Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3f1d4115609...18.exe
windows7-x64
7f1d4115609...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
1$PLUGINSDI...sh.dll
windows10-2004-x64
1$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$TEMP/~nsi...86.dll
windows7-x64
1$TEMP/~nsi...86.dll
windows10-2004-x64
3Cloud-Web_2_86.dll
windows7-x64
6Cloud-Web_2_86.dll
windows10-2004-x64
6Cloud-Web_2_86.dll
windows7-x64
6Cloud-Web_2_86.dll
windows10-2004-x64
6Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
1Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
1Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
3Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
3Cloud-Web_run.exe
windows7-x64
6Cloud-Web_run.exe
windows10-2004-x64
6Cloud-Web_run.exe
windows7-x64
6Cloud-Web_run.exe
windows10-2004-x64
6Cloud-Web_tb_2_86.dll
windows7-x64
1Cloud-Web_tb_2_86.dll
windows10-2004-x64
1Cloud-Web_tb_2_86.dll
windows7-x64
1Cloud-Web_tb_2_86.dll
windows10-2004-x64
1cloudidsvc.exe
windows7-x64
1cloudidsvc.exe
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 20:11
Static task
static1
Behavioral task
behavioral1
Sample
f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$TEMP/~nsis/Cloud-Web_nad_2_86.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$TEMP/~nsis/Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
Cloud-Web_2_86.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Cloud-Web_2_86.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
Cloud-Web_2_86.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Cloud-Web_2_86.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
Cloud-Web_mime_2_86.dll
Resource
win7-20240319-en
Behavioral task
behavioral16
Sample
Cloud-Web_mime_2_86.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Cloud-Web_mime_2_86.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Cloud-Web_mime_2_86.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
Cloud-Web_nad_2_86.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
Cloud-Web_nad_2_86.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
Cloud-Web_run.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Cloud-Web_run.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
Cloud-Web_run.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Cloud-Web_run.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
Cloud-Web_tb_2_86.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Cloud-Web_tb_2_86.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
Cloud-Web_tb_2_86.dll
Resource
win7-20240319-en
Behavioral task
behavioral30
Sample
Cloud-Web_tb_2_86.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
cloudidsvc.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
cloudidsvc.exe
Resource
win10v2004-20240412-en
General
-
Target
f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe
-
Size
587KB
-
MD5
f1d4115609ebdba98586dbcadd5cfd27
-
SHA1
f3900de98053c1cd44e6df41867fda507814daba
-
SHA256
7886e911d79668ca934c87d8612f3722fe9be00efa23785940f836d4f37b5373
-
SHA512
f9c137ca7455b20558d350c73d2633e89e40c45c9b07d52fff531f67d47efa8ea95d5810a545437e7473e8a907262b8dc15e38340702b91035152c8974b79af0
-
SSDEEP
12288:JMTbLIlQhBaUFP9QVKjHtzp7F2tpeOEnNsViTeyJgu:eXLe4zFPzBl7F2P6N4iv
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 392 cloudidsvc.ex_ 3580 cloudidsvc.ex_ 2212 cloudidsvc.exe 4932 cloudidsvc.exe 3576 cloudidsvc.exe -
Loads dropped DLL 14 IoCs
pid Process 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\ = "CloudExs40004APIClass Helper" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_nad_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_tb_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_nad_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_mime_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\uninst.exe f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_tb_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_mime_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Cloud-Web\Log\cloudweb_up_20240415.txt cloudidsvc.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_run.ex_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Cloud-Web\Log\cloudweb_up_20240415.txt cloudidsvc.ex_ File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_run.exe f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\cloud_uins.dat f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\HotIcon = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll,202" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Default Visible = "Yes" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ButtonText = "Ŭ¶ó¿ìµåÀ¥ ¼³Á¤ ½ÇÇà" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Icon = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll,201" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ClsidExtension = "{053202B5-4539-4c5a-B531-42C754ABBD41}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cloudidsvc.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML.1\CLSID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\Version f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\ = "CloudWeb Web3.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ProxyStubClsid32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0\FLAGS f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0\0\win32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib\Version = "1.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\VersionIndependentProgID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\ = "CloudToolbarObject Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\ProgID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs40004BHO.CloudExs40004APIClass f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs40004BHO.CloudExs40004APIClass\CLSID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs40004BHO.CloudExs40004APIClass\CurVer\ = "CloudExs40004BHO.CloudExs40004APIClass.1" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\ProgID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\InprocServer32\ThreadingModel = "Apartment" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0\ = "MimeHTML 1.0 Type Library" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ProxyStubClsid32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs40004BHO.CloudExs40004APIClass.1\CLSID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\ProgID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML\CurVer f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\TypeLib\ = "{EA3B666E-8A3C-4099-B499-E0A277279117}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\InprocServer32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject.1 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\VersionIndependentProgID\ = "CloudToolBar.CloudToolbarObject" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\InprocServer32\ThreadingModel = "Apartment" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\FLAGS\ = "0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\0\win32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\CLSID\ = "{053202B5-4539-4c5a-B531-42C754ABBD41}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\Programmable f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ = "ICloudToolbarObject" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib\Version = "1.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML.1\ = "MimeHTML Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ = "IMimeHTML" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ProxyStubClsid32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ProxyStubClsid32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Cloud-Web\\" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0\0\win32\ = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_mime_2_86.dll" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\VersionIndependentProgID\ = "CloudExs40004BHO.CloudExs40004APIClass" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\FLAGS f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\ = "ICloudExs40004API" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML\CLSID\ = "{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\ProgID\ = "CloudExs40004BHO.CloudExs40004APIClass.1" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\HELPDIR f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0\0\win32\ = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\InprocServer32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib\Version = "1.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\CurVer f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\InprocServer32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0\ = "CloudToolBar 1.0 Type Library" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ = "IMimeHTML" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5096 wrote to memory of 392 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 87 PID 5096 wrote to memory of 392 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 87 PID 5096 wrote to memory of 392 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 87 PID 5096 wrote to memory of 3580 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 88 PID 5096 wrote to memory of 3580 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 88 PID 5096 wrote to memory of 3580 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 88 PID 5096 wrote to memory of 2212 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 91 PID 5096 wrote to memory of 2212 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 91 PID 5096 wrote to memory of 2212 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 91 PID 5096 wrote to memory of 4932 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 92 PID 5096 wrote to memory of 4932 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 92 PID 5096 wrote to memory of 4932 5096 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_"C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_" /stop2⤵
- Executes dropped EXE
PID:392
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_"C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_" /u2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3580
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe" /i2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2212
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe" /start2⤵
- Executes dropped EXE
PID:4932
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD5f5e11bef483ed3b0c2436099a61b090b
SHA1fbf8fb0a380d69ab83365a0f9dfb9d6aa89ca0c8
SHA25602ff072273315997902c1aaa97d111d99e75bc4624e9b2a3f801d469d9a6bf3f
SHA5129d7ebcc4e7a6cc3049b90a30d9ab1c7dc23307c4050b79b4de7cb407130424a49222e9ceefd09016f74e7306b87f164c6d91b8adb9367b01eefe91005b24f5f9
-
Filesize
210KB
MD5e03152320af546785839f21cefd28ce1
SHA17264e5753bb5313b9ceb69d05c15e000ed938559
SHA2566807aee8007988c5409a947a526c187c66e349886399541454800ce2a99c2442
SHA51293681775e96cb80b8cc4b89c788902f5070497c5a0120c0ba965c14e651ab3726387bc0d3f8feeaf315ae45bd7bf40bf37f1e2fd379b89bc812c9dd2fdfefb5e
-
Filesize
127KB
MD5f58b43fe184e6e6617b543d6e328db4b
SHA15c3c21cbcfe750102766d4e3a0d2023080900948
SHA256fa1d28539f809a9333959b0ce12625e0b1282f8eab2effb9743f907f4a9cdd2b
SHA51220ee54ea0e4a6473aa3171eff5f18141fca5145c562cf7b72283ceacf3f796352d07b9cb22f7ad46268df0cc1916a4b02a3dce862c58e4cfab87e16c36bf1059
-
Filesize
127KB
MD5fba59862b8e2d049b64c10af254f93a9
SHA1712e432e17c744063995d45195b4a918c72f4790
SHA256a1685530939b91cd4ab1d34a72bada8d41ef708754d829a1c24e6ab4b0e4b530
SHA512cda0082126615957c1572142502a278fe5e80fed8bdc2bf674011039dbfa07066e7768355c8dcbeba316f917ce081ba7c2923f7534c2ab99ea606cdd61781086
-
Filesize
304B
MD5297afc7d75aaee7979b743097a8419fc
SHA1a1254bb0da1b33da709204d81bdfc3f4c81ca6d9
SHA2569b559ea8dbea950cec04b3dbe858d83d22366960e32f2b6b8015929441e74721
SHA512c6b3ae7512b2ffabfb850fd9e6b814b7da2687952c0b7e0482270e1525cbcbd016b80260c1f1ab911bdb95ef908f3498763c1f053efbd8ce705899ae9ce7f260
-
Filesize
107KB
MD5a839f8672617d05b4c2937b99e925ee7
SHA1fd47813200d810ae7751f1e18e09bc162fc7b3fb
SHA256799bc692e8eeb52f466aa52e3207be5dff2ad83e761402b8877227bbfad6cc15
SHA512d1f4a23eab71a87cbf079e3d5b4eb9bc2cea94a2f40ce40ee5dd4097873ff32b598d315d3426ad6a755b9d6a7c6d6bc430b8f173d84535ead8776479c4f6f727
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
8KB
MD57ee14dff57fb6e6c644b318d16768f4c
SHA19a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA25653377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
SHA5120565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
-
Filesize
4KB
MD58f4ac52cb2f7143f29f114add12452ad
SHA129dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA256b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
SHA5122f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
-
Filesize
631B
MD5d68e763c825dc0e388929ae1b375ce18
SHA17951a43bbfb08fd742224ada280913d1897b89ab
SHA25625cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd
SHA5121e146e2631a4f3bd091905ccc10ed1054700349648cd52aad24eaeeedff0fac4b44b6212284a6d0855942ff16308c66402ecb895e68ef1c66dcd496973043cdb
-
Filesize
551KB
MD5ed69beb49380916ea57113b0a0c924fc
SHA12ab7472804ef54e168b31614c25a45e322eb43e7
SHA256b5de4af37fdb5723161b48306857e1bf4b95df7b46403499012c35c86cf0170d
SHA512bb3b5cce79d7576917e039e4476f7a75fe8ec64681e3c9267f1aa295e6888a92852ca45318a2fec8b350fbc962f766dddaa75c13b6e0c6bf760a3bc479a1fbdb