Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 20:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
General
-
Target
f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe
-
Size
512KB
-
MD5
f08b703cc1d852279362e7b5ad25d22a
-
SHA1
f1efa9ba25da90274ff8a08a7f062e6e04b1d719
-
SHA256
f7f02312b7607fcdeace47c2cb46a57e3f280e44b33ceafde3b6e23340ddfff6
-
SHA512
f78de3375c9913f0e3645099a30a62b213290547877881d6a4ba6e4a10766026e0791ae2bb5cc33a1e2ef0b1d96760ebf595cc667809b41faeb00e8dc0dfc87f
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" mobrhxuapk.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mobrhxuapk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" mobrhxuapk.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mobrhxuapk.exe -
Executes dropped EXE 5 IoCs
pid Process 2816 mobrhxuapk.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2772 pidfqrjf.exe 2904 pidfqrjf.exe -
Loads dropped DLL 5 IoCs
pid Process 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2816 mobrhxuapk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" mobrhxuapk.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ihnmghpz = "mobrhxuapk.exe" eetqtggccjpiyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rtyuumyp = "eetqtggccjpiyzc.exe" eetqtggccjpiyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "dznnyazkfkhii.exe" eetqtggccjpiyzc.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: mobrhxuapk.exe File opened (read-only) \??\t: mobrhxuapk.exe File opened (read-only) \??\p: pidfqrjf.exe File opened (read-only) \??\e: mobrhxuapk.exe File opened (read-only) \??\m: mobrhxuapk.exe File opened (read-only) \??\r: pidfqrjf.exe File opened (read-only) \??\j: pidfqrjf.exe File opened (read-only) \??\l: pidfqrjf.exe File opened (read-only) \??\s: pidfqrjf.exe File opened (read-only) \??\b: pidfqrjf.exe File opened (read-only) \??\s: pidfqrjf.exe File opened (read-only) \??\i: mobrhxuapk.exe File opened (read-only) \??\j: mobrhxuapk.exe File opened (read-only) \??\i: pidfqrjf.exe File opened (read-only) \??\l: pidfqrjf.exe File opened (read-only) \??\q: pidfqrjf.exe File opened (read-only) \??\n: mobrhxuapk.exe File opened (read-only) \??\x: mobrhxuapk.exe File opened (read-only) \??\z: mobrhxuapk.exe File opened (read-only) \??\n: pidfqrjf.exe File opened (read-only) \??\h: pidfqrjf.exe File opened (read-only) \??\u: pidfqrjf.exe File opened (read-only) \??\z: pidfqrjf.exe File opened (read-only) \??\r: mobrhxuapk.exe File opened (read-only) \??\o: pidfqrjf.exe File opened (read-only) \??\e: pidfqrjf.exe File opened (read-only) \??\i: pidfqrjf.exe File opened (read-only) \??\n: pidfqrjf.exe File opened (read-only) \??\p: pidfqrjf.exe File opened (read-only) \??\k: pidfqrjf.exe File opened (read-only) \??\x: pidfqrjf.exe File opened (read-only) \??\k: mobrhxuapk.exe File opened (read-only) \??\o: mobrhxuapk.exe File opened (read-only) \??\u: pidfqrjf.exe File opened (read-only) \??\z: pidfqrjf.exe File opened (read-only) \??\o: pidfqrjf.exe File opened (read-only) \??\p: mobrhxuapk.exe File opened (read-only) \??\e: pidfqrjf.exe File opened (read-only) \??\x: pidfqrjf.exe File opened (read-only) \??\h: mobrhxuapk.exe File opened (read-only) \??\y: mobrhxuapk.exe File opened (read-only) \??\g: pidfqrjf.exe File opened (read-only) \??\w: pidfqrjf.exe File opened (read-only) \??\a: pidfqrjf.exe File opened (read-only) \??\y: pidfqrjf.exe File opened (read-only) \??\g: mobrhxuapk.exe File opened (read-only) \??\y: pidfqrjf.exe File opened (read-only) \??\l: mobrhxuapk.exe File opened (read-only) \??\q: mobrhxuapk.exe File opened (read-only) \??\t: pidfqrjf.exe File opened (read-only) \??\w: pidfqrjf.exe File opened (read-only) \??\v: mobrhxuapk.exe File opened (read-only) \??\w: mobrhxuapk.exe File opened (read-only) \??\a: pidfqrjf.exe File opened (read-only) \??\h: pidfqrjf.exe File opened (read-only) \??\r: pidfqrjf.exe File opened (read-only) \??\t: pidfqrjf.exe File opened (read-only) \??\b: mobrhxuapk.exe File opened (read-only) \??\s: mobrhxuapk.exe File opened (read-only) \??\u: mobrhxuapk.exe File opened (read-only) \??\m: pidfqrjf.exe File opened (read-only) \??\q: pidfqrjf.exe File opened (read-only) \??\g: pidfqrjf.exe File opened (read-only) \??\j: pidfqrjf.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" mobrhxuapk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" mobrhxuapk.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2400-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0007000000016d1f-9.dat autoit_exe behavioral1/files/0x000b000000012253-17.dat autoit_exe behavioral1/files/0x0008000000016d15-21.dat autoit_exe behavioral1/files/0x0007000000016d27-40.dat autoit_exe behavioral1/files/0x0009000000016cf6-65.dat autoit_exe behavioral1/files/0x00070000000193ec-67.