Overview
overview
7Static
static
712bcdb449b...18.exe
windows7-x64
712bcdb449b...18.exe
windows10-2004-x64
7$INSTDIR"/...ll.exe
windows7-x64
7$INSTDIR"/...ll.exe
windows10-2004-x64
7$INSTDIR"/...er.exe
windows7-x64
1$INSTDIR"/...er.exe
windows10-2004-x64
1$INSTDIR"/...us.dll
windows7-x64
3$INSTDIR"/...us.dll
windows10-2004-x64
3$INSTDIR"/...sU.exe
windows7-x64
1$INSTDIR"/...sU.exe
windows10-2004-x64
1$INSTDIR"/...XU.dll
windows7-x64
1$INSTDIR"/...XU.dll
windows10-2004-x64
1$INSTDIR"/...er.exe
windows7-x64
1$INSTDIR"/...er.exe
windows10-2004-x64
1$INSTDIR"/...er.exe
windows7-x64
1$INSTDIR"/...er.exe
windows10-2004-x64
1$INSTDIR"/...er.dll
windows7-x64
1$INSTDIR"/...er.dll
windows10-2004-x64
1$INSTDIR"/...MC.dll
windows7-x64
1$INSTDIR"/...MC.dll
windows10-2004-x64
1$INSTDIR"/...il.exe
windows7-x64
3$INSTDIR"/...il.exe
windows10-2004-x64
3$INSTDIR"/...nc.dll
windows7-x64
7$INSTDIR"/...nc.dll
windows10-2004-x64
7$INSTDIR"/...l2.dll
windows7-x64
3$INSTDIR"/...l2.dll
windows10-2004-x64
3$INSTDIR"/...ad.exe
windows7-x64
1$INSTDIR"/...ad.exe
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 12:28
Behavioral task
behavioral1
Sample
12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$INSTDIR"/OpalViewerUninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$INSTDIR"/OpalViewerUninstall.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$INSTDIR"/bin/"/$OUTDIR/OpalPreFetchListener.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$INSTDIR"/bin/"/$OUTDIR/OpalPreFetchListener.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$INSTDIR"/bin/"/GdiPlus.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$INSTDIR"/bin/"/GdiPlus.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$INSTDIR"/bin/"/NMSAccessU.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$INSTDIR"/bin/"/NMSAccessU.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
$INSTDIR"/bin/"/NMSDVDXU.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$INSTDIR"/bin/"/NMSDVDXU.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$INSTDIR"/bin/"/OpalPreFetchListener.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$INSTDIR"/bin/"/OpalPreFetchListener.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
$INSTDIR"/bin/"/OpalViewer.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$INSTDIR"/bin/"/OpalViewer.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$INSTDIR"/bin/"/OpalWebKicker.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$INSTDIR"/bin/"/OpalWebKicker.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
$INSTDIR"/bin/"/VizMMC.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
$INSTDIR"/bin/"/VizMMC.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$INSTDIR"/bin/"/WinTail.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$INSTDIR"/bin/"/WinTail.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
$INSTDIR"/bin/"/lame_enc.dll
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
$INSTDIR"/bin/"/lame_enc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$INSTDIR"/bin/"/libxml2.dll
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
$INSTDIR"/bin/"/libxml2.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
$INSTDIR"/bin/"/win32pad.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$INSTDIR"/bin/"/win32pad.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
General
-
Target
12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
-
Size
5.5MB
-
MD5
12bcdb449b0071b8451c4887a87efef9
-
SHA1
34f179932ac93e0bf92c2fd8cd9fd44d479742fe
-
SHA256
7d93356ce79e5c931bc2951c4284d42fc9210c8e130ffec7833463f3d7aaaa75
-
SHA512
7be9f14b0535f8b43789136349d6725af474b5ab3820f74928a4ec2bcdd6df4747b8644937908a1a87c7d8e7d88db88505a6954861705077ab2bebdbf8ccc0a8
-
SSDEEP
98304:l7vDN1vO9D5WE8YvH/UoGPiYaq1g5ox28qHIHic0SKVdIcVOteMO9hLQPZFTXjOF:l7bsfP/FGPEox25Hcwgc8eR9qtOFjeGb
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 2912 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 2912 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 2912 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 2912 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BAC4A11-58CB-483C-A8AF-B26F5E3B5DE1}\ = "DiscInfoX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938}\ToolboxBitmap32\ = "C:\\opal\\bin\\NMSDVDXU.dll, 119" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA775796-D564-4A22-8BCB-6D5128EB28C8}\TypeLib\Version = "1.0" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37E3F4D6-E694-439D-B17E-C6EC726C7BE8}\InprocServer32\ThreadingModel = "Apartment" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C68273E-A742-44CB-B3AC-C347D614ADD8}\ProxyStubClsid32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA775796-D564-4A22-8BCB-6D5128EB28C8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF00A585-3C3D-4F49-8984-DE58E69AFD80}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDACF50F-50D7-4F62-B4AF-0E5B0B212E2E}\MiscStatus\ = "0" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.TrackInfoX.1\CLSID\ = "{9FD65921-DFB2-4D17-9E84-0C1752E03CF2}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DynamicDataImageX\CurVer\ = "NMSDVDX.DynamicDataImageX.1" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{59480498-3171-48AE-A3C4-F8B050FFA921}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{234527CE-03EE-4420-BB90-040D3C650382}\TypeLib\Version = "1.0" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5A47309C-6364-44D9-B441-AE98F0BDCFA5}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dcm\ = "Opal.DicomFile" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14725AC8-AAAB-48E5-914E-26BE824FEBE9}\Programmable 