24bfc1076092095e13ff1cc8835f28e6ef1b47d384b920556491c9c2a389dd3f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Size

1.4MB
MD5

15c5f7c55bcbb6ea5236da240f0c4f03
SHA1

52093376cba61c3c9f2fd60a3cdb42d909b49111
SHA256

24bfc1076092095e13ff1cc8835f28e6ef1b47d384b920556491c9c2a389dd3f
SHA512

3df98e16a115a591c60711f14267fd6620b7fb9c1fa9f54d6a6cd8fa9173e9fb9548a2e79084e17752999b50ac130f13c7c4a68eaad14101a4fe766321ae9859
SSDEEP

24576:HGTBjw4aeYzoVwhQN/iAaLM4vAXwyfzb89Pp1z4SzBuomm7Ohb77N4QEptX:HGdjtYzB+/ibDYXZfzo1rr9qb7p4ZL

Score

7^/10

adware discovery stealer

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000d00000001342e-3.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2744	BarBroker.exe
2648	ASBarBroker.exe

Loads dropped DLL 29 IoCs

pid	Process
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
2744	BarBroker.exe
2744	BarBroker.exe
2744	BarBroker.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
2744	BarBroker.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
2648	ASBarBroker.exe
2648	ASBarBroker.exe
2648	ASBarBroker.exe
2648	ASBarBroker.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\NoExplorer = "1"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\id = "bdbar"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\NoExplorer = "1"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Baidu\ASBarBroker.exe	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\conf.xml	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\ASBarBroker.exe	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\Toolbar\rc.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\AddressBar.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\AddressBar.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\AddressBar.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\ASBarBroker.exe	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\conf.xml	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\螜Ϛ	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
File created	C:\Program Files (x86)\Baidu\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\conf.xml	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x002b000000013a88-137.dat	nsis_installer_1

