opened (read-only) \??\l: lmesmklv.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" nmvifryviw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" nmvifryviw.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0009000000012286-20.dat autoit_exe behavioral1/files/0x000700000001660d-9.dat autoit_exe behavioral1/files/0x0008000000016398-21.dat autoit_exe behavioral1/files/0x0007000000016688-35.dat autoit_exe behavioral1/files/0x0006000000016dcf-71.dat autoit_exe behavioral1/files/0x0006000000016dd8-73.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\nmvifryviw.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lmesmklv.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll nmvifryviw.exe File created C:\Windows\SysWOW64\lmesmklv.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ozwksogefqcng.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ozwksogefqcng.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nmvifryviw.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ufkzqmucumtvhxq.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ufkzqmucumtvhxq.exe eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal lmesmklv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lmesmklv.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lmesmklv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal lmesmklv.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lmesmklv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal lmesmklv.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lmesmklv.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lmesmklv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lmesmklv.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lmesmklv.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lmesmklv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal lmesmklv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lmesmklv.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lmesmklv.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ozwksogefqcng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lmesmklv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ufkzqmucumtvhxq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nmvifryviw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lmesmklv.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C67815E1DABEB8C17C95EDE534CE" eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat nmvifryviw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg nmvifryviw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" nmvifryviw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFFAC9F966F293840E3B35819E3992B38A02F94213023FE1BD45E809D2" eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" nmvifryviw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" nmvifryviw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf nmvifryviw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" nmvifryviw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh nmvifryviw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc nmvifryviw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" nmvifryviw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342C0C9D5683566A4377D2772F2DD87D8765DE" eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B15C4792389A53BABAA03299D4B9" eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFEFC8D4F27851A9042D7287D92BD93E134584667446330D7EA" eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0866BC3FF6721D0D272D0A78A7F9062" eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" nmvifryviw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs nmvifryviw.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2908 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 584 lmesmklv.exe 584 lmesmklv.exe 584 lmesmklv.exe 584 lmesmklv.exe 2964 lmesmklv.exe 2964 lmesmklv.exe 2964 lmesmklv.exe 2964 lmesmklv.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2916 ufkzqmucumtvhxq.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 584 lmesmklv.exe 584 lmesmklv.exe 584 lmesmklv.exe 2964 lmesmklv.exe 2964 lmesmklv.exe 2964 lmesmklv.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2916 ufkzqmucumtvhxq.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2408 nmvifryviw.