Analysis
- max time kernel
118s - max time network
131s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
07/04/2024, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
General
- Target e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe
- Size 54KB
- Sample240407-ne863abe3x
- SHA256 7b9b3dee97ab9eccaed357e245bc06d2d2888768c157f6179cb8ae7cfb3923b5
- MD5 e4ce215f310030a47ce1d4d576b131b4
- SHA1 ef3dadccd99f48d01cf05d69c46a4a87f4bd4a50
- SHA512 96ebb191428207b1a67974aa4b2350108970fc2786453d626503c18fdf15c91e24a5878873398b29456a6c6ae9ff568abc23601ce4096d71c29809d1b1ac6c59
- SSDEEP 768:ns8twJnUGh/Jh3bjYUCgFdQggQRhLjAxuDlwJjMrvjSp07C36rThkoO3xL/zCyaN:nLUlBh3bjYUCgFK8wJjp94TClPX5wi6j
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000c0000000122bb-2.dat acprotect - Loads dropped DLL 1 IoCs
pid Process 2552 regsvr32.exe -
resource yara_rule behavioral1/files/0x000c0000000122bb-2.dat upx - Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2FF811E6-8925-4084-A649-C159955E67E8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2FF811E6-8925-4084-A649-C159955E67E8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2FF811E6-8925-4084-A649-C159955E67E8} e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2FF811E6-8925-4084-A649-C159955E67E8}\ e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ascisys.dll e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE057E31-F4D0-11EE-9911-62ABD1C114F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80155195dd88da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4294b90f949a0419d20a4bba0c7065500000000020000000000106600000001000020000000e282312b9280619231853fda47313eba68a2bef563b683787be5fe55377b78e0000000000e8000000002000020000000ceb747de7e4ff089bc409287153a4449a60ee1340b44db0c4b87c815ab96c8d220000000e29bbdec80c9a49ce6c414ebe60fdf5d75eea73ac9449b98399eba08aaab32054000000048c07ad5e8c9951da8bc54bbf4401bd2d9775682d4071aa4a9e3216fe7ead421787db682f112dd36c80f8eef5d66fb7aba568b28b0cdc33762d50458833aab25 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4294b90f949a0419d20a4bba0c70655000000000200000000001066000000010000200000007bd0b058b2582fdb01cbeeebd707d8be11b52ae6bc610c5ab79bfba4646371d1000000000e800000000200002000000035e3939e527a978525ba24166117ec17b7ec95b9a69aaedce40069d613c0cb2290000000a26b6aa33ad247b14c171072ca9a53f65fae3fc6668fd42daf543d7160a8c52f2416dd57c075359c76335f612262b8312a92a2cbd25ee53d471b0c2fcb816af71130c463f6b6f909140ef64b5ae39b12743fc9253e191f6744cec89f9f2d1f7318b218738301f1eada8183f36157577960f29aed2b469463ed9c41bdc231e62bfc59ed60318da9bd16f4151831e61cc6400000000327c4cb59e21e74594d9b9ea25a09919b953c7428ca4f510755e9fa0e9e8929cb8417585df5060036f9dc52d39a8370dc382544223d8a4bb1384707f18a54d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418650655" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe - Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ = "IBhoApp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ascisys.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp.1\ = "WinGold" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ = "IBhoApp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp\CLSID\ = "{2FF811E6-8925-4084-A649-C159955E67E8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\ProgID\ = "BhoNew.BhoApp.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ = "_IBhoAppEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ = "_IBhoAppEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp\ = "WinGold" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\ = "WinGold" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp.1\CLSID\ = "{2FF811E6-8925-4084-A649-C159955E67E8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\InprocServer32\ = "C:\\Windows\\SysWow64\\ascisys.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\VersionIndependentProgID\ = "BhoNew.BhoApp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp\CurVer\ = "BhoNew.BhoApp.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\ = "Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.BhoApp.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2FF811E6-8925-4084-A649-C159955E67E8}\ProgID regsvr32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3044 iexplore.exe 3044 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2024 wrote to memory of 3044 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 28 PID 2024 wrote to memory of 3044 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 28 PID 2024 wrote to memory of 3044 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 28 PID 2024 wrote to memory of 3044 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 28 PID 2024 wrote to memory of 2552 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 29 PID 2024 wrote to memory of 2552 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 29 PID 2024 wrote to memory of 2552 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 29 PID 2024 wrote to memory of 2552 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 29 PID 2024 wrote to memory of 2552 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 29 PID 2024 wrote to memory of 2552 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 29 PID 2024 wrote to memory of 2552 2024 e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe 29 PID 3044 wrote to memory of 2304 3044 iexplore.exe 30 PID 3044 wrote to memory of 2304 3044 iexplore.exe 30 PID 3044 wrote to memory of 2304 3044 iexplore.exe 30 PID 3044 wrote to memory of 2304 3044 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e4ce215f310030a47ce1d4d576b131b4_JaffaCakes118.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://hotvid44.com/bind2.php?id=1xxx39135112⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ascisys.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 2f80f0a9b7b2b3ea693379cc9fba0101b091d5026c388eee8a6f7db35db2a0e3
- MD5 651fe0d50809e6b14cb348278fdf96ed
- SHA1 572bd20a4a19e3256e06e260a7d6d484ad665664
- SHA512 a6798de7ce90081edcab83857987b1f18b3e7c57ac6a1b5884420f053e7772bc21a7b17545549add0cdabfbc284f91d6678b9798cd664f16e7de18a7363935e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 561afd1c49122172e3a783502e141005f2265aae145b8336944e7c16a92d0218
- MD5 278b626a786b9bc19df9e9da5a571ac0
- SHA1 e8f98c91fe0c55bac1d6098d9ca5e032ec3e4513
- SHA512 b433d6a0dd01b0ab2dd7df6cfb7e838cfb6eefe00448a125469a2122f5dceb1b867ce2e92f43b60af1d7fb16bc00d0d3a1e80415500daaa96cf33f64311eed4c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6f02e2ee9a0d57941af65bca1c9ff53be4818d784aea73705aeed72cd2a262b9
- MD5 7c0153da7444e3e3d75b8cd6251ef843
- SHA1 270ab03d196d193581f1f6c1c331882422efeac7
- SHA512 9369ab3fa72f5e35e95e3efdff227bbe7bd49b37d8f7f8f3596e3ae06645f63dac47ed0f91861d8ab46f62d9d393c208aee31e5dc900428b9892d9d4c1713671
