Analysis
- max time kernel
120s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
27/04/2024, 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe
- Size 2.3MB
- Sample240427-acrmcaeg74
- SHA256 51d35d521169eaef5e7d4f0770d604306e53cff50eb52b7c9efb4b3b19e36c6c
- MD5 01f6baa5167877bcaa01bf1de89c130e
- SHA1 37a4d1e940a7ad72a4aefd496f787e484ab248c4
- SHA512 f1b2b965b6beb5a3df648040d9c4b722b24c9022961fb034fdfdf0cc6e657c0c0b6bf1b2d817ec885df920002df238732e5e2e7b7da1d3e52fbbb47401535bb2
- SSDEEP 49152:xWsuGHdqpCYWFkhmiQodN1kl/dnqUdSyYUh:FHIpCYWFkhdQodN6lgUd7Y
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2308 mpbUarwSj8DqSUE.exe - Loads dropped DLL 4 IoCs
pid Process 2236 01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe 2308 mpbUarwSj8DqSUE.exe 2656 regsvr32.exe 2912 regsvr32.exe - Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\InprocServer32\ = "C:\\Program Files (x86)\\VaaiuDiX\\zfAxFMgyBZ6ls4.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77c527ad-3b25-49e0-9a61-f4d64e6de96a} mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\ = "VaaiuDiX" mpbUarwSj8DqSUE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\NoExplorer = "1" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77c527ad-3b25-49e0-9a61-f4d64e6de96a} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\ = "VaaiuDiX" regsvr32.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.x64.dll mpbUarwSj8DqSUE.exe File opened for modification C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.x64.dll mpbUarwSj8DqSUE.exe File created C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.dll mpbUarwSj8DqSUE.exe File opened for modification C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.dll mpbUarwSj8DqSUE.exe File created C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.tlb mpbUarwSj8DqSUE.exe File opened for modification C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.tlb mpbUarwSj8DqSUE.exe File created C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.dat mpbUarwSj8DqSUE.exe File opened for modification C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.dat mpbUarwSj8DqSUE.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\ mpbUarwSj8DqSUE.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{77c527ad-3b25-49e0-9a61-f4d64e6de96a} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\ regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{77c527ad-3b25-49e0-9a61-f4d64e6de96a} mpbUarwSj8DqSUE.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration mpbUarwSj8DqSUE.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{77c527ad-3b25-49e0-9a61-f4d64e6de96a} mpbUarwSj8DqSUE.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1} mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\TypeLib\Version = "1.0" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8}\TypeLib mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.9\CLSID mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_\CurVer mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E481A870-86C7-44E1-97DF-E759FC147CBE}\ = "IPlaghinMein" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8}\ = "IRegistry" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\TypeLib\ = "{41F978F3-431A-4464-A789-5C0692D562FB}" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE} mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\ = "VaaiuDiX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB}\1.0\0\win32 mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\ProxyStubClsid32 mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\TypeLib mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77C527AD-3B25-49E0-9A61-F4D64E6DE96A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\TypeLib mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE}\ProxyStubClsid32 mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_\ = "VaaiuDiX" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\ = "VaaiuDiX" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB} mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E481A870-86C7-44E1-97DF-E759FC147CBE}\TypeLib mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE}\ProxyStubClsid32 mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE}\TypeLib\ = "{41F978F3-431A-4464-A789-5C0692D562FB}" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE}\TypeLib\ = "{41F978F3-431A-4464-A789-5C0692D562FB}" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\Programmable\ mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\InprocServer32 mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB}\1.0 mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_\ = "VaaiuDiX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\ = "ILocalStorage" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8}\ProxyStubClsid32 mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.9\CLSID\ = "{77c527ad-3b25-49e0-9a61-f4d64e6de96a}" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.9\ = "VaaiuDiX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE332809-93C1-48DF-929F-AEC0BC4BFCFE}\TypeLib\Version = "1.0" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8} mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.9\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\Programmable\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77C527AD-3B25-49E0-9A61-F4D64E6DE96A}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.9 mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\VaaiuDiX" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB}\1.0\ = "IEPluginLib" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E481A870-86C7-44E1-97DF-E759FC147CBE}\TypeLib\Version = "1.0" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8}\ = "IRegistry" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8} mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.9\CLSID\ = "{77c527ad-3b25-49e0-9a61-f4d64e6de96a}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.9 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\P77c527ad_3b25_49e0_9a61_f4d64e6de96a_.P77c527ad_3b25_49e0_9a61_f4d64e6de96a_\CLSID\ = "{77c527ad-3b25-49e0-9a61-f4d64e6de96a}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\InprocServer32\ = "C:\\Program Files (x86)\\VaaiuDiX\\zfAxFMgyBZ6ls4.dll" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77C527AD-3B25-49E0-9A61-F4D64E6DE96A}\Implemented Categories mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8}\TypeLib\Version = "1.0" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}\InprocServer32\ThreadingModel = "Apartment" mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{138E44EF-8988-4DC7-8F48-FBC4FCEF83D1}\TypeLib\Version = "1.0" mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BB50CC62-09E1-4DD9-912C-F1DA4D6D71D8}\ProxyStubClsid32 mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E481A870-86C7-44E1-97DF-E759FC147CBE}\ProxyStubClsid32 mpbUarwSj8DqSUE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E481A870-86C7-44E1-97DF-E759FC147CBE}\TypeLib mpbUarwSj8DqSUE.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2308 2236 01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe 28 PID 2236 wrote to memory of 2308 2236 01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe 28 PID 2236 wrote to memory of 2308 2236 01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe 28 PID 2236 wrote to memory of 2308 2236 01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe 28 PID 2308 wrote to memory of 2656 2308 mpbUarwSj8DqSUE.exe 29 PID 2308 wrote to memory of 2656 2308 mpbUarwSj8DqSUE.exe 29 PID 2308 wrote to memory of 2656 2308 mpbUarwSj8DqSUE.exe 29 PID 2308 wrote to memory of 2656 2308 mpbUarwSj8DqSUE.exe 