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 2808 ozwksogefqcng.exe 584 lmesmklv.exe 584 lmesmklv.exe 584 lmesmklv.exe 2964 lmesmklv.exe 2964 lmesmklv.exe 2964 lmesmklv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2908 WINWORD.EXE 2908 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2408 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2408 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2408 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2408 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2916 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 31 PID 2416 wrote to memory of 2916 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 31 PID 2416 wrote to memory of 2916 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 31 PID 2416 wrote to memory of 2916 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 31 PID 2416 wrote to memory of 584 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 32 PID 2416 wrote to memory of 584 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 32 PID 2416 wrote to memory of 584 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 32 PID 2416 wrote to memory of 584 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 32 PID 2416 wrote to memory of 2808 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 33 PID 2416 wrote to memory of 2808 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 33 PID 2416 wrote to memory of 2808 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 33 PID 2416 wrote to memory of 2808 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 33 PID 2408 wrote to memory of 2964 2408 nmvifryviw.exe 35 PID 2408 wrote to memory of 2964 2408 nmvifryviw.exe 35 PID 2408 wrote to memory of 2964 2408 nmvifryviw.exe 35 PID 2408 wrote to memory of 2964 2408 nmvifryviw.exe 35 PID 2416 wrote to memory of 2908 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 34 PID 2416 wrote to memory of 2908 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 34 PID 2416 wrote to memory of 2908 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 34 PID 2416 wrote to memory of 2908 2416 eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe 34 PID 2908 wrote to memory of 316 2908 WINWORD.EXE 38 PID 2908 wrote to memory of 316 2908 WINWORD.EXE 38 PID 2908 wrote to memory of 316 2908 WINWORD.EXE 38 PID 2908 wrote to memory of 316 2908 WINWORD.EXE 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eccbf884c07fbcb4bca01da23b37fc7c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\nmvifryviw.exenmvifryviw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\lmesmklv.exeC:\Windows\system32\lmesmklv.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2964
-
-
-
C:\Windows\SysWOW64\ufkzqmucumtvhxq.exeufkzqmucumtvhxq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2916
-
-
C:\Windows\SysWOW64\lmesmklv.exelmesmklv.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:584
-
-
C:\Windows\SysWOW64\ozwksogefqcng.exeozwksogefqcng.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2808
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:316
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5af1e8f1cb9c47711ee50abc29a283b39
SHA1c1add6ca88ebcc33c91b4227a750bd89a1a60a1b
SHA256d8535df1285bc8cb06d4dc6f0b8bda10abe9c353d7b7b9f1b9e924e1ec1559e5
SHA512029810590e0bb288268317aafdd7e01fc71092282b3b0d512c6aa348313ca6680442e21a8a62364575bebbeac4c8fa76a693c8717b36dbc31866b356c460ef0d
-
Filesize
512KB
MD5c0dd0504e17f0fe6dc1741a4b36d67bf
SHA134725342f85fc38876a4415316414e0b6373394a
SHA2566f074e77f31d9cd49ca316a4ed4aaa89af917822e07368702abd90a6e1940933
SHA512a10727927af0ebc82c2f1705c4b76ad721bec4f5a101c1fea52bba4a23ef1b872a416793b60c8bc396d139949f0def5d81dfaa1da53cf9a29a2864fa3f6b0d91
-
Filesize
386B
MD5e91567e5b167d6aa191de30da466d8aa
SHA195452fe319f3830604c4a78f0e3cff014622b2d9
SHA256494f370997f2c3337c7db76291159a55f26a6c96a9642273e7ceca948721dbfb
SHA5124536d70cf214f95758062d58c64106068d1b347b957a6f0db68259e9f9309451acdd9536e4c654ff7af9b2698df602e8cdcb154708c48735987f576b908d40a2
-
Filesize
19KB
MD57bcdad1affec686c623aec4b1f1aea4e
SHA183a7d17a13d94afadf1bf124df50dbec44f34063
SHA256b3d138f8bd167e2a79009485aef0835a8a465226d015dc4bdbda686fba625505
SHA5124784c4a54054f924f2396ee2ff1f6fb01618b95ca903a0dc466424d6c21a75f724b645533f1f6096683432aab5ace3a14c7147127529ed4420668c4eaf8d528b
-
Filesize
512KB
MD5dec5ad49435457d1d2d4ca7d4dd4c7c7
SHA1f2d21d6789739fdb1c83296c770a4d6667857bcb
SHA256caca13d330c1a5614cf9f99f64cc760893b68dacf3d04947a95f69b16278a6ba
SHA51205acf8d8a83dabc93bcf3291b640b12155313a3713eb33b96edf42215b2ae158faf720a81b30cda57fd87bfaee296956bce55d9d700f2b2accf921c30b7fe769
-
Filesize
512KB
MD58e59e30d9b9ec70372569e400fa0466f
SHA12733491013471da3db6234b3cff81720c378d76b
SHA256600876789b113c29443d79adf2a98a535eff04e732c953c7cec57e8b0f925c25
SHA512db2ac6f42cc3d605a0e01a550ee580376166288986cdeb5d7e18c27642dcb6101c58360e4a21dde1924fea50e4451260e5d59805fcd78fef5031a7392e7126ad
-
Filesize
512KB
MD50f0c96b4b87695abffeead32ba34cb8e
SHA15aee72e01e79c34c7c021b2da4bc85161546e696
SHA25637082cd01eb736347c100bae76605598a8718ab152eba438dc4920ff33e0924f
SHA512ceb794eb3319ac2d5a6f63376ca75a4a0561613a03ac4aad2dafe6f88806df1ab4cf0b84594faabcf0a359b7c35748021b902764fb94e225af35143816287999
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5785038154b71bd375cdc626320a21451
SHA14ca4149e7169121952939c0a9d27808dc6c6f015
SHA2564e86fc352defd70061e524c4a14b628f408040f205806335b534d950d9984596
SHA5129d1f8c3a7a267750a0fdf1ae9850f036c2af4597bb5c1341c1934f3b4d6b241544190f39e98afb8bb0f0b579d9f612f79611fed77f1c249f11be18df05dadec3