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\pidfqrjf.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dznnyazkfkhii.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File created C:\Windows\SysWOW64\mobrhxuapk.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mobrhxuapk.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File created C:\Windows\SysWOW64\eetqtggccjpiyzc.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eetqtggccjpiyzc.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\pidfqrjf.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File created C:\Windows\SysWOW64\dznnyazkfkhii.exe f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll mobrhxuapk.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal pidfqrjf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal pidfqrjf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pidfqrjf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pidfqrjf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pidfqrjf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pidfqrjf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pidfqrjf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal pidfqrjf.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pidfqrjf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pidfqrjf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pidfqrjf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pidfqrjf.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe pidfqrjf.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe pidfqrjf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal pidfqrjf.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mobrhxuapk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eetqtggccjpiyzc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dznnyazkfkhii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pidfqrjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pidfqrjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB1584795399D52CFB9D0329FD7B9" f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF5FC8D482E851F9031D75F7EE6BDE6E1345935674F6337D79D" f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf mobrhxuapk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg mobrhxuapk.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334E2C779C5282226A3477A777232CDF7C8E64AD" f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C7751490DBBEB9C17CE9EC9737C9" f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" mobrhxuapk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" mobrhxuapk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" mobrhxuapk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BC4FE6A21ACD20ED0A68B799060" f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh mobrhxuapk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" mobrhxuapk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs mobrhxuapk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc mobrhxuapk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACFFAB1FE10F29884743B46869C3992B08C02FE4268034BE2BE45EA08A9" f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat mobrhxuapk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" mobrhxuapk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" mobrhxuapk.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1448 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2772 pidfqrjf.exe 2772 pidfqrjf.exe 2772 pidfqrjf.exe 2772 pidfqrjf.exe 2904 pidfqrjf.exe 2904 pidfqrjf.exe 2904 pidfqrjf.exe 2904 pidfqrjf.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2124 eetqtggccjpiyzc.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2772 pidfqrjf.exe 2772 pidfqrjf.exe 2772 pidfqrjf.exe 2904 pidfqrjf.exe 2904 pidfqrjf.exe 2904 pidfqrjf.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2816 mobrhxuapk.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2124 eetqtggccjpiyzc.