Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
15c5f7c55bcbb6ea5236da240f0c4f03
-
SHA1
52093376cba61c3c9f2fd60a3cdb42d909b49111
-
SHA256
24bfc1076092095e13ff1cc8835f28e6ef1b47d384b920556491c9c2a389dd3f
-
SHA512
3df98e16a115a591c60711f14267fd6620b7fb9c1fa9f54d6a6cd8fa9173e9fb9548a2e79084e17752999b50ac130f13c7c4a68eaad14101a4fe766321ae9859
-
SSDEEP
24576:HGTBjw4aeYzoVwhQN/iAaLM4vAXwyfzb89Pp1z4SzBuomm7Ohb77N4QEptX:HGdjtYzB+/ibDYXZfzo1rr9qb7p4ZL
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000d00000001342e-3.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 2744 BarBroker.exe 2648 ASBarBroker.exe -
Loads dropped DLL 29 IoCs
pid Process 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 2744 BarBroker.exe 2744 BarBroker.exe 2744 BarBroker.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 2744 BarBroker.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 2648 ASBarBroker.exe 2648 ASBarBroker.exe 2648 ASBarBroker.exe 2648 ASBarBroker.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 5 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\NoExplorer = "1" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\id = "bdbar" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\NoExplorer = "1" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files (x86)\Baidu\ASBarBroker.exe 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\conf.xml 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\ASBarBroker.exe 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\Toolbar\rc.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\AddressBar.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\AddressBar.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\AddressBar.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\ASBarBroker.exe 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\conf.xml 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Baidu\Toolbar\BaiduBarX_Tmp\螜Ϛ 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe File created C:\Program Files (x86)\Baidu\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\conf.xml 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x002b000000013a88-137.dat nsis_installer_1 -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = "12" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.baidu.com/index.php?tn=baidudg&addresssearch=1" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://www.baidu.com/index.php?tn=baidudg&addresssearch=2" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\URL = "http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=49029047_adr" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights ASBarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppName = "ASBarBroker.exe" ASBarBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\Policy = "3" ASBarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\FaviconURL = "http://www.baidu.com/favicon.ico" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2} BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\AppPath = "%ProgramFiles(x86)%\\Baidu\\Toolbar" BarBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\Policy = "3" BarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\DisplayName = "百度一下,你就知道" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie={inputEncoding}&from=ie8" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppPath = "C:\\Program Files (x86)\\Baidu\\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}" ASBarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppPath = "C:\\Program Files (x86)\\Baidu\\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}" ASBarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4} ASBarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.baidu.com/index.php?tn=49029047_adr&addresssearch=1" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4} ASBarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\URL = "http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&bar=13&tn=49029047_cb" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy ASBarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppName = "ASBarBroker.exe" ASBarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\AppPath = "%ProgramFiles(x86)%\\Baidu\\AddressBar" ASBarBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}\Policy = "3" ASBarBroker.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4} ASBarBroker.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}\AppName = "BarBroker.exe" BarBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://www.baidu.com/index.php?tn=49029047_adr&addresssearch=2" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key deleted \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.4 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.3\ = "°Ù¶È¹¤¾ßÀ¸¸öÐÔ»¯Ê×Ò³Ö§³Ö×é¼þ" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\VersionIndependentProgID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BarBroker.EXE BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BarBroker.BDBroker\CLSID\ = "{5BECD27B-DCF5-4DEF-B066-486A47245C03}" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\TypeLib\Version = "1.0" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\ = "°Ù¶È¹¤¾ßÀ¸¸¨Öú¶ÔÏó" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddressSearch.JsObject\CurVer\ = "AddressSearch.JsObject.1" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9BC0421-BB5C-447D-8547-BB45AFA80A4D}\1.0\0 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ASBarBroker.EXE\AppID = "{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}" ASBarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.5\CLSID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\ProxyStubClsid32 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\TypeLib 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.1\CLSID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\ProgID\ = "AddressSearch.JsObject.1" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}\TypeLib\Version = "1.0" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D02E3AB9-7796-40CB-BDFC-20D834FE1F75}\1.0\ = "ASBarBroker 1.0 Type Library" ASBarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BarBroker.EXE\AppID = "{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}" BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172} BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\VersionIndependentProgID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA677CC1-D6FA-4B55-825D-6C493F56ED84}\ = "ISnavHttpProtocol" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCB380C4-D350-44BE-8791-50216F4747AC}\ProxyStubClsid32 ASBarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand\ = "°Ù¶È¹¤¾ßÀ¸" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\ = "JsObject Class" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FBEDBA6C-44A2-43b9-BD49-20EB6E0C4E86}\ProgID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9BC0421-BB5C-447D-8547-BB45AFA80A4D}\1.0 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\ProxyStubClsid32 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\ProgID\ = "31DF0D4B-528D-FFD8-E64F-F28188BEDDD0.Addr.1" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\TypeLib\ = "{F9BC0421-BB5C-447d-8547-BB45AFA80A4D}" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\VersionIndependentProgID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib\Version = "1.0" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\31DF0D4B-528D-FFD8-E64F-F28188BEDDD0.Addr.1\CLSID\ = "{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddressSearch.SnavHttpProtocol 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\FLAGS BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.BandIE\CLSID\ = "{77FEF28E-EB96-44FF-B511-3185DEA48697}" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\TypeLib 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage\ = "°Ù¶È¹¤¾ßÀ¸¸öÐÔ»