Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 12:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
General
-
Target
ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe
-
Size
512KB
-
MD5
ed954ed4772590e21477fed8d7430984
-
SHA1
93021b6d923609738951745d7596f0b43569eeb2
-
SHA256
498a7f9e73fbeab214dd89907c272112d605d34afa7515075241536db6db1814
-
SHA512
0298560109e22f4d6e4e096033945091246d909859c595043ebd3d4ad27b2a1ea79e8170049b57cb74b496dc90fbc56bda2ccf3ffe3f5abdc54b7da954215256
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" zxmgwssyyb.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zxmgwssyyb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zxmgwssyyb.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zxmgwssyyb.exe -
Executes dropped EXE 5 IoCs
pid Process 2164 zxmgwssyyb.exe 2228 siuwxrqkqskzzva.exe 2696 tklvlvsw.exe 2840 gwmfarzlfmxoz.exe 2196 tklvlvsw.exe -
Loads dropped DLL 5 IoCs
pid Process 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 2164 zxmgwssyyb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zxmgwssyyb.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdpttqga = "zxmgwssyyb.exe" siuwxrqkqskzzva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qyudiisl = "siuwxrqkqskzzva.exe" siuwxrqkqskzzva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gwmfarzlfmxoz.exe" siuwxrqkqskzzva.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: tklvlvsw.exe File opened (read-only) \??\i: tklvlvsw.exe File opened (read-only) \??\l: zxmgwssyyb.exe File opened (read-only) \??\o: tklvlvsw.exe File opened (read-only) \??\n: zxmgwssyyb.exe File opened (read-only) \??\y: zxmgwssyyb.exe File opened (read-only) \??\j: tklvlvsw.exe File opened (read-only) \??\r: tklvlvsw.exe File opened (read-only) \??\e: tklvlvsw.exe File opened (read-only) \??\u: tklvlvsw.exe File opened (read-only) \??\b: zxmgwssyyb.exe File opened (read-only) \??\m: tklvlvsw.exe File opened (read-only) \??\n: tklvlvsw.exe File opened (read-only) \??\o: tklvlvsw.exe File opened (read-only) \??\b: tklvlvsw.exe File opened (read-only) \??\k: zxmgwssyyb.exe File opened (read-only) \??\v: zxmgwssyyb.exe File opened (read-only) \??\g: tklvlvsw.exe File opened (read-only) \??\t: tklvlvsw.exe File opened (read-only) \??\y: tklvlvsw.exe File opened (read-only) \??\g: zxmgwssyyb.exe File opened (read-only) \??\e: zxmgwssyyb.exe File opened (read-only) \??\l: tklvlvsw.exe File opened (read-only) \??\k: tklvlvsw.exe File opened (read-only) \??\q: tklvlvsw.exe File opened (read-only) \??\w: tklvlvsw.exe File opened (read-only) \??\l: tklvlvsw.exe File opened (read-only) \??\z: zxmgwssyyb.exe File opened (read-only) \??\g: tklvlvsw.exe File opened (read-only) \??\j: tklvlvsw.exe File opened (read-only) \??\q: zxmgwssyyb.exe File opened (read-only) \??\p: zxmgwssyyb.exe File opened (read-only) \??\h: tklvlvsw.exe File opened (read-only) \??\t: zxmgwssyyb.exe File opened (read-only) \??\k: tklvlvsw.exe File opened (read-only) \??\b: tklvlvsw.exe File opened (read-only) \??\h: zxmgwssyyb.exe File opened (read-only) \??\m: zxmgwssyyb.exe File opened (read-only) \??\x: zxmgwssyyb.exe File opened (read-only) \??\w: tklvlvsw.exe File opened (read-only) \??\y: tklvlvsw.exe File opened (read-only) \??\h: tklvlvsw.exe File opened (read-only) \??\i: zxmgwssyyb.exe File opened (read-only) \??\s: zxmgwssyyb.exe File opened (read-only) \??\a: tklvlvsw.exe File opened (read-only) \??\u: zxmgwssyyb.exe File opened (read-only) \??\n: tklvlvsw.exe File opened (read-only) \??\a: tklvlvsw.exe File opened (read-only) \??\p: tklvlvsw.exe File opened (read-only) \??\x: tklvlvsw.exe File opened (read-only) \??\z: tklvlvsw.exe File opened (read-only) \??\a: zxmgwssyyb.exe File opened (read-only) \??\w: zxmgwssyyb.exe File opened (read-only) \??\i: tklvlvsw.exe File opened (read-only) \??\z: tklvlvsw.exe File opened (read-only) \??\p: tklvlvsw.exe File opened (read-only) \??\s: tklvlvsw.exe File opened (read-only) \??\v: tklvlvsw.exe File opened (read-only) \??\m: tklvlvsw.exe File opened (read-only) \??\r: zxmgwssyyb.exe File opened (read-only) \??\e: tklvlvsw.exe File opened (read-only) \??\q: tklvlvsw.exe File opened (read-only) \??\s: tklvlvsw.exe File opened (read-only) \??\u: tklvlvsw.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" zxmgwssyyb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" zxmgwssyyb.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/828-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000b000000012263-17.dat autoit_exe behavioral1/files/0x0008000000015ed2-5.dat autoit_exe behavioral1/files/0x0008000000015f96-26.dat autoit_exe behavioral1/files/0x0008000000016009-32.dat autoit_exe behavioral1/files/0x0006000000016de8-70.dat autoit_exe behavioral1/files/0x0006000000016eb8-72.