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b350c80c1da2bdd80f9c3b0575edc1bdcd2f1385740520a73ee88292cf4bfc62
- MD5 01659208fea9d39c683d11d0f4d67bcf
- SHA1 0c1c563fb9b36549af27052d9fb19b5b63672645
- SHA512 857056a6916367099cfed5198d370dbcf28c03e2024b251bc319fd9e83e418c8f00175b07e33435431d88a6f681aedadad3efd90e9be0b87beeed42c0135e5ec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 0f8ad7630a32d53bd049edaef2553bff67fccef143b8c916f296d5d36e2c260e
- MD5 dbfb97908104cc307369a9e002af3f4b
- SHA1 dd6b940931081a97a261de23cb06b6f0b56752d0
- SHA512 aca379bfd4fd0f7ab9bf5600e34a055c15bb68fc8257f972b0bd4c7201e5c3f707a83cdf5a856c94cbe0ab6fc6013e9b083507dad771797bee991da390653305
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 9e26bf36dbb2a003fc7d5df90fbbcdd25d85060ce5e049ecdb6635f64f9e50ca
- MD5 71d96d9f810543e900692d72c95b6d09
- SHA1 c81552a4bd4ace069653169cf6fc9fad2443105e
- SHA512 03450837981d967049b0fa88dba8724879f077b1488b32676e6571c2ee173c8b1e810548ce6a960f472ac06438098db4b3c12d9cfbe58c3f9206a0ee203ab352
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8d6ea53e71565a4c2e6674a08e6c62a412718ff716c0fb1e504077e1d5a3d769
- MD5 dc3778880b548924165132900c80fb0b
- SHA1 4ed68825810c58aaed71dca43e123b8f3418d03a
- SHA512 a73943bc387009a04a3ead8b89929d1b96d26b750cf3f2a8c37ebfc94df6526551885e3600761ebb52d314b43e5b4a42cfc0bbe5ab926d18849c181bf6ed31af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b3d1679ba593e5ca38f69d46e21ed3b827f258ad0096b6832d26571a49e96061
- MD5 25952bc33cfea95d33ec8c7aec4bca25
- SHA1 23d62bcb522f98cde6b788ac90447aadab258642
- SHA512 c7822a04d5cf4e7e473a17f93cc9230dd975d061577f7dc93fab45c516143693441f2dcf5fd9d59eaad6989a9138087fa9a7bb985e1a6cf2030c310368cfa647
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e07961a26b416d5ba65a3f83ed993beb7d2f533d9093e10bd970969076f1eb34
- MD5 e14158e6f9425e809e7f824a4f5cf838
- SHA1 14434a0f4b2f12c6a4f6615fd33daa589050cd7a
- SHA512 4591f42cfbece6b794e175431e96185a56df7ed715a0d59325f03aefdaf24b873cae04371deddea03dcad2e67e297ad612850272591b1bb2bd1a6a68287fbf5d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e2d635b5b7cbf3ab9d067752da510f7753f7109226a382360cb72adcf7205dda
- MD5 96a157b260a49a0f3f72e9e34c6218a7
- SHA1 731ec83d85a4e54aba9812363140cdf7139c01b2
- SHA512 81fbbbd41968b1848e93aeaa4284a89beefa442979715d8adc0be27ed6c3ce38e243cad905a2fa76af7c751e3fb92d3e1393a750fb7666ca9e70ec5ad87c7b40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 7aea3ed1320b8f1b4d26fafe173bc1713513b209c8d4ef370b3da7690ad8afdb
- MD5 473e7be4fd8632378d4e6ce8b065c843
- SHA1 3ee03cdcdfccebdf852a3daa24550c217c2e2052
- SHA512 bbfe8ff2b7263cd480fa62a635ae843b7c59f7b38def961ec94a9358126a20ae3f6205532b432756eb320a737bdda53bf35db7a6081b12901b1fa0579a5fd760
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 7812198f61ac34b21ce201b7e16b6b2ea01a1929ad47891095cf3ebebba34e5f
- MD5 008c5580dd9e74e7db9bf43a359dda08
- SHA1 d96a6f9ee20b550f83551717d057116e9e30466d
- SHA512 4913d1500486c9eece27d50fa9097bae19cbbdef9a753c957968a11d43fd25f47c895755ea97dab9c8e00e7497b14a3c562256cf5afe5db8b964121006b93da9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 0613cfc544aa4077b72010b236251a6499aad15346fc0a184480e4f26909f17a
- MD5 e8da470e351451de60d2a653ce4fc36d
- SHA1 e2c43a708a08e6359e510a2c598bde700cdfadda
