Analysis
- max time kernel
146s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
16/04/2024, 04:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe
- Size 597KB
- Sample240416-fcp2eahf64
- SHA256 29e9f3cc4143a9573de61bdffa4256b6fb5d92afdc30cee2d5823a3049e95d12
- MD5 f2b809ba93dfa6e034425254f4984dcb
- SHA1 0fd6e30ed9cbda02878ac990f6feda564137ac81
- SHA512 1c5968bd32c4721ba87deaf2e167a1090b0d948d2367877e185ca4ba6d2ca3e12c7f15d8827cbe3378c2ab01785397291d138306f8d78f13f09bfac5e98125fc
- SSDEEP 12288:xQMO0vgK2lEjNLjiK0ZPzl7laL3Ot8hyTBOQBfHlGnkKF:xQMOuEUNLjj0ZbyzOSEOQBfHlG
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\License\Parameters\ServiceDll = "C:\\Windows\\system32\\oeudg.dll" rundll32.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe - Executes dropped EXE 5 IoCs
pid Process 3464 rundllfromwin2000.exe 2716 rundllfromwin2000.exe 1404 RUNDLLFROMWIN2000.EXE 4228 f2.exe 428 bar.exe - Loads dropped DLL 5 IoCs
pid Process 3464 rundllfromwin2000.exe 2716 rundllfromwin2000.exe 1404 RUNDLLFROMWIN2000.EXE 3300 rundll32.exe 428 bar.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Program Files (x86)\\Common Files\\System\\Updaterun.exe" f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\ = "ʵÓÃËÑË÷" bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} bar.exe - Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\krjwe.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\krjwe.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File created C:\Windows\SysWOW64\Score.txt RUNDLLFROMWIN2000.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 RUNDLLFROMWIN2000.EXE File opened for modification C:\Windows\SysWOW64\advport.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File created C:\Windows\SysWOW64\rundllfromwin2000.exe f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\ocmor.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\ocmor.dll RUNDLLFROMWIN2000.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE RUNDLLFROMWIN2000.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies RUNDLLFROMWIN2000.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 RUNDLLFROMWIN2000.EXE File opened for modification C:\Windows\SysWOW64\oeudg.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ocmor.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ocmor.dll RUNDLLFROMWIN2000.EXE File created C:\Windows\SysWOW64\advport.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File created C:\Windows\SysWOW64\oeudg.dll f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rundllfromwin2000.exe f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\superutilbar\uninst.exe bar.exe File created C:\Program Files (x86)\Common Files\System\Updaterun.exe f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Updaterun.exe f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File created C:\Program Files (x86)\superutilbar\superutilbar.dll bar.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f2.exe f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe File created C:\Windows\bar.exe f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{03465FF5-00AE-411a-9C34-960ED566EC03} = "ʵÓÃËÑË÷¹¤¾ßÌõ2.0" bar.exe Set value (str) \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "http://www.3839.com/index.html" f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix RUNDLLFROMWIN2000.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" RUNDLLFROMWIN2000.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" RUNDLLFROMWIN2000.EXE - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\ProgID bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\VersionIndependentProgID bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR.1\CLSID bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\ProgID bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\HELPDIR bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\HELPDIR\ = "C:\\Program Files (x86)\\superutilbar\\" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR\CurVer\ = "6781.TOOLBAR.1" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER.1\CLSID\ = "{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\ProgID\ = "6781.TOOLBAR.1" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\VersionIndependentProgID\ = "6781.TOOLBARLOADER" bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER.1 bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\ = "TOOLBARLIB" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\Programmable bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\ = "ʵÓÃËÑË÷" bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\Programmable bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\FLAGS bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\0 bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\TypeLib\ = "{03D0C547-EBAD-43d9-8B57-DE16E7A93B52}" bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER\CurVer bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR\CurVer bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03} bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\VersionIndependentProgID\ = "6781.TOOLBAR" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\InprocServer32\ThreadingModel = "Apartment" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\TypeLib\ = "{03D0C547-EBAD-43d9-8B57-DE16E7A93B52}" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\InprocServer32 bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\Programmable bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\InprocServer32 bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\FLAGS\ = "0" bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\ProgID bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER\CLSID bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER\CLSID\ = "{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\InprocServer32\ThreadingModel = "Apartment" bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\VersionIndependentProgID bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03} bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER\CurVer bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\InprocServer32\ = "C:\\Program Files (x86)\\superutilbar\\superutilbar.dll" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR\ = "ʵÓÃËÑË÷¹¤¾ßÌõ2.0" bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\ = "ʵÓÃËÑË÷¹¤¾ßÌõ2.0" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\InprocServer32 bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER\CLSID bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\InprocServer32 bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR.1 bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR\CLSID bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER\ = "ʵÓÃËÑË÷" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0 bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\0\win32\ = "C:\\Program Files (x86)\\superutilbar\\superutilbar.dll" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\ProgID bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\VersionIndependentProgID bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER.1\CLSID bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER.1 bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03465FF5-00AE-411a-9C34-960ED566EC03}\TypeLib bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER.1\ = "ʵÓÃËÑË÷" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBARLOADER\CurVer\ = "6781.TOOLBARLOADER.1" bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\VersionIndependentProgID bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03D0C547-EBAD-43D9-8B57-DE16E7A93B52}\0.0\0\win32 bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR bar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR\CLSID\ = "{03465FF5-00AE-411a-9C34-960ED566EC03}" bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\Programmable bar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}\TypeLib bar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\6781.TOOLBAR.1 bar.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4392 wrote to memory of 3464 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 84 PID 4392 wrote to memory of 3464 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 84 PID 4392 wrote to memory of 3464 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 84 PID 4392 wrote to memory of 2716 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 92 PID 4392 wrote to memory of 2716 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 92 PID 4392 wrote to memory of 2716 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 92 PID 4392 wrote to memory of 3300 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 95 PID 4392 wrote to memory of 3300 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 95 PID 4392 wrote to memory of 3300 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 95 PID 4392 wrote to memory of 4228 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 96 PID 4392 wrote to memory of 4228 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 96 PID 4392 wrote to memory of 4228 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 96 PID 4392 wrote to memory of 428 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 97 PID 4392 wrote to memory of 428 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 97 PID 4392 wrote to memory of 428 4392 f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2b809ba93dfa6e034425254f4984dcb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundllfromwin2000.exe"C:\Windows\system32\rundllfromwin2000.exe" "C:\Windows\system32\wbem\krjwe.dll",Export @install2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3464