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = "12"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.baidu.com/index.php?tn=baidudg&addresssearch=1"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://www.baidu.com/index.php?tn=baidudg&addresssearch=2"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\URL = "http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=49029047_adr"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights	ASBarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppName = "ASBarBroker.exe"	ASBarBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\Policy = "3"	ASBarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\FaviconURL = "http://www.baidu.com/favicon.ico"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}	BarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\AppPath = "%ProgramFiles(x86)%\\Baidu\\Toolbar"	BarBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\Policy = "3"	BarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\DisplayName = "百度一下，你就知道"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie={inputEncoding}&from=ie8"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppPath = "C:\\Program Files (x86)\\Baidu\\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}"	ASBarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppPath = "C:\\Program Files (x86)\\Baidu\\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}"	ASBarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}	ASBarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.baidu.com/index.php?tn=49029047_adr&addresssearch=1"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}	ASBarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\URL = "http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&bar=13&tn=49029047_cb"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	ASBarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppName = "ASBarBroker.exe"	ASBarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppPath = "%ProgramFiles(x86)%\\Baidu\\AddressBar"	ASBarBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\Policy = "3"	ASBarBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}	ASBarBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\AppName = "BarBroker.exe"	BarBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://www.baidu.com/index.php?tn=49029047_adr&addresssearch=2"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.4	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.3\ = "°Ù¶È¹¤¾ßÀ¸¸öÐÔ»¯Ê×Ò³Ö§³Ö×é¼þ"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\VersionIndependentProgID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BarBroker.EXE	BarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BarBroker.BDBroker\CLSID\ = "{5BECD27B-DCF5-4DEF-B066-486A47245C03}"	BarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\TypeLib\Version = "1.0"	BarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\ = "°Ù¶È¹¤¾ßÀ¸¸¨Öú¶ÔÏó"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AddressSearch.JsObject\CurVer\ = "AddressSearch.JsObject.1"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9BC0421-BB5C-447D-8547-BB45AFA80A4D}\1.0\0	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ASBarBroker.EXE\AppID = "{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}"	ASBarBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.5\CLSID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\ProxyStubClsid32	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\TypeLib	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.1\CLSID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\ProgID\ = "AddressSearch.JsObject.1"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}\TypeLib\Version = "1.0"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D02E3AB9-7796-40CB-BDFC-20D834FE1F75}\1.0\ = "ASBarBroker 1.0 Type Library"	ASBarBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BarBroker.EXE\AppID = "{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}"	BarBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}	BarBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\VersionIndependentProgID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA677CC1-D6FA-4B55-825D-6C493F56ED84}\ = "ISnavHttpProtocol"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCB380C4-D350-44BE-8791-50216F4747AC}\ProxyStubClsid32	ASBarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand\ = "°Ù¶È¹¤¾ßÀ¸"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\ = "JsObject Class"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FBEDBA6C-44A2-43b9-BD49-20EB6E0C4E86}\ProgID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9BC0421-BB5C-447D-8547-BB45AFA80A4D}\1.0	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\ProxyStubClsid32	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\ProgID\ = "31DF0D4B-528D-FFD8-E64F-F28188BEDDD0.Addr.1"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\TypeLib\ = "{F9BC0421-BB5C-447d-8547-BB45AFA80A4D}"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\VersionIndependentProgID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib\Version = "1.0"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\31DF0D4B-528D-FFD8-E64F-F28188BEDDD0.Addr.1\CLSID\ = "{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AddressSearch.SnavHttpProtocol	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\FLAGS	BarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.BandIE\CLSID\ = "{77FEF28E-EB96-44FF-B511-3185DEA48697}"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\TypeLib	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage\ = "°Ù¶È¹¤¾ßÀ¸¸öÐÔ»¯Ê×Ò³Ö§³Ö×é¼þ"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\Programmable	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCB380C4-D350-44BE-8791-50216F4747AC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ASBarBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand.1\CLSID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32\ThreadingModel = "Apartment"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\0\win32\ = "C:\\Program Files (x86)\\Baidu\\Toolbar\\BarBroker.exe"	BarBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\TypeLib	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCB380C4-D350-44BE-8791-50216F4747AC}\TypeLib\ = "{D02E3AB9-7796-40CB-BDFC-20D834FE1F75}"	ASBarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\ = "°Ù¶È¹¤¾ßÀ¸¸¨Öú¶ÔÏó"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.2\CLSID	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FA677CC1-D6FA-4B55-825D-6C493F56ED84}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D02E3AB9-7796-40CB-BDFC-20D834FE1F75}\1.0\FLAGS\ = "0"	ASBarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32\ = "C:\\Program Files (x86)\\Baidu\\Toolbar\\BaiduBarX.dll"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\0\win32	BarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BarBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\InprocServer32\ThreadingModel = "Apartment"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AddressSearch.JsObject	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\ProxyStubClsid32	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FBEDBA6C-44A2-43b9-BD49-20EB6E0C4E86}\VersionIndependentProgID\ = "AddressSearch.SnavHttpProtocol"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}\ = "ISearchHook"	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Token: SeBackupPrivilege	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2744	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2744	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2744	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2744	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2744	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2744	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2744	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2648	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2648	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2648	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2648	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2648	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2648	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2648	1620	15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe
  "C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe" -RegServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2744
- C:\PROGRA~2\Baidu\{31DF0~1\ASBarBroker.exe
  "C:\PROGRA~2\Baidu\{31DF0~1\ASBarBroker.exe" -RegServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Baidu\{31DF0~1\conf.xml

Filesize
333B

MD5
6dd75c3990eabc4493f873b55c04eff3

SHA1
9a441bafe2916f4c0d143e91829d0c5159b78eb5

SHA256
dcc449371c23fffa9b8c0e5a4f1fb464ab3e0f94e1eda59d9fd0899559106f3e

SHA512
8f148d18d0334a3e6e5ee2278a214cd855a9de227b14d7eea09fb5e2b8e243edcc45114a2d5b35a027049ec89090aa20b10e7d4165f7534d814d9c50b8e76ba9

Download Submit
C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe

Filesize
228KB

MD5
adafb685914e48bcb2cc47d02de967d4

SHA1
241e39b0b51028ab451f0abb2e39492ce18e2701

SHA256
2a5e0c7f3698b8192df5ca2548944632e656eb27f4b3b3bd252b370b7348ad70

SHA512
8f01feebc063c0b611c7503f1bbcbd5479fb65f0acc8c66eae91965228c5c8037bafc3393b251d77f2f62d457d2e661b99d703bebac7df269792f030258388ed

Download Submit
C:\Program Files (x86)\Baidu\Toolbar\rc.dll

Filesize
468KB

MD5
fd00f62dcb903fbbbe40aeb48a482708

SHA1
1333d5ef06dfd707e40a1322cb40c08487b3f50d

SHA256
3efdb3bf488038cf8c08b690f4bfa469fb49b9d2ed585ba3c88feb0770f37350

SHA512
c83ac2be93e05527e09de4ea0b3617bbcbb5747890c7a0b861ad3b55aaaec3d148783a7fcbbacb66b92ede37440d82d41fbfe8a871273f1c6796fdcbe63131a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dblE26.tmp

Filesize
1.2MB

MD5
10a311357d5a4f66ef3d902a2cf5e35f

SHA1
129cf2d957da9f4ebdf330fe238ad7832310bf7a

SHA256
99b5a682cc03894a9e95d360127c10a1efd4106ea3ae50a56351f9f2e4f74a59

SHA512
d174436e615c0fdd2e0b23b79126e5c83d27add68f49a5cc4c62f12ade893f16669961dd313b2adb79f0a5fbfea686c779b37a569ce800e30d87e6c59cdeff3f

Download Submit
\PROGRA~2\Baidu\{31DF0~1\ASBarBroker.exe

Filesize
129KB

MD5
0ebf8f583abb1ffb40c07b87eae4edb3

SHA1
ef91b3245f426b86c2b69fd9678176d3be05c009

SHA256
00a481ef9985281177c1f6cc6d055c2bdb719db224637e7eb474a3eaab6305cf

SHA512
0bca7bc46019628149afb00cd69d26fd59195c4cbecbb472f9afabf73e8b3eb1da20fdaa4ef03c0776d11b5c8532d16b40a927e4b8b68640067c145cb7e463b4

Download Submit
\Program Files (x86)\Baidu\AddressBar.dll

Filesize
1.1MB

MD5
57d9f8b6e595ef4a02d8630c53fddcc3

SHA1
523dedd35613dc3221657876a3f5248e38e2a842

SHA256
c9a2b8ff0be921e2ac2ff6993f7fecc486b02969254884f89af3a19babfcf7e6

SHA512
e95f144caa3bb636fd4a085a24a41d95ac6dae1c47d729400bb65a37527863b02b15e98cb62121f2155956f8a2b177f3b1a11d9ba08881858924d9bd75be985e

Download Submit
\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll

Filesize
2.6MB

MD5
ba75680a2b710f7d2c575e816000f041

SHA1
a36e8bf8635473494cf58953227b21facdfd2682

SHA256
4c4c9cf71e8eb6f83fe875ad657512f1405648b30472df6597d92a679ee51801

SHA512
4408149541ab4b6eda6c9d6b95995be64773559701a18096c283e503fa3b5b22b624db5956c7916f4cecd80c47036e13b100dd51069ef23292749ef4a89bfbb3

Download Submit
\Users\Admin\AppData\Local\Temp\ablE05.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1620-33-0x0000000003950000-0x0000000003BE8000-memory.dmp

Filesize
2.6MB

Download
memory/1620-46-0x0000000003CF0000-0x0000000003D65000-memory.dmp

Filesize
468KB

Download
memory/1620-93-0x0000000004040000-0x0000000004166000-memory.dmp

Filesize
1.1MB

Download
memory/1620-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1620-10-0x0000000001D40000-0x0000000001DB3000-memory.dmp

Filesize
460KB

Download
memory/1620-2-0x0000000000240000-0x0000000000271000-memory.dmp

Filesize
196KB

Download
memory/1620-143-0x0000000001D40000-0x0000000001DB3000-memory.dmp

Filesize
460KB

Download
memory/1620-142-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-140-0x0000000001E70000-0x0000000001EE3000-memory.dmp

Filesize
460KB

Download
memory/2648-145-0x0000000001E70000-0x0000000001EE3000-memory.dmp

Filesize
460KB

Download
memory/2744-78-0x0000000002030000-0x00000000020A3000-memory.dmp

Filesize
460KB

Download
memory/2744-83-0x0000000002030000-0x00000000020A3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads