Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 14:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
25 signatures
150 seconds
General
-
Target
fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe
-
Size
512KB
-
MD5
fa8cd8394aa27c9b22fa8bd7d7b5a51c
-
SHA1
93205ba789a795d333a5beb6441ebd3eadeeae27
-
SHA256
c3762ac4dcd225bb4afbd6f12a41877065cb23f0e10cb1eef6ffdaa7c2eb620e
-
SHA512
8a3b47b9e58f36eacef4c91f24b47a2d973a070bd5196de35f755c4840781ac36606e52504a2c30d0256f032abeb8180aa1fe915cf03368982921616389f0126
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" lasqsudhii.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lasqsudhii.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" lasqsudhii.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lasqsudhii.exe -
Executes dropped EXE 5 IoCs
pid Process 2740 lasqsudhii.exe 2700 lrxqtygoskyrrae.exe 2824 qzfcdnfi.exe 2136 haevpyrmzyxtf.exe 2844 qzfcdnfi.exe -
Loads dropped DLL 5 IoCs
pid Process 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 2740 lasqsudhii.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lasqsudhii.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mncouwbl = "lasqsudhii.exe" lrxqtygoskyrrae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bofoqsom = "lrxqtygoskyrrae.exe" lrxqtygoskyrrae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "haevpyrmzyxtf.exe" lrxqtygoskyrrae.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: lasqsudhii.exe File opened (read-only) \??\k: lasqsudhii.exe File opened (read-only) \??\a: qzfcdnfi.exe File opened (read-only) \??\g: qzfcdnfi.exe File opened (read-only) \??\l: qzfcdnfi.exe File opened (read-only) \??\m: qzfcdnfi.exe File opened (read-only) \??\y: qzfcdnfi.exe File opened (read-only) \??\g: lasqsudhii.exe File opened (read-only) \??\m: lasqsudhii.exe File opened (read-only) \??\o: lasqsudhii.exe File opened (read-only) \??\x: qzfcdnfi.exe File opened (read-only) \??\n: qzfcdnfi.exe File opened (read-only) \??\p: qzfcdnfi.exe File opened (read-only) \??\h: qzfcdnfi.exe File opened (read-only) \??\k: qzfcdnfi.exe File opened (read-only) \??\j: lasqsudhii.exe File opened (read-only) \??\p: lasqsudhii.exe File opened (read-only) \??\u: qzfcdnfi.exe File opened (read-only) \??\j: qzfcdnfi.exe File opened (read-only) \??\b: qzfcdnfi.exe File opened (read-only) \??\k: qzfcdnfi.exe File opened (read-only) \??\w: qzfcdnfi.exe File opened (read-only) \??\e: qzfcdnfi.exe File opened (read-only) \??\v: qzfcdnfi.exe File opened (read-only) \??\r: lasqsudhii.exe File opened (read-only) \??\w: lasqsudhii.exe File opened (read-only) \??\b: qzfcdnfi.exe File opened (read-only) \??\v: qzfcdnfi.exe File opened (read-only) \??\y: lasqsudhii.exe File opened (read-only) \??\m: qzfcdnfi.exe File opened (read-only) \??\j: qzfcdnfi.exe File opened (read-only) \??\l: qzfcdnfi.exe File opened (read-only) \??\s: qzfcdnfi.exe File opened (read-only) \??\z: qzfcdnfi.exe File opened (read-only) \??\a: lasqsudhii.exe File opened (read-only) \??\l: lasqsudhii.exe File opened (read-only) \??\t: qzfcdnfi.exe File opened (read-only) \??\o: qzfcdnfi.exe File opened (read-only) \??\u: qzfcdnfi.exe File opened (read-only) \??\a: qzfcdnfi.exe File opened (read-only) \??\p: qzfcdnfi.exe File opened (read-only) \??\b: lasqsudhii.exe File opened (read-only) \??\s: lasqsudhii.exe File opened (read-only) \??\z: lasqsudhii.exe File opened (read-only) \??\i: qzfcdnfi.exe File opened (read-only) \??\i: qzfcdnfi.exe File opened (read-only) \??\z: qzfcdnfi.exe File opened (read-only) \??\q: qzfcdnfi.exe File opened (read-only) \??\w: qzfcdnfi.exe File opened (read-only) \??\q: lasqsudhii.exe File opened (read-only) \??\h: qzfcdnfi.exe File opened (read-only) \??\y: qzfcdnfi.exe File opened (read-only) \??\g: qzfcdnfi.exe File opened (read-only) \??\o: qzfcdnfi.exe File opened (read-only) \??\r: qzfcdnfi.exe File opened (read-only) \??\n: lasqsudhii.exe File opened (read-only) \??\e: qzfcdnfi.exe File opened (read-only) \??\r: qzfcdnfi.exe File opened (read-only) \??\t: qzfcdnfi.exe File opened (read-only) \??\u: lasqsudhii.exe File opened (read-only) \??\x: lasqsudhii.exe File opened (read-only) \??\n: qzfcdnfi.exe File opened (read-only) \??\s: qzfcdnfi.exe File opened (read-only) \??\x: qzfcdnfi.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" lasqsudhii.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" lasqsudhii.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/376-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x00070000000186ca-9.dat autoit_exe behavioral1/files/0x000b00000001225e-17.dat autoit_exe behavioral1/files/0x00060000000186c6-25.dat autoit_exe behavioral1/files/0x00060000000186d9-37.dat autoit_exe behavioral1/files/0x0009000000018718-65.dat autoit_exe behavioral1/files/0x0007000000019240-69.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\lasqsudhii.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File created C:\Windows\SysWOW64\lrxqtygoskyrrae.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File created C:\Windows\SysWOW64\qzfcdnfi.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File created C:\Windows\SysWOW64\haevpyrmzyxtf.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\haevpyrmzyxtf.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lasqsudhii.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lrxqtygoskyrrae.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\qzfcdnfi.exe fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll lasqsudhii.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qzfcdnfi.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qzfcdnfi.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal qzfcdnfi.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal qzfcdnfi.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qzfcdnfi.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qzfcdnfi.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe qzfcdnfi.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal qzfcdnfi.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lasqsudhii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxqtygoskyrrae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qzfcdnfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language haevpyrmzyxtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qzfcdnfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" lasqsudhii.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FFF9485C82689047D62E7E97BDE0E6415837664F6243D7E9" fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1839C67E15E4DAB4B9BC7FE7ED9134BD" fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs lasqsudhii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat lasqsudhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" lasqsudhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" lasqsudhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" lasqsudhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334F2C799D5182276D3F77D570222CD67D8764AB" fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB9F9CDFE65F29884743A31869C39E5B38C02FF4261023BE2CC429A08D6" fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FC6BC2FE6721AED10CD1A98A7B9166" fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" lasqsudhii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf lasqsudhii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg lasqsudhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB0204793399A53CABADC3293D7CF" fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh lasqsudhii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc lasqsudhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" lasqsudhii.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2652 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2824 qzfcdnfi.exe 2824 qzfcdnfi.exe 2824 qzfcdnfi.exe 2824 qzfcdnfi.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2844 qzfcdnfi.exe 2844 qzfcdnfi.exe 2844 qzfcdnfi.exe 2844 qzfcdnfi.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2700 lrxqtygoskyrrae.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2824 qzfcdnfi.exe 2824 qzfcdnfi.exe 2824 qzfcdnfi.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2844 qzfcdnfi.exe 2844 qzfcdnfi.exe 2844 qzfcdnfi.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2740 lasqsudhii.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2700 lrxqtygoskyrrae.exe 2824 qzfcdnfi.exe 2824 qzfcdnfi.exe 2824 qzfcdnfi.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2136 haevpyrmzyxtf.exe 2844 qzfcdnfi.exe 2844 qzfcdnfi.exe 2844 qzfcdnfi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2652 WINWORD.EXE 2652 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 376 wrote to memory of 2740 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 30 PID 376 wrote to memory of 2740 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 30 PID 376 wrote to memory of 2740 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 30 PID 376 wrote to memory of 2740 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 30 PID 376 wrote to memory of 2700 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 31 PID 376 wrote to memory of 2700 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 