Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe
-
Size
459KB
-
MD5
fc5aa1906a159ee13d37aab3986be6f2
-
SHA1
33741d57ac6a5bb456a1a2b8e797a82fff7ba80d
-
SHA256
5143c5e62c20e424a810bce1512e5feb7b156f9322f8256163ca3bf3f1988c79
-
SHA512
d5e4e04ba7727af3e6dc81bf892d7666b5532310182d5d2e46e6eccdf7d15a67b388fd8db79f31693229a539a3124ad3f6e11b3417c10ff85642c2976698c5e8
-
SSDEEP
12288:fNw8rpifjNpgiVwGd3RwnDowSbmoq4YrNw7Ef7qs9HGEXEx2ft7fTneSvG7tvH3s:LifjNp3Vw8RwnDowSbmoq42Nw7W739Hp
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe scvhost.exe" scvhost.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC0071E0-E0FC-F544-D000-B22D25041D00} fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC0071E0-E0FC-F544-D000-B22D25041D00}\StubPath = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC0071E0-E0FC-F544-D000-B22D25041D00} scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC0071E0-E0FC-F544-D000-B22D25041D00}\StubPath = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe -
Executes dropped EXE 2 IoCs
pid Process 2508 scvhost.exe 2616 scvhost.exe -
Loads dropped DLL 6 IoCs
pid Process 2896 regsvr32.exe 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 2480 regsvr32.exe 2508 scvhost.exe 2508 scvhost.exe -
Adds Run key to start application 2 TTPs 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\icq lite = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\Update Checker = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Windows Update = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\msconfig = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\icq lite = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\Update Checker = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\Windows Update = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\msconfig = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\AntiVir = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\AntiVir = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Windows Update = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Update Checker = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\ = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\ = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\msconfig = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\icq lite = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\ = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\Windows Update = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\Update Checker = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\AntiVir = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\msconfig = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\msconfig = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\msconfig = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\icq lite = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\icq lite = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Update Checker = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\AntiVir = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\msconfig = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\icq lite = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\Update Checker = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Update Checker = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\AntiVir = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\AntiVir = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\ = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Windows Update = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\Windows Update = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\ = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\ = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\AntiVir = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\ = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\ = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\Windows Update = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\AntiVir = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\icq lite = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\Windows Update = "C:\\Windows\\system32\\scvhost.exe" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\msconfig = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNSERVICES\icq lite = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX\Update Checker = "C:\\Windows\\system32\\scvhost.exe" scvhost.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\scvhost.exe fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe File created C:\Windows\SysWOW64\scvhost.exe fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mswinsck.ocx fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\scvhost.exe scvhost.exe File opened for modification C:\Windows\SysWOW64\ scvhost.exe File created C:\Windows\SysWOW64\scvhost.exe scvhost.exe File opened for modification C:\Windows\SysWOW64\mswinsck.ocx scvhost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 2508 scvhost.exe 2616 scvhost.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2896 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2896 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2896 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2896 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2896 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2896 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2896 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2508 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 29 PID 1904 wrote to memory of 2508 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 29 PID 1904 wrote to memory of 2508 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 29 PID 1904 wrote to memory of 2508 1904 fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe 29 PID 2508 wrote to memory of 2480 2508 scvhost.exe 30 PID 2508 wrote to memory of 2480 2508 scvhost.exe 30 PID 2508 wrote to memory of 2480 2508 scvhost.exe 30 PID 2508 wrote to memory of 2480 2508 scvhost.exe 30 PID 2508 wrote to memory of 2480 2508 scvhost.exe 30 PID 2508 wrote to memory of 2480 2508 scvhost.exe 30 PID 2508 wrote to memory of 2480 2508 scvhost.exe 30 PID 2508 wrote to memory of 2616 2508 scvhost.exe 31 PID 2508 wrote to memory of 2616 2508 scvhost.exe 31 PID 2508 wrote to memory of 2616 2508 scvhost.exe 31 PID 2508 wrote to memory of 2616 2508 scvhost.exe 31 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" scvhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1904 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\system32\mswinsck.ocx"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2896
-
-
C:\Windows\SysWOW64\scvhost.exeC:\Windows\system32\scvhost.exe C:\Users\Admin\AppData\Local\Temp\fc5aa1906a159ee13d37aab3986be6f2_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2508 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\system32\mswinsck.ocx"3⤵
- Loads dropped DLL
- Modifies registry class
PID:2480
-
-
C:\Windows\SysWOW64\scvhost.exeC:\Windows\system32\scvhost.exe C:\Windows\system32\scvhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
459KB
MD5fc5aa1906a159ee13d37aab3986be6f2
SHA133741d57ac6a5bb456a1a2b8e797a82fff7ba80d
SHA2565143c5e62c20e424a810bce1512e5feb7b156f9322f8256163ca3bf3f1988c79
SHA512d5e4e04ba7727af3e6dc81bf892d7666b5532310182d5d2e46e6eccdf7d15a67b388fd8db79f31693229a539a3124ad3f6e11b3417c10ff85642c2976698c5e8