- SHA512 db0fb1a9bcf9314518a9170c81c4bdd7adad58bb38489e19ecf00a45cf1bc431df339e82e4a33614c704d32ba68c52218bf4a6c28e23c3169da0c218563ebb9d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3393f80acee17d579bc6f6b58ab4b067a215c7b3425a3e01274faf0e94ea382e
- MD5 bd390c93d7b041fee5a894a86dfce137
- SHA1 baac64803cb1d7f0f91c0f44ef70cdf25a99b549
- SHA512 b0a0067104660ea7d0c587ce61be512f708df4b9847d252cb0afd756a582a255778c7a0ad6945d91e13391457ff59181ff130f01dc6900e39089fabfa4ad2f96
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 9572ffb488be8a02e8c898d8acb35d015884bc3ccc7afee2736ed3ed871b9779
- MD5 c121c6a4ed7e3d1693a1ce862752d6d9
- SHA1 df32ac4b897c40ad6bdfd50daf748b961bb503a5
- SHA512 623b58105e45b7089feac22aa9c507ce8414fc5cfa4cad87d7c68ee43f8cb755ed8544e736829b6718d7656d85080569db4895fcd37da4b509b873662d7661d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4f6e001e41ba0a5b2c13414c65c1fd129342ef0dea65c02a71f86b54a40a8d0a
- MD5 66e9a70db0fde15e887a832287067cef
- SHA1 c7ed05fc41df80973df25ca3aef5b62ebc4a9343
- SHA512 eac717b683dd95c908a708e9d3f7787fde95a7a8d0bced30d44e6f4365303503837499fe7fe3fa4a1b03eafe27e63d61ea24391a5a1f2eda07f6a16ff87904f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2fdbb68ae9f84307b01d2d03052430a25aaafbc58bd248b5aaecdba9f155657a
- MD5 3b01654b428a091ba8984c77b8065869
- SHA1 8f35177bcd12d3302e8737be351aad2cfc86cff7
- SHA512 a92040c81a9f0b9a1ac16b21b5b556bcdec274506254d8ae3ac5ead07f8eecb543a7a7a4a110edbecc2ebd2f596137dd3099779276560cffbd5f0e17ace05254
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 0c8d033f3737afa7eeb097167453d6fadb5f6ef1b05dedfc74038616d43bac54
- MD5 61efffe998172314708c0ff6d22b23d4
- SHA1 487e0a084127de4096ddaa5989caac73f20b78f6
- SHA512 27392acd1315b065855fd0415befdf430db3adc85fa15305500578479fff4d9a5c659535eda805fb35be90e3a3494c263b184b7e37f509519b23fa2929f66e54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2ca3f4497b5af72c2fafaa16b0ab240a3338eee2c1a0832489e2e4ab3d34a814
- MD5 531cd0a845faa897adc85c4c6da360cb
- SHA1 7ebe38b543675ee5366faf9dff99fba88c479998
- SHA512 71b8cbf52bd54fd28f58af45668098d2620a0521132d38c1d016774cf8224a601b968a24a0c5edfe3dc07a4fec669f920552349e536b9291dd3d06abe580d3cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 5ad3f1b97621413aa23d7456d0d8f9691949242cc42fe7a0a7ade55e871a7b5c
- MD5 07038af1131590338ff0b3d44aae548f
- SHA1 f128f2730ec1f021b1a89a4917b59e0552bd8c14
- SHA512 de384cdff15256fee8d52849f494618dcf117112ab29bf9d2b9903ffe75a1577287c3663dd174024f087afdcaf506743519e2cdfba7bbb9477ef9119c01b8888
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 02c200b5b4218e44f555ee9083cda19904cfe8c786081757471b403e28fba689
- MD5 cc3df7eac67fc5c355e3043dbf0e7051
- SHA1 e1d5272f0817083a0d51085d45cd3b5c8ca00645
- SHA512 a61934a8d59f79afc69dc6b74e089ea739b79a7157f82bd12f5e38efb6fb720c2dccd259c6c17f7da9342533ce64f9d2a4b3cdc97690274dab4442695e8fb3ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar328B.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ascisys.dll
- Size 17KB
- SHA256 8c8682b0ded3d56afa63463cf05f9427b8936f701d538eb51cceadefc3e28bf3
- MD5 2bdbf02a42e254b990acb3659d403589
- SHA1 a2a69dbb7aa630c0ba46e7a2d0896320d721a6d3
- SHA512 21a8f7dbdfcba8cbda4d11fc2471bba789c00485fe9b38511ea60e2652a815f59625d05018c4c89bbbb8cbe653bf16e34f89a29cf98331dc3a1b5b41463e0cac
- SSDEEP 384:FkoVYB/RtqIRLaNeCeCBsNfaaTBlwi29DiivRz:FkoO3xL/zCyaaPwioz
- MD5 SHA1 SHA512 SSDEEP