31 PID 376 wrote to memory of 2700 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 31 PID 376 wrote to memory of 2700 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 31 PID 376 wrote to memory of 2824 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 32 PID 376 wrote to memory of 2824 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 32 PID 376 wrote to memory of 2824 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 32 PID 376 wrote to memory of 2824 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 32 PID 376 wrote to memory of 2136 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 33 PID 376 wrote to memory of 2136 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 33 PID 376 wrote to memory of 2136 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 33 PID 376 wrote to memory of 2136 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 33 PID 2740 wrote to memory of 2844 2740 lasqsudhii.exe 34 PID 2740 wrote to memory of 2844 2740 lasqsudhii.exe 34 PID 2740 wrote to memory of 2844 2740 lasqsudhii.exe 34 PID 2740 wrote to memory of 2844 2740 lasqsudhii.exe 34 PID 376 wrote to memory of 2652 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 35 PID 376 wrote to memory of 2652 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 35 PID 376 wrote to memory of 2652 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 35 PID 376 wrote to memory of 2652 376 fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe 35 PID 2652 wrote to memory of 2472 2652 WINWORD.EXE 37 PID 2652 wrote to memory of 2472 2652 WINWORD.EXE 37 PID 2652 wrote to memory of 2472 2652 WINWORD.EXE 37 PID 2652 wrote to memory of 2472 2652 WINWORD.EXE 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa8cd8394aa27c9b22fa8bd7d7b5a51c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\lasqsudhii.exelasqsudhii.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\qzfcdnfi.exeC:\Windows\system32\qzfcdnfi.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2844
-
-
-
C:\Windows\SysWOW64\lrxqtygoskyrrae.exelrxqtygoskyrrae.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2700
-
-
C:\Windows\SysWOW64\qzfcdnfi.exeqzfcdnfi.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2824
-
-
C:\Windows\SysWOW64\haevpyrmzyxtf.exehaevpyrmzyxtf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2136
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2472
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5c91e8d52bb335c84fe3c6c3aef3f9e89
SHA1b11f71f73510610c0bd8db5aee088e2d75b188f1
SHA25673fa3bced4f3a7627ad39f507ae036475e4a733e4f61676c828fa60db8b0281f
SHA512cc485d2c09c45d556a36ad7804c4aad1575986625cf1227309f0ad1503f89c69c39583a2684856dc1368eaf291af92b7f1fb24b536e903e479efdfb9756dda18
-
Filesize
512KB
MD54c4eb436d47a55f8f31c0a6a429781e2
SHA1ad974637dec4e20ce21ea7c066f0bb99f7155c7f
SHA2560ff2a37e7e6a2f4f8dd57ca84426f875d627ed536218824b3f9f71e796ccbd9d
SHA512c94eca5fbb22ddeba5dd6b23cfe92d5cdfca7e0eeca8a99a25f35f87df85132453a98f86913e9dba72c8494e8af87c60611652f2e83f81067cad6bf80dcdc734
-
Filesize
19KB
MD5b277094f882183f7968aab2027a854fb
SHA1d1ce56b3a81cc3ab6e5a953211b5b022ed3022d5
SHA25660d81b7a34e290e20fd9e63b37f05e3ef0c915a7bb9c84fc0802ac32ee8047d9
SHA512f73afd5ca5b2eec86dd4efd4cbc6feb683f4c391268f3c045ef50e52cef8f6172e8ad4d7500c72e8e0dd1f2f2b46260e93c4dcb52840ca060047f7d25f704c19
-
Filesize
512KB
MD5172c513b7a5d6139d2cdf2cfe04c3f68
SHA1afd7df12d50438ea12f4e549329a621a57a814aa
SHA256b2764df35b9721955500b20f3d89774a8fcb03865468adcb975cea609a9ac5dc
SHA512d6bf74f3768c1cdc4e8c313c043f01530310b4a58ea6a6cea7d720e39922d599d4b3806f95164574421566a941e87e2732059c67348e9baa82f3edd5303b202e
-
Filesize
512KB
MD53b6f914be64b52e502e6dc2b9c3238cb
SHA1454e41e85859f07e86b0667b5602aeaccaea78e8
SHA2565f63d398126e55cfd4c8b2b98a60e827b58cdfb8b70b9844ba217a01b32ef820
SHA5129832864f59f97e89fab253cde5bf93db2d779e3f10a640e0d04397532c8fbc232f6a0ffc2cb3457814acd5c9f4ecb878dbdc54fdd9c3193c54768f873e42c2e8
-
Filesize
512KB
MD53154f49ac025aaf86e8183470edb47d1
SHA1a7576be4e46f4420ad1b833f010f686e61e29fb5
SHA25689a03e975b9b5c68fab6cbae3a439be0750134cc914c2c65b0faf89f125b8762
SHA512011b87b5967c158244a9d9f703ff102e43ba55bc724d09c0752e89568469f8107518f49a74794144303a98fe29ca14b796cf1bde6d72859fcd3a2036ee617535
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5467e4a8aa9a5ffa2df87649d04429739
SHA1efaf4bce6ead7b34d4325a115ee213a71203d093
SHA256eca60811116b8e99d4ce4a09773bd4bd7c8241c739e8c8329d8f626baa16bf86
SHA512b057e7521fbb4a802d6c92fedf330dc4dd2dc4332466a76bd48df3a90c9c35847c0c09bdc8e49460cb5ac21bba4882f3a3feced880a6f2575c64b7863de6e267