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2868 dznnyazkfkhii.exe 2772 pidfqrjf.exe 2772 pidfqrjf.exe 2772 pidfqrjf.exe 2904 pidfqrjf.exe 2904 pidfqrjf.exe 2904 pidfqrjf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1448 WINWORD.EXE 1448 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2816 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2816 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2816 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2816 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 30 PID 2400 wrote to memory of 2124 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2124 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2124 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2124 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2772 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2772 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2772 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2772 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2868 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 33 PID 2400 wrote to memory of 2868 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 33 PID 2400 wrote to memory of 2868 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 33 PID 2400 wrote to memory of 2868 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 33 PID 2816 wrote to memory of 2904 2816 mobrhxuapk.exe 34 PID 2816 wrote to memory of 2904 2816 mobrhxuapk.exe 34 PID 2816 wrote to memory of 2904 2816 mobrhxuapk.exe 34 PID 2816 wrote to memory of 2904 2816 mobrhxuapk.exe 34 PID 2400 wrote to memory of 1448 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 35 PID 2400 wrote to memory of 1448 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 35 PID 2400 wrote to memory of 1448 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 35 PID 2400 wrote to memory of 1448 2400 f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe 35 PID 1448 wrote to memory of 1716 1448 WINWORD.EXE 38 PID 1448 wrote to memory of 1716 1448 WINWORD.EXE 38 PID 1448 wrote to memory of 1716 1448 WINWORD.EXE 38 PID 1448 wrote to memory of 1716 1448 WINWORD.EXE 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f08b703cc1d852279362e7b5ad25d22a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\mobrhxuapk.exemobrhxuapk.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\pidfqrjf.exeC:\Windows\system32\pidfqrjf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2904
-
-
-
C:\Windows\SysWOW64\eetqtggccjpiyzc.exeeetqtggccjpiyzc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2124
-
-
C:\Windows\SysWOW64\pidfqrjf.exepidfqrjf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2772
-
-
C:\Windows\SysWOW64\dznnyazkfkhii.exedznnyazkfkhii.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2868
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1716
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5eb0f65f135afb3cff5fd7655b6dc66e6
SHA17faeef8ebf69064b00ccc42a549452fdff6ba514
SHA256cb1356f00b4a822ef3dfe9117bcdf18631a634366c6a51088b0f1e40ffbd3050
SHA5124305b101e7cc160d491243949c10c0da04a9af7f887e4778270307a4f8feb155c58043a28cdcb3a388ba91ccf252056e6ffc0601d5486397c8f458515cbf5824
-
Filesize
19KB
MD5a2653a2b7b9fa8d8dc8504fc2c279a6d
SHA1268919ca2edcff843b12fe7721070a00b1894dbd
SHA2561a7d8f7eff2497beab8b634c79cee4b67e44b73159e33e903e367076c9b3aa65
SHA512e07e25611c254c1890bacac05deecc44a6c4bc44e876f7ba88b3920f6dad12a1f6fab292d10b9fe9094e7c8613395929b0a2f7c77116bbeff5acf80a1688418d
-
Filesize
512KB
MD50ddd2cc471e332b4bc08e14471fbd2a5
SHA121bc21c8019596f298fd1095091e9abfcc8fe06d
SHA25676d9b27f7963bf457089df7a5746bb73adb486b8224eb944ffc6bb5bc3477367
SHA5121f176a510493822bd0b8d835a2c7eb9d08c74b58f15c3654d86796a63f0ea2d365d5e85d056fe41a21fb1e4a2c8a846ab52264684ede1e1c999a382928b9cfd7
-
Filesize
512KB
MD529ea978024a0defeaea732d24f5e1078
SHA1485251b7881f11a1195537362337db5b0eb288a8
SHA256904076d5d1788e01fe1cbad49b9168b5a3f13276cf0e2833ffcfa9be7336a921
SHA512db428d81a19ab2ec863dbafb01170f58072c5f1260c80d291676bb9aff8f7edfa9369651b88702dc84b185679a8e45186e586ecce52fb8b55f23bf0ca92b9f03
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD55baeb809ae27fe4578f532583f9fed90
SHA14909dd5f4f4788a9eb78f38afe4b4febb51f8cc3
SHA2563c8fdcb14909063d0ff6d814dbdb7ae1f0f004186bd4ca33d617ee55b4d16f96
SHA5122647dd25cb7ec9d5741d0c439a3a66f55456fb94759ca210f20c27102387bc0beb05c06dd5288f868c3f4de543bc1b55529fe346e36fc4c46ca81d400c6e1e04
-
Filesize
512KB
MD5893d2cce8c88d3ff1fcb0635e49c435d
SHA100e67dc6cc03f3a13a255169e3ab5b85990f5243
SHA256b836bf5571803c81f62795df26a31611efd6485f2833dc0b16005bb2c1a43f50
SHA512f212c417616194cbc472e6d0da261b58731bc3d9d9ed7b75199aa9ebe8e2105c7c88d5bded2170be49d85a98b7d8c116d478f2f63bd374c0ae06655cdb9ba2fa
-
Filesize
512KB
MD5d59c8ea6faf1d22029c24c11f78dec3c
SHA12d9673d777e5e5b6227a47396aac06173927973e
SHA256380d1cda094f4f3e847b8e8036e169afd26c657bbf823969cf6c9da3971cb084
SHA512be5c214783efc2155fb8fccc4685c7fe5e8fa32a409f4f5e450dcf8b9ea1ba285f141e534f9433d3172bd9ee12b5fa705b69b50e5e52af8e2d534ce7c8c5e937