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tklvlvsw.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File created C:\Windows\SysWOW64\zxmgwssyyb.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\zxmgwssyyb.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File created C:\Windows\SysWOW64\siuwxrqkqskzzva.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\siuwxrqkqskzzva.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File created C:\Windows\SysWOW64\tklvlvsw.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File created C:\Windows\SysWOW64\gwmfarzlfmxoz.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gwmfarzlfmxoz.exe ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll zxmgwssyyb.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal tklvlvsw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tklvlvsw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tklvlvsw.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tklvlvsw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tklvlvsw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tklvlvsw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal tklvlvsw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tklvlvsw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tklvlvsw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal tklvlvsw.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tklvlvsw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal tklvlvsw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe tklvlvsw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe tklvlvsw.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language siuwxrqkqskzzva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tklvlvsw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gwmfarzlfmxoz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tklvlvsw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zxmgwssyyb.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302D0B9C2483586D4477D377252DD77C8764DB" ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB0B12147E2389D53B9B9D433EFD4BE" ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh zxmgwssyyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" zxmgwssyyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs zxmgwssyyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" zxmgwssyyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7836BB1FF1F22DCD10FD1D68A7E916B" ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat zxmgwssyyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" zxmgwssyyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc zxmgwssyyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" zxmgwssyyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg zxmgwssyyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFCFB482D85689140D65A7EE6BDE1E134594A664F6331D69E" ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCDFABDFE13F2E784783A43819A39E1B38E038C43630233E2C445E608D2" ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C77814E7DABFB8CD7C92ECE434BE" ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" zxmgwssyyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf zxmgwssyyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" zxmgwssyyb.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2748 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2696 tklvlvsw.exe 2696 tklvlvsw.exe 2696 tklvlvsw.exe 2696 tklvlvsw.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2196 tklvlvsw.exe 2196 tklvlvsw.exe 2196 tklvlvsw.exe 2196 tklvlvsw.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2228 siuwxrqkqskzzva.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2696 tklvlvsw.exe 2696 tklvlvsw.exe 2696 tklvlvsw.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2196 tklvlvsw.exe 2196 tklvlvsw.exe 2196 tklvlvsw.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2164 zxmgwssyyb.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2228 siuwxrqkqskzzva.exe 2696 tklvlvsw.exe 2696 tklvlvsw.exe 2696 tklvlvsw.