29 PID 2308 wrote to memory of 2656 2308 mpbUarwSj8DqSUE.exe 29 PID 2308 wrote to memory of 2656 2308 mpbUarwSj8DqSUE.exe 29 PID 2308 wrote to memory of 2656 2308 mpbUarwSj8DqSUE.exe 29 PID 2656 wrote to memory of 2912 2656 regsvr32.exe 30 PID 2656 wrote to memory of 2912 2656 regsvr32.exe 30 PID 2656 wrote to memory of 2912 2656 regsvr32.exe 30 PID 2656 wrote to memory of 2912 2656 regsvr32.exe 30 PID 2656 wrote to memory of 2912 2656 regsvr32.exe 30 PID 2656 wrote to memory of 2912 2656 regsvr32.exe 30 PID 2656 wrote to memory of 2912 2656 regsvr32.exe 30 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID mpbUarwSj8DqSUE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{77c527ad-3b25-49e0-9a61-f4d64e6de96a} = "1" mpbUarwSj8DqSUE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\52064ff9\mpbUarwSj8DqSUE.exe"C:\Users\Admin\AppData\Local\Temp/52064ff9/mpbUarwSj8DqSUE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2308 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.x64.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:2912
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\52064ff9\mpbUarwSj8DqSUE.dat
- Size 7KB
- SHA256 09693f2b2b9e8387b368ff5cc310c1505ed85c5617ec4bff1520f9c15d904e4e
- MD5 8af416ddeb8c7f514b81fcbc54bd9a1b
- SHA1 14dee48b2ce2680b39d5f6fe7bd524d518973a87
- SHA512 2434c5a0c8d9e505e47747f63e6417aadc5a8b15347a0e616a45f2af2fac6133e3c8a47bc97b6b4f595490f0d9554aa982b2d9ed07513af271e0e799623e7f7f
- SSDEEP 192:YTarkwRwbs7rPzd29norVxWnSM5hBCzqC8lELwCAbcyY88:SarLwIfbdQor7Wn15zxGkCVyo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\52064ff9\zfAxFMgyBZ6ls4.dll
- Size 573KB
- SHA256 d8c8085e002578d7dad3d16100a7a4984b13b923c36459ddb83d71bf811ac3de
- MD5 364b62ed350c46f66c61820c5a57e989
- SHA1 f00161bcb1f9d847c3a9ea502bc32f2ca9d6b08b
- SHA512 be9be03bfd1fdfb4dfc2be7e4325f45ce8f1b62bff5badf82682cad01de4b45acde867122000e387c0bb68a06837b1c6420d528f05f2aaae898105faf6535aae
- SSDEEP 12288:/XttQRgiMn8ENhI5qLmbrESnVfgHofwjNL1Q:MR5rnuPjxO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\52064ff9\zfAxFMgyBZ6ls4.tlb
- Size 4KB
- SHA256 ee29d7672ab20bd7c779268d59994217be7d3704396e52785f3da70db8afb02b
- MD5 0fe06b2503ac0e34dcbb7ac744f8905b
- SHA1 8850ee13bfdc7e62670b67588f8b88e798f02622
- SHA512 bf3df6c9dba950e63dc0b1d448e87d1387cfd63233fe9eb04cb72563bc9fb2be8bce133748be07b74e8cf47d374b0fd5641c1d8fd66886c950cad6bc771ee8e9
- SSDEEP 96:4bqMacAAkQJCXMKATe3TJLAiePZDhuPU5DOf:4cQjJWTJ0iePrdIf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\52064ff9\zfAxFMgyBZ6ls4.x64.dll
- Size 645KB
- SHA256 128a355220799bbea2587e47eeb23f47b711a7adba937858871f5f7c888b3466
- MD5 f1d5fc4488d1a83dc1b50cd0a03e9a4e
- SHA1 4cced3bca48fd00858df9e76f4fbff05da82575b
- SHA512 1f0064675fe37629a6c5701a00eacac03ee5988cbce8e2571dd64c4c6ab09951fcfc64becea0ebbc737e9ba9b78c719f7a4518fc7278e272f24e0470b6d05677
- SSDEEP 12288:Udzy74qVUYWpt1P6+1PsuIw4b/AxFsW9phjIoRUI/UkAP0PkJv8YNQwbM:SsopvhlAP0PkJ8Ab
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}-log.txt
- Size 1KB
- SHA256 4a5b95b07eb6286198e1fc66a073242bf9ef8273f81605057fd5f79e0961da6a
- MD5 40b0254c8fbc7fabd8e7a3356e7d903a
- SHA1 156f1d41b4e354ac34d1666b88a329a904935531
- SHA512 15f3f9f4ddae9ac234c647155637fcba0812b5ce023adcf1b5d515315f5d94121683439f9966fe031ebc277d61deba99ea94b2fa4b146bf859c1db9c25d41cec
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\52064ff9\mpbUarwSj8DqSUE.exe
- Size 766KB
- SHA256 1d94c27748e7d0dc5ffd03ae99acd9c30aaa8a6e91a66beab420650f9d6e4977
- MD5 eb843f08b06cc5bb0e8bbe9f8aaa0ba6
- SHA1 0813518ec2daeb0a49d7ee2c9482150cc0eb1136
- SHA512 48e3ec76eeb7a54d7ae467317d03ad5f073249e38cb8be1f08a65d31c8c4fb687d8315d6093074c074fb16c782ca57f9d0ec53464d91c0998d85f54fe58324c4
- SSDEEP 12288:/5GSULMTdS/NBGpgMkVbhx01K/jGjnKtDSCrdQml9g7UB4lJH9e3L:ENQTdONBLMSVxNrInKtDSwdQm7N4lJHM
- MD5 SHA1 SHA512 SSDEEP