-
-
C:\Windows\SysWOW64\rundllfromwin2000.exe"C:\Windows\system32\rundllfromwin2000.exe" "C:\Windows\system32\wbem\krjwe.dll",Export @start2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\oeudg.dll",ExportFunc 10012⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
PID:3300
-
-
C:\Windows\f2.exe"C:\Windows\f2.exe"2⤵
- Executes dropped EXE
PID:4228
-
-
C:\Windows\bar.exe"C:\Windows\bar.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:428
-
-
C:\WINDOWS\SysWOW64\RUNDLLFROMWIN2000.EXEC:\WINDOWS\SysWOW64\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\KRJWE.DLL,Export 10871⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\superutilbar\superutilbar.dll
- Size 752KB
- SHA256 9dcd123989a689fc35760150d530106d78e3c00d9ff2971cd30b423c7317e18d
- MD5 7edcdbeb0e9119e20561fb90264e14bc
- SHA1 b9c720e47505ad228b9bddfdde7669d36a30eabc
- SHA512 db2493d7affddf5ee83434f51b1b78b7a0a1accd13d4ce833d28974fb306936a12668ccb3747100084472e2d6d4564dcc75d9b8d8ff48f0c81fe1df2d8c3b2a5
- SSDEEP 6144:0wagLy6dAj/G/MvC9yN0HEcMGX5MqEpVR6zXLQ:0waZ6ejzC9y6BmXR6TL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\WINDOWS\SysWOW64\WBEM\ocmor.dll
- Size 5KB
- SHA256 99abb1ab6a3af62c7c69c02ccdf5ff69b76acd95ccf64ad840b3b0162d8ecffe
- MD5 69dc24ba916e7c621706e8f336cc9e9f
- SHA1 80b269f60a3fb40078d47e2098c6854b24df92e7
- SHA512 ffa757461815ed910c0a31e057e6e19dbb4d6f24c2ca3b3d94b5adb370fd11599b0424903f42c00578ea4d9d9a1cfeac1ef6057737bfcaca457b32fa638cdbd4
- SSDEEP 96:XD4Q/40ymUVbamQ/3kW1kSJaR0ZMFP4fepHQqJ31r6aB654Bed4fl0oaOMjVas:XD4J0yyh/3FQ0SS+HQq11rhB654BlN0d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\oeudg.dll
- Size 231KB
- SHA256 24e911379c3942ebd54c620ea4e12df6caeb1cb2a42f5254a8eeba47343b1e13
- MD5 ccb8fe84f5802e9016c00ebd2968f569
- SHA1 95fab580730159d255c451f2d89f10de830ac5ee
- SHA512 c74f1d7887192dd53a65c60c1b7c073832be7f077f74d71611fc4cdeaf0a562978d8d339a701e46339f82817c861f5c9a528dd945b78e733a8c0f3b1ce7fa4fb
- SSDEEP 3072:R8Mki9AABq1+TQdb12Csc5mp887X7HiZdhlN3AAjn0PWkjXhnyaLr/ttCnQSKllY:uQAGS+TQdZuKoruf3YpnltCnnn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rundllfromwin2000.exe
- Size 10KB
- SHA256 e598bcf79618ab6ab58b29b7a7f3e5fc01ce6c7dbefcaa308565d3d9168249fe
- MD5 4936a6954ed59700a3c706f9094685ee
- SHA1 124edd171bfc8a5c7f5fcf2147f6ff43b705bb79
- SHA512 1ef09ed6a9b22d761981e759fa2089e9c461fda4a46cba66431817bc7b75451d4639e63cd3872a71c3bf123831983590075fc924424833adf0ef491056de32ea
- SSDEEP 192:m+daJ4lecnI7gEdR8bRoHSVQxy5Z2WMwWW9fW:mmaJ4lecI0EKNQxyr2jwWW9fW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wbem\krjwe.dll
- Size 248KB
- SHA256 029f3036148f98c7d4936831763fe3c376f9af68b7341a998ff67ca5413f67b7
- MD5 3886c63333867a34c837591283c287ff
- SHA1 4710b09c50050336065e64a93a69a191e64c98d8
- SHA512 bdc5f7e4464da6ecebfa245c1e583bbfbbdb1ca1ef68d18a19d752c35c73b5d8023a90ca47e26bc27683ec54b52837146465cbd1a8fa011dc406caf094cde786
- SSDEEP 3072:DA4OZfQRbZZkxeJKWdTQbStIxQVomBhrDeAmYutqrOMSddqaTXA6oEsU49fnk1uF:04OZfmJKNS/V331+tqG3TcEsbfKg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\bar.exe
- Size 311KB
- SHA256 5fd497519cc13f9027ef34cb9bb3e9cf2b444694e5567d7dc5c8b060a1f835a7
- MD5 0d636eaf10de0e304d423286f2cfeb57
- SHA1 b333625c738f9816c394f81c824425ac79c081f9
- SHA512 6b46f865b85cfa12aa21bd01eeb69418eda0d215c7133b2d8d9ba7b203a919d4c7641365769f1328281bfc6a638dd2b5da1b351afed10e851183db114aa0d3a3
- SSDEEP 6144:s+Ze0wSjg3RmMdNEClCNKywAVpkuPHTWyJWEIAHSylQFDjYqbNGy:Fd03RmMmEyEazWyJM1BjTGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\f2.exe
- Size 56KB
- SHA256 037c8923891bfa670d62ec0a517865236db0bfb987a02f856b7ce157f57073c5
- MD5 c0c559d16ece9d992359258016fd09ed
- SHA1 d9b1d8f78a5f2b194dbd7f650f6e71f90ef62da3
- SHA512 3bd63cde415e017648f829dbf61045c0d9dd8bdbf07339b555a1143bc14378c3bfa7c1ef4c2dd47809da98798aaba1aa49b5446a04eee610c4e32fdc07944070
- SSDEEP 768:GD6t4Ql0O10Sd9u8jb1y7lo5cjfJfe37iG7rgvUy7J4:GDYKebyyQfqiWyUi
- MD5 SHA1 SHA512 SSDEEP