Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 19:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
25 signatures
150 seconds
General
-
Target
fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe
-
Size
512KB
-
MD5
fd02aec39b72775c357694ef1fca80b4
-
SHA1
a44d6204399eee243172bde55635109c064894ac
-
SHA256
38f20f54668afa01a21970299cd1d4d0e5bd3877f540c9d81acf966d22c101f4
-
SHA512
af9e35a2e96cd3f1b94c72af4c68e5c4ad5b245ae9c07ba05249e1de315590284015dc9e3c1ff97299963556906ea62642cf3dc3dc52832af9c58a6f28a1676c
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jrqoazqpan.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jrqoazqpan.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" jrqoazqpan.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jrqoazqpan.exe -
Executes dropped EXE 5 IoCs
pid Process 2712 jrqoazqpan.exe 2756 mljjdujsbkkbgzd.exe 2148 bcjnmhlw.exe 2760 gdikmosclnsuv.exe 2624 bcjnmhlw.exe -
Loads dropped DLL 5 IoCs
pid Process 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2712 jrqoazqpan.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jrqoazqpan.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gcanegxo = "jrqoazqpan.exe" mljjdujsbkkbgzd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rvidusuj = "mljjdujsbkkbgzd.exe" mljjdujsbkkbgzd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gdikmosclnsuv.exe" mljjdujsbkkbgzd.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: jrqoazqpan.exe File opened (read-only) \??\v: bcjnmhlw.exe File opened (read-only) \??\k: jrqoazqpan.exe File opened (read-only) \??\j: bcjnmhlw.exe File opened (read-only) \??\k: bcjnmhlw.exe File opened (read-only) \??\x: bcjnmhlw.exe File opened (read-only) \??\g: bcjnmhlw.exe File opened (read-only) \??\j: jrqoazqpan.exe File opened (read-only) \??\p: jrqoazqpan.exe File opened (read-only) \??\p: bcjnmhlw.exe File opened (read-only) \??\s: bcjnmhlw.exe File opened (read-only) \??\w: bcjnmhlw.exe File opened (read-only) \??\y: bcjnmhlw.exe File opened (read-only) \??\a: bcjnmhlw.exe File opened (read-only) \??\r: bcjnmhlw.exe File opened (read-only) \??\o: bcjnmhlw.exe File opened (read-only) \??\t: bcjnmhlw.exe File opened (read-only) \??\t: bcjnmhlw.exe File opened (read-only) \??\l: bcjnmhlw.exe File opened (read-only) \??\z: bcjnmhlw.exe File opened (read-only) \??\o: bcjnmhlw.exe File opened (read-only) \??\e: bcjnmhlw.exe File opened (read-only) \??\u: bcjnmhlw.exe File opened (read-only) \??\y: bcjnmhlw.exe File opened (read-only) \??\n: jrqoazqpan.exe File opened (read-only) \??\r: jrqoazqpan.exe File opened (read-only) \??\h: bcjnmhlw.exe File opened (read-only) \??\e: jrqoazqpan.exe File opened (read-only) \??\g: jrqoazqpan.exe File opened (read-only) \??\o: jrqoazqpan.exe File opened (read-only) \??\b: bcjnmhlw.exe File opened (read-only) \??\r: bcjnmhlw.exe File opened (read-only) \??\l: jrqoazqpan.exe File opened (read-only) \??\j: bcjnmhlw.exe File opened (read-only) \??\m: bcjnmhlw.exe File opened (read-only) \??\x: bcjnmhlw.exe File opened (read-only) \??\l: bcjnmhlw.exe File opened (read-only) \??\z: bcjnmhlw.exe File opened (read-only) \??\h: bcjnmhlw.exe File opened (read-only) \??\b: jrqoazqpan.exe File opened (read-only) \??\q: jrqoazqpan.exe File opened (read-only) \??\u: jrqoazqpan.exe File opened (read-only) \??\v: jrqoazqpan.exe File opened (read-only) \??\w: jrqoazqpan.exe File opened (read-only) \??\q: bcjnmhlw.exe File opened (read-only) \??\v: bcjnmhlw.exe File opened (read-only) \??\m: bcjnmhlw.exe File opened (read-only) \??\s: bcjnmhlw.exe File opened (read-only) \??\i: jrqoazqpan.exe File opened (read-only) \??\s: jrqoazqpan.exe File opened (read-only) \??\a: bcjnmhlw.exe File opened (read-only) \??\g: bcjnmhlw.exe File opened (read-only) \??\k: bcjnmhlw.exe File opened (read-only) \??\i: bcjnmhlw.exe File opened (read-only) \??\t: jrqoazqpan.exe File opened (read-only) \??\x: jrqoazqpan.exe File opened (read-only) \??\p: bcjnmhlw.exe File opened (read-only) \??\h: jrqoazqpan.exe File opened (read-only) \??\e: bcjnmhlw.exe File opened (read-only) \??\n: bcjnmhlw.exe File opened (read-only) \??\n: bcjnmhlw.exe File opened (read-only) \??\q: bcjnmhlw.exe File opened (read-only) \??\w: bcjnmhlw.exe File opened (read-only) \??\y: jrqoazqpan.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" jrqoazqpan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" jrqoazqpan.