7914966d04455dab1927ea3d4f117810a5a6113e3fb9ca79c6b1ae7d02ccf434

General

Target

fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
Size

548KB
MD5

fb80a7c65b6bf20d9479ef3f5d112592
SHA1

f6119d5d80ef4527ccc3514ee04883789a70336a
SHA256

7914966d04455dab1927ea3d4f117810a5a6113e3fb9ca79c6b1ae7d02ccf434
SHA512

bbb6a2a2cdbfe3a9a92d57b792b0912400c25c7cab10fbd007b82582ca81c4c449d3c20cdda246aeb4fcfee0a554c84a144bddd00dea93fc0b00eb250ec1303f
SSDEEP

12288:L7l4s3shTJBJbI3HfdVQyBc+pQ5KA5QzDP7+FxJvjaVbkbJHURZbK:LGs3qTZbIXVVPe+pE/2D7EvSbkbdwG

Score

8^/10

adware bootkit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

bffd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts bffd.exe
Executes dropped EXE 3 IoCs

Processes:

bffd.exebffd.exebffd.exe

pid process

2960 bffd.exe
2464 bffd.exe
2356 bffd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	bffd.exe

pid	process
2960	bffd.exe
2464	bffd.exe
2356	bffd.exe

Loads dropped DLL 49 IoCs

Processes:

regsvr32.exefb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exebffd.exebffd.exebffd.exerundll32.exerundll32.exe

pid	process
2680	regsvr32.exe
2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
2960	bffd.exe
2960	bffd.exe
2960	bffd.exe
2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
2464	bffd.exe
2464	bffd.exe
2464	bffd.exe
2356	bffd.exe
2532	rundll32.exe
2532	rundll32.exe
2532	rundll32.exe
2532	rundll32.exe
2716	rundll32.exe
2716	rundll32.exe
2716	rundll32.exe
2716	rundll32.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe
2356	bffd.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "Microsoft User"	regsvr32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

rundll32.exefb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exebffd.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	bffd.exe

Drops file in System32 directory 19 IoCs

Processes:

rundll32.exefb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\14rb.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\1ba4.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\4f3r.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\144d.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\4f3r.dlltmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\3bef.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\a1l8.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\25-12865-117	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\a1l8.dlltmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\b4cb.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\841e.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\8b4o.dlltmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\12cefb	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\34ua.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\b4cb.dlltmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\b3fs.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\8b4o.dll	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bffd.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe

Drops file in Windows directory 13 IoCs

Processes:

fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\8f6d.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File created	C:\Windows\Tasks\ms.job	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\8f6.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\6f1u.bmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\a8f.flv	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\a8fd.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\4bad.flv	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\a8fd.flv	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\a34b.flv	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\f6f.bmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\f6fu.bmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\bf14.bmp	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
File opened for modification	C:\Windows\14ba.exe	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe

Modifies registry class 47 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID\ = "BHO.FunPlayer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\8b4o.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer\ = "BHO.FunPlayer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID\ = "BHO.FunPlayer.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\ = "CFunPlayer Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\ = "CFunPlayer Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "CFunPlayer Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ = "C:\\Windows\\SysWow64\\8b4o.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\ = "BHO 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bffd.exe

pid process

2356 bffd.exe

pid	process
2356	bffd.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exebffd.exe

description	pid	process	target process
PID 2820 wrote to memory of 2740	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2740	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2740	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2740	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2740	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2740	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2740	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2640	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2640	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2640	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2640	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2640	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2640	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2640	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2636	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2636	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2636	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2636	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2636	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2636	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2636	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2588	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2588	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2588	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2588	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2588	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2588	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2588	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2680	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2680	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2680	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2680	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2680	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2680	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2680	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	regsvr32.exe
PID 2820 wrote to memory of 2960	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2960	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2960	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2960	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2960	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2960	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2960	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2464	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2464	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2464	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2464	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2464	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2464	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2820 wrote to memory of 2464	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	bffd.exe
PID 2356 wrote to memory of 2532	2356	bffd.exe	rundll32.exe
PID 2356 wrote to memory of 2532	2356	bffd.exe	rundll32.exe
PID 2356 wrote to memory of 2532	2356	bffd.exe	rundll32.exe
PID 2356 wrote to memory of 2532	2356	bffd.exe	rundll32.exe
PID 2356 wrote to memory of 2532	2356	bffd.exe	rundll32.exe
PID 2356 wrote to memory of 2532	2356	bffd.exe	rundll32.exe
PID 2356 wrote to memory of 2532	2356	bffd.exe	rundll32.exe
PID 2820 wrote to memory of 2716	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	rundll32.exe
PID 2820 wrote to memory of 2716	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	rundll32.exe
PID 2820 wrote to memory of 2716	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	rundll32.exe
PID 2820 wrote to memory of 2716	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	rundll32.exe
PID 2820 wrote to memory of 2716	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	rundll32.exe
PID 2820 wrote to memory of 2716	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	rundll32.exe
PID 2820 wrote to memory of 2716	2820	fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb80a7c65b6bf20d9479ef3f5d112592_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\a1l8.dll"
2⤵
PID:2740

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\b4cb.dll"
2⤵
PID:2640

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\4f3r.dll"
2⤵
PID:2636

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\8b4o.dll"
2⤵
PID:2588

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s "C:\Windows\system32\8b4o.dll"
2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2680

C:\Windows\SysWOW64\bffd.exe
C:\Windows\system32\bffd.exe -i
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960

C:\Windows\SysWOW64\bffd.exe
C:\Windows\system32\bffd.exe -s
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32 C:\Windows\system32\841e.dll, Always
2⤵
- Loads dropped DLL
PID:2716

C:\Windows\SysWOW64\bffd.exe
C:\Windows\SysWOW64\bffd.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32 C:\Windows\system32\841e.dll,Always
2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\h8nil4o8\b.dll
Filesize
224KB

MD5
e8c37e48e853d777cfe4db3cf548e915

SHA1
bcd773541f03eb21874dfa00c03fbf48f8f4f22c

SHA256
50f43d5132686ac4bf27ec2db5433557aa8cf45fa4ef56eceb37a1627811ff88

SHA512
647af797b58af10bf8c5a35cfcd5126b0ec27d4635852e1393b53df35b2e7188d73331251d1323d05486008672ec4068b462666db300881e05b615b8af717c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\p.dll
Filesize
420KB

MD5
30cb347361e00ca56e0f7cf9342912d5

SHA1
a8932045718b584ae4cff8ede0748ead21c35281

SHA256
01c65505197823ac602e6c40721cb9e8b455809791952acd550a9e8b64e23120

SHA512
7c8e1aaff60471cab5a43deefffb17d8d1eb7f1fdf9a1fc7f059f8e911d6feaed7448eb7e0bd7f66fb208a1bfda6195e46c3deb6ef7da63580746568f1a908dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\s.exe
Filesize
128KB

MD5
5b75e3c2e589f0722f33786364dee102

SHA1
db999965cd3ead5bfd4ef239ed0d168dcaa58496

SHA256
d2e626f17842fa72c8f009198d1256ff81a71237022913fb5ccb2bbda38c2371

SHA512
dd9c8b83966c3deed13471df206e8c7923c59ab7b761e9a6b5ffa40d4e9cdfbeab58c715393a85d9c8d4c131d2f8c4a982eb01c4e105bf845a12a5f290ec821d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads