35631e05faf661e1105c3506e2b0d88e8abfa48041845bd29b74ac55088d4926

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
Size 282KB
Sample240408-lfhdmadh53
SHA256 35631e05faf661e1105c3506e2b0d88e8abfa48041845bd29b74ac55088d4926
MD5 e72465c332e78d946bfa29e7ef836a9f
SHA1 f5c6d73281c06700241d02c898cc80f57f19f809
SHA512 057cc0315af73bf3bd027cc8274e3047dca6c812b429a159c1c8e5e4e0f672f2a8eed007951514d164ae764e1e8870961fe6b0ee379aa8cef9f7652de9c6b8dd
SSDEEP 6144:se34L675+ZPPfnE2Qyn20UA5ibYMYC/gMXG6lCHBL75+ZPPfnE2Qyn20U:I6F+ZPPfnEUnhwMhLF+ZPPfnEUn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023214-66.dat	acprotect
behavioral2/memory/640-69-0x0000000074B50000-0x0000000074B59000-memory.dmp	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1076	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
4764	FineTop.exe

Loads dropped DLL 15 IoCs

pid	Process
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
5012	regsvr32.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
4764	FineTop.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
3952	regsvr32.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023214-66.dat	upx
behavioral2/memory/640-69-0x0000000074B50000-0x0000000074B59000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FineTop = "C:\\Program Files (x86)\\FineTop\\FineTop.exe"	FineTop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBF53489-AD8D-4637-965A-413861EEC7CF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBF53489-AD8D-4637-965A-413861EEC7CF}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{CBF53489-AD8D-4637-965A-413861EEC7CF}	regsvr32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 1076	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	99

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FineTop\FineTop.exe	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
File created	C:\Program Files (x86)\FineTop\adc.acc	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
File created	C:\Program Files (x86)\FineTop\Uninstall.exe	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
File created	C:\Program Files (x86)\FineTop\FineTop.dll	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\ = "FineTop 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\0\win32\ = "C:\\Program Files (x86)\\FineTop\\FineTop.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID\ = "FineTop.TopBand.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID\ = "FineTop.TopBand.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID\ = "FineTop.TopBand"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ = "ITopBand"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\FineTop\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\ = "TopBand Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ = "C:\\Program Files (x86)\\FineTop\\FineTop.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ = "C:\\Program Files (x86)\\FineTop\\FineTop.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ = "FineTop"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib\ = "{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\VersionIndependentProgID\ = "FineTop.TopBand"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\ = "TopBand Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\ = "TopBand Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\CLSID\ = "{CBF53489-AD8D-4637-965A-413861EEC7CF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CBF53489-AD8D-4637-965A-413861EEC7CF}\ = "FineTop"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ = "ITopBand"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand.1\ = "TopBand Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1AACA8D-4899-4D6C-B360-403A5A20B5D2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineTop.TopBand\CurVer\ = "FineTop.TopBand.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3E54C6DC-A2C6-404C-A36F-DE346281B3A7}\1.0\FLAGS	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe
4764	FineTop.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2700	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	86
PID 640 wrote to memory of 2700	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	86
PID 640 wrote to memory of 2700	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	86
PID 640 wrote to memory of 1348	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	88
PID 640 wrote to memory of 1348	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	88
PID 640 wrote to memory of 1348	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	88
PID 640 wrote to memory of 4952	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	90
PID 640 wrote to memory of 4952	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	90
PID 640 wrote to memory of 4952	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	90
PID 640 wrote to memory of 216	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	91
PID 640 wrote to memory of 216	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	91
PID 640 wrote to memory of 216	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	91
PID 640 wrote to memory of 2396	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	92
PID 640 wrote to memory of 2396	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	92
PID 640 wrote to memory of 2396	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	92
PID 640 wrote to memory of 1444	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	93
PID 640 wrote to memory of 1444	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	93
PID 640 wrote to memory of 1444	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	93
PID 640 wrote to memory of 5012	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	94
PID 640 wrote to memory of 5012	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	94
PID 640 wrote to memory of 5012	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	94
PID 640 wrote to memory of 4764	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	95
PID 640 wrote to memory of 4764	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	95
PID 640 wrote to memory of 4764	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	95
PID 4764 wrote to memory of 3952	4764	FineTop.exe	98
PID 4764 wrote to memory of 3952	4764	FineTop.exe	98
PID 4764 wrote to memory of 3952	4764	FineTop.exe	98
PID 640 wrote to memory of 1076	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	99
PID 640 wrote to memory of 1076	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	99
PID 640 wrote to memory of 1076	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	99
PID 640 wrote to memory of 1076	640	e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe	99

C:\Users\Admin\AppData\Local\Temp\e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e72465c332e78d946bfa29e7ef836a9f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\InfoTab\InfoTab.dll"
  2⤵
  PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\PlusTab\PlusTab.dll"
  2⤵
  PID:1348
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\SmartTool\SmartTool.dll"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\TopGuide\TopGuide.dll"
  2⤵
  PID:216
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\InfoWise\InfoWise.dll"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\WiseBar\WiseBar.dll"
  2⤵
  PID:1444
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\FineTop\FineTop.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:5012
- C:\Program Files (x86)\FineTop\FineTop.exe
  "C:\Program Files (x86)\FineTop\FineTop.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FineTop\FineTop.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:3952
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  - Deletes itself
  PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FineTop.dll

Path C:\Program Files (x86)\FineTop\FineTop.dll
Size 130KB
SHA256 407a5ed628dbd6f1c2cea2276b4ea98f053160dd6f5ee3007dcbad02382a1a77
MD5 82a6904974f4f20c147fce776663b1b0
SHA1 eee8e0a93cb1be3dcfef2699f154f0881e68dda4
SHA512 50dfb3c8e67e1ef794f3dd1b4caaa515bfe342e17e4bb73dd2b1e58a2ac61e327bed2395c1f36d8f2a69de8c5a73ce03eda03a9c0c5515b5965191edfb22c005
SSDEEP 3072:KKkpqCWz8mt3aIJWmKk0T7gHiZKgKUxnPhfgafdg:KK1CkWnYHi4N0Ph
MD5 SHA1 SHA512 SSDEEP

Submit Download

FineTop.exe

Path C:\Program Files (x86)\FineTop\FineTop.exe
Size 42KB
SHA256 6e0d4e65b147d69b249c40c1f9cc5ea82ae3179777bd25462eef3449d3bbbdb8
MD5 61c81941b91b1d502971bd42a29806a1
SHA1 72ee7b2fb665f01415a00267cbc1a5d385d1f0cf
SHA512 0583df8495ed3c252713bfa2b0b38b9a2aac8ce22ed5e50e42cf5a7d94e903e605614a5ab507a0b10497f434759c945eec7ae1f124f530fe3d488f4ec661de7f
SSDEEP 384:kVhtux58TuX+ON45/EoF0naexusdPq18W/07c4xp5/SYJLuPkCQub:kVhtY8TuZN45NF0rnkH/0A4x/7LuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

adc.acc

Path C:\Program Files (x86)\FineTop\adc.acc
Size 28KB
SHA256 aa3c21a88e93709f149284cc17a37439d3f7f90b785119fee5ef330902718b65
MD5 72b966950a0f53df4ce2fdb19679c3c6
SHA1 ccfff4ecc68608a6231e75e175d2aeba62d37fa5
SHA512 84149a210748bc45f02d7f5e12b37e91eba44500d7222efaa46228b1330ffe0dfc1efbb612a67a562ddffc3048ba5d67426b739ac950e8da27f0ee9e86707e33
SSDEEP 384:xxTVtRNRKHo10g3UW3XRzmXqpt35aASxmTOtXJk4vJYJLuPkCQu3F:xDMo1f3UIaXqpt3DHTOtZkFLuDfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

IpConfig.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3C00.tmp\IpConfig.dll
Size 114KB
SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
MD5 a3ed6f7ea493b9644125d494fbf9a1e6
SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3C00.tmp\NSISdl.dll
Size 14KB
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

Submit Download

SelfDel.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3C00.tmp\SelfDel.dll
Size 4KB
SHA256 281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
MD5 7cff7fe2caea5184d98c147e7e263132
SHA1 21f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA512 fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
SSDEEP 48:CzHDh3jgWMynQfXKsJ3eAn67wN4VDm0pmoZSeJY8JTaCILFoyTFS7lWsaEaSueq:S18WMynkXKOOATEVUPnS7s9TShqTM
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3C00.tmp\UAC.dll
Size 13KB
SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
MD5 29858669d7da388d1e62b4fd5337af12
SHA1 756b94898429a9025a04ae227f060952f1149a5f
SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3C00.tmp\nsProcess.dll
Size 4KB
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

Submit Download

memory/640-69-0x0000000074B50000-0x0000000074B59000-memory.dmp

Download