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2308-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0009000000016d5a-9.dat autoit_exe behavioral1/files/0x00090000000120f9-17.dat autoit_exe behavioral1/files/0x0008000000016d49-24.dat autoit_exe behavioral1/files/0x0008000000016d71-37.dat autoit_exe behavioral1/files/0x0009000000017355-72.dat autoit_exe behavioral1/files/0x0007000000017349-70.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\gdikmosclnsuv.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gdikmosclnsuv.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mljjdujsbkkbgzd.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bcjnmhlw.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File created C:\Windows\SysWOW64\mljjdujsbkkbgzd.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File created C:\Windows\SysWOW64\bcjnmhlw.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll jrqoazqpan.exe File created C:\Windows\SysWOW64\jrqoazqpan.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jrqoazqpan.exe fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal bcjnmhlw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bcjnmhlw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal bcjnmhlw.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal bcjnmhlw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bcjnmhlw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal bcjnmhlw.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bcjnmhlw.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gdikmosclnsuv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcjnmhlw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrqoazqpan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mljjdujsbkkbgzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcjnmhlw.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B12947E439EC53BABAA13299D4BE" fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFF834829851A9135D7287E96BDEEE147593266446244D6E9" fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat jrqoazqpan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc jrqoazqpan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg jrqoazqpan.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302D7A9D5783506A4677A177272DDE7D8F64D7" fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C70C1590DABFB9C17FE7ECE234BC" fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" jrqoazqpan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" jrqoazqpan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh jrqoazqpan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" jrqoazqpan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" jrqoazqpan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" jrqoazqpan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB8FAB8F967F19383743A4486EA3E92B08D02FF4363033BE1C945EA08D5" fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BB6FE1C21ADD20CD0A98B0E9165" fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf jrqoazqpan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs jrqoazqpan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" jrqoazqpan.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2224 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2712 jrqoazqpan.exe 2712 jrqoazqpan.exe 2712 jrqoazqpan.exe 2712 jrqoazqpan.exe 2712 jrqoazqpan.exe 2148 bcjnmhlw.exe 2148 bcjnmhlw.exe 2148 bcjnmhlw.exe 2148 bcjnmhlw.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2624 bcjnmhlw.exe 2624 bcjnmhlw.exe 2624 bcjnmhlw.exe 2624 bcjnmhlw.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2756 mljjdujsbkkbgzd.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2712 jrqoazqpan.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2712 jrqoazqpan.exe 2712 jrqoazqpan.exe 2148 bcjnmhlw.exe 2148 bcjnmhlw.exe 2148 bcjnmhlw.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2624 bcjnmhlw.exe 2624 bcjnmhlw.exe 2624 bcjnmhlw.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 2712 jrqoazqpan.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2756 mljjdujsbkkbgzd.exe 2712 jrqoazqpan.exe 2712 jrqoazqpan.exe 2148 bcjnmhlw.exe 2148 bcjnmhlw.exe 2148 bcjnmhlw.