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.WriteErrorX\ = "WriteErrorX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1BAC4A11-58CB-483C-A8AF-B26F5E3B5DE1}\VersionIndependentProgID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51496FEE-8200-4B10-B57C-EB5D64DB28A0}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.AudioCDImageX\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3FF0FE7-E5B9-410B-9AF0-6927794CE654} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D0EC0FE-60AF-471C-AFD1-1D7FC72E39DF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{767F7042-CE3C-4AA7-8F17-CE92B0A609DF}\TypeLib\Version = "1.0" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF00A585-3C3D-4F49-8984-DE58E69AFD80}\ProxyStubClsid32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DataItemX\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.ExtentX 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.ExtentX\ = "ExtentX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{016327E9-3173-4773-A5A4-C57614CC1C43}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C9B9C-1948-44F5-8A3E-275BF892E60C}\AppID = "{FA52E4C8-68B6-49C4-BF9C-C048A8447905}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65472655-C70C-4393-9470-BBD37A1A6F7B}\VersionIndependentProgID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37E3F4D6-E694-439D-B17E-C6EC726C7BE8}\ProgID\ = "NMSDVDX.DynamicDataImageX.1" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDACF50F-50D7-4F62-B4AF-0E5B0B212E2E}\MiscStatus\1\ = "131473" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.MSFX\ = "MSFX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A232E886-AAA6-4471-98E3-520E09F80D95}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E628BEB5-35A5-4415-AEF8-ABDF44054C54}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DeviceErrorX\ = "DeviceErrorX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.TocX\ = "TocX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{753A15E2-A722-4939-9183-9E0BA897D354}\ProgID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B0190ECA-A831-44BD-9B2E-74000ECA96E2}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA775796-D564-4A22-8BCB-6D5128EB28C8}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{753A15E2-A722-4939-9183-9E0BA897D354}\InprocServer32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B2E795E-C849-46DC-B321-07E6B7EB975C} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CCAD1D8B-E648-4839-8CC3-AE585560F988}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DeviceErrorX\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DVDEngineX\CurVer\ = "NMSDVDX.DVDEngineX.1" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37E3F4D6-E694-439D-B17E-C6EC726C7BE8}\Programmable 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B2E795E-C849-46DC-B321-07E6B7EB975C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0190ECA-A831-44BD-9B2E-74000ECA96E2}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20DB9E90-63E9-4700-9811-BDFA27D4459A}\ProgID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DB66D8E9-55F8-4103-BB4E-DA0163C56A72}\TypeLib\Version = "1.0" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5A45C449-ECA1-473C-BBFC-E035BFD3E484}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCAD1D8B-E648-4839-8CC3-AE585560F988}\ProxyStubClsid32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20DB9E90-63E9-4700-9811-BDFA27D4459A}\ProgID\ = "NMSDVDX.TocX.1" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.FileLayoutX.1\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{65472655-C70C-4393-9470-BBD37A1A6F7B}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938}\Control 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB66D8E9-55F8-4103-BB4E-DA0163C56A72}\ProxyStubClsid32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FA52E4C8-68B6-49C4-BF9C-C048A8447905}\ = "OpalWebKicker" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{016609A9-951A-4906-BEFD-2F4B67FB0E3E}\InprocServer32\ = "C:\\opal\\bin\\NMSDVDXU.dll" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.BootOptionsX.1\CLSID\ = "{A1ECCFA4-32FF-456B-92AA-7F8F76AC5B93}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A47309C-6364-44D9-B441-AE98F0BDCFA5}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A5A6560-9B11-4980-943B-5332A91FC11A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dcm 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D9AC115-02B1-4B91-A5A9-DC5430C38DC6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{016327E9-3173-4773-A5A4-C57614CC1C43} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
1.2MB
MD58f2e118719c0a8329ef00b58bb256483
SHA1a9b426f52a7f931e2a268e28b25d93249ac515ee
SHA2565fdbd14f8b88d21b58a138433c035031fb6a8c6be756b828dc126fce426dee70
SHA5129ebe4c54556ab09f7fb7792f35ceb7459b7c306c08f3806bc28f7345020eac44f0a88ad9fab631bed5523112eddeb28d3cca03734ede4443cde4660b35f05007
-
Filesize
552KB
MD5a4bde4b2b0c5423a05fc497057a64fbb
SHA13f0d2862c31fe4fc018cb48ca202e87e6b15046f
SHA256d4d980aa2ffcdb68a9984f31fa49f64bd491476a39d1169b0a5efe153a4f7f4a
SHA51253b68a903ef916ccfa39e39b32cfba4da914879e6fea6946ced74e0320b475d5798dd297991bca1af71e63074d5611ef64c6f2e5bbb0d0de89b2f81188bd6c29
-
Filesize
1.1MB
MD59e27fa1bbb7bf9a826d9092c69e79e4b
SHA178a0f434aec0e14e4654dce1fd7515ac22a9daaa
SHA256b5fd602a3f7228fc2978e00dc7c50869f9bde6c351391894a299c186301454c8
SHA512c29acfbe00e416667880d0d2c37ff1ad75f27dbb209129a9bc451c5c7df409c597c38fa26245b57b7e46f4dc39315e4647313c6762f45462cc258a12aa4ee165