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2840 gwmfarzlfmxoz.exe 2196 tklvlvsw.exe 2196 tklvlvsw.exe 2196 tklvlvsw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 WINWORD.EXE 2748 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 828 wrote to memory of 2164 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 31 PID 828 wrote to memory of 2164 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 31 PID 828 wrote to memory of 2164 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 31 PID 828 wrote to memory of 2164 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 31 PID 828 wrote to memory of 2228 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 32 PID 828 wrote to memory of 2228 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 32 PID 828 wrote to memory of 2228 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 32 PID 828 wrote to memory of 2228 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 32 PID 828 wrote to memory of 2696 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 33 PID 828 wrote to memory of 2696 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 33 PID 828 wrote to memory of 2696 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 33 PID 828 wrote to memory of 2696 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 33 PID 828 wrote to memory of 2840 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 34 PID 828 wrote to memory of 2840 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 34 PID 828 wrote to memory of 2840 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 34 PID 828 wrote to memory of 2840 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 34 PID 828 wrote to memory of 2748 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 35 PID 828 wrote to memory of 2748 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 35 PID 828 wrote to memory of 2748 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 35 PID 828 wrote to memory of 2748 828 ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe 35 PID 2164 wrote to memory of 2196 2164 zxmgwssyyb.exe 36 PID 2164 wrote to memory of 2196 2164 zxmgwssyyb.exe 36 PID 2164 wrote to memory of 2196 2164 zxmgwssyyb.exe 36 PID 2164 wrote to memory of 2196 2164 zxmgwssyyb.exe 36 PID 2748 wrote to memory of 1724 2748 WINWORD.EXE 38 PID 2748 wrote to memory of 1724 2748 WINWORD.EXE 38 PID 2748 wrote to memory of 1724 2748 WINWORD.EXE 38 PID 2748 wrote to memory of 1724 2748 WINWORD.EXE 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed954ed4772590e21477fed8d7430984_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\zxmgwssyyb.exezxmgwssyyb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\tklvlvsw.exeC:\Windows\system32\tklvlvsw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2196
-
-
-
C:\Windows\SysWOW64\siuwxrqkqskzzva.exesiuwxrqkqskzzva.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2228
-
-
C:\Windows\SysWOW64\tklvlvsw.exetklvlvsw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2696
-
-
C:\Windows\SysWOW64\gwmfarzlfmxoz.exegwmfarzlfmxoz.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2840
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1724
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD55db4d3001cc3195b53eb71e1766a6009
SHA1d92f012e97277dbb73312e5f3e03e109d458b79c
SHA256722e4ccc2b81278144d0a93827671438588ac7c678e32eaea9f478e987eefea2
SHA51212db4b5a1be9f1989e474f024af97bed8d7afb9d2a36c0996c478406bcf1e48fb74ccaae66b32d4cadc07bff8d0c9d748a909461887fca6beb45d8b5fd2b1804
-
Filesize
512KB
MD51257e4aac6d36a8b7dc929a814d649b2
SHA1956b2cc02ad63023f478a26d413acea67e920964
SHA2567d6a2fb905608e4db03e4f9501cb3ce5f4e9abcd43152e5faff24ccb67a310e2
SHA51239c2234aa6ffd22f668e3771aa1dddded23a742bf8121ac575aeae967b40ca2e91a19be9a53894e9e2f890dc5c9ac8af1e85935790c0bb787021664e7355d546
-
Filesize
19KB
MD55f57c9caf36644a32fd84367836b0bf3
SHA11ffeebd0a5575470dc0695b13672465b29f24f59
SHA25607a414f62f6971e1dc2a4786f78427d1413c5c93cff2cb392c85325897b9f31d
SHA51262b1e8beec5d4b11f0f283b042a2be34624310a63887a782910fea722acff865acf23e656ff314e132a7cf8c1c36abb8df9beeeff076e6e84680930e25cf3e22
-
Filesize
512KB
MD54add51b81887d83cf0af579d8bcb5ce7
SHA15a852ebd39b2fc7b90954a55c6e1c10304519238
SHA25670ac5e2d3bb1c6be85442330e6129964f29aa44699ac561390daae5b9beb9bbf
SHA512ddd47ed4015a1baeb1460f608210b2e87716fff02f4e33b8b696f3dc838d0095207e1b4e35ea7ec456de15bf6b06301e9a4efd0455e7bdfa02e11ec2eb7846fd
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD58112843a41cb1234789ff5d9eaf548ff
SHA1cf86c3aa5ecd2d461df5b2e294a00fb45e21b0f4
SHA25600fa8406584f9cf814237f68c51f249b1ba03cacc806b6800e0faffd3803f023
SHA512858dcfd7fc2bc680f128790ac960fcafa8e7c5479bcc2a08fe9e757e89e45aecab4c00e6b81f7cbfb77f468e89a8c99db39edcfa423dc2c23cc436226ff6f59d
-
Filesize
512KB
MD52d93866efcf5f731da62335ab11bbb37
SHA132403311e204801c595566b33b8b25759b2b72e9
SHA256dd0485f9fc2e4bb0918902cf709165fc63a34d108871bfdd2189fd5505a0bfdc
SHA5121c378e8878967a7d2873ce6a976368948fa0858f5b6fe4da2cb8367ba05bdebcf9d2ceff1ac40f59c51ac8e13321f1d3517b08c9f09935b6195f15e8c789e6da
-
Filesize
512KB
MD5736b75594e4054ef67eb3bf2e70770c6
SHA1eed75beb65a59f25c767910ebd5f3754c59ca64f
SHA256ee038d8dbbc1401e70a18c09ffa1c7a96d27821a2492c3a8901afc8b60686e85
SHA512a66e28ac44dddd5b53fae525498bdbfe4b416360f63f9eb1d916db268d08dd0a13c282abb7ab2e10283f20c81c937963633e992e4409972114f5893362c3c97f