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2760 gdikmosclnsuv.exe 2624 bcjnmhlw.exe 2624 bcjnmhlw.exe 2624 bcjnmhlw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2224 WINWORD.EXE 2224 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2712 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2712 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2712 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2712 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2756 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 32 PID 2308 wrote to memory of 2756 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 32 PID 2308 wrote to memory of 2756 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 32 PID 2308 wrote to memory of 2756 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 32 PID 2308 wrote to memory of 2148 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 33 PID 2308 wrote to memory of 2148 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 33 PID 2308 wrote to memory of 2148 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 33 PID 2308 wrote to memory of 2148 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 33 PID 2308 wrote to memory of 2760 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 34 PID 2308 wrote to memory of 2760 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 34 PID 2308 wrote to memory of 2760 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 34 PID 2308 wrote to memory of 2760 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 34 PID 2712 wrote to memory of 2624 2712 jrqoazqpan.exe 35 PID 2712 wrote to memory of 2624 2712 jrqoazqpan.exe 35 PID 2712 wrote to memory of 2624 2712 jrqoazqpan.exe 35 PID 2712 wrote to memory of 2624 2712 jrqoazqpan.exe 35 PID 2308 wrote to memory of 2224 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 36 PID 2308 wrote to memory of 2224 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 36 PID 2308 wrote to memory of 2224 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 36 PID 2308 wrote to memory of 2224 2308 fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe 36 PID 2224 wrote to memory of 528 2224 WINWORD.EXE 38 PID 2224 wrote to memory of 528 2224 WINWORD.EXE 38 PID 2224 wrote to memory of 528 2224 WINWORD.EXE 38 PID 2224 wrote to memory of 528 2224 WINWORD.EXE 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd02aec39b72775c357694ef1fca80b4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\jrqoazqpan.exejrqoazqpan.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\bcjnmhlw.exeC:\Windows\system32\bcjnmhlw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2624
-
-
-
C:\Windows\SysWOW64\mljjdujsbkkbgzd.exemljjdujsbkkbgzd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2756
-
-
C:\Windows\SysWOW64\bcjnmhlw.exebcjnmhlw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2148
-
-
C:\Windows\SysWOW64\gdikmosclnsuv.exegdikmosclnsuv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:528
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD568c65f12cb70810e633241de6b83ff17
SHA1da016c2d826153c73241f2a1c3f991c9a8c6fdaa
SHA256070b379642b9e93c7f01c9ed11be4cc8c361ce4788dddae0a733b5aa436d1c2b
SHA5122e82a11037744673bee1933fb32ac40f93ee340308fb0be3b0c8538a0fbeb65c5d2a90df46c8d8873cca805a944c26440baf4e9206aad387e5d230946748f72d
-
Filesize
512KB
MD54af645438b0865e84d8c869e4bfdf4e9
SHA1d280140d4a77f4d9b57f0953aad86908e64d6735
SHA256a2d9bbb8fdc2b92d82c8b3109e017ed10fda64f2a62e9ad440b1477e8e9e5cff
SHA5122f2e93983a5e9cc06de6c689b041a12e3871c2be7efd51ce5382e0935990a12a623b71dccdcf193dbbdc553ad1ae872029818b58f2ce3e16adc7f8b690ed551e
-
Filesize
19KB
MD5af2e3c1d0f4a3c513ba17059ed755c0f
SHA1487ba920fbb392ba258946eda34a0b63eea7ee31
SHA256c436e2556d929e2d9e2c086b1989e350f28639b625a0da6036e32cf516a116f0
SHA512b40a8d6b5759d467e05f5ffa94f2b0c3e602893874c9c8d107dff62b600575bc66d867c87c38f2d5f090fc50d6998ce018119e2ed6e687be3d25a853a640b294
-
Filesize
512KB
MD5017875b18e4bfe3bcc8528319fdd1aff
SHA12970ff98b0dda372a266788306b04d5a391aa906
SHA2566f448ff9ff2300dcb6ad44d520e54e6fd4975d9a0fd4d608fb0d700675c6e1bf
SHA51278a9c8b1f8dd3b577167be5ab20cc08a2894bfc554b6bebf0fa0ba8099b61a720af85dcd93b1f76315b012cb5032f6ba0af1f36e8d9e5a34ec5c9851f98cc39b
-
Filesize
512KB
MD5a1dc85581d83144c7274bd36208ea9b0
SHA117d48899a853658cd5d8fe344946e9c7aae13786
SHA2562135a6a8c4be3dbbff0e86aa17b84b0ba0a7382ec04d88763782907256b13ac1
SHA51294c60fa374fee2590af55d432475eb37ed546b43c3dcaf2c2aaa03eb5a90e4f326f0b2845f981ef0e2706dc80d14194474b0d8196319f3338da61729b0865b08
-
Filesize
512KB
MD5a1b6be0ed05a9a1a3c2b48b1eb15396b
SHA1cecac1d54d1cd2b68376eb45043adc4530974648
SHA256d8ab86926314e34b418c1e76acbdd49010f6e6fa150f88b1728c8bb4cc4bc7bb
SHA512ee90513b9fe49d8017c98ac36edc5e50d2060462e5bbd3fa9fa4191c9f6601bb9dcb8d9de686ad0e9c288a5653a98dbde4e8e6eb9d883c013829e170cd66345e
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5b19ab8e0a4a4a0a5543079655ce45a2d
SHA11bba574ffe5abe86db95882d7f682c83eaacff74
SHA256ab3eec112c4bbceda8771e71b2093629cf773982adf2c4283d52f1a88b59053f
SHA5127a6dc59eddcc25965983f859c26bcd307dad39cf5ad3f43014776c88b01290c8e97921285c5af51bfd574e8cc335021608a81cdd42ac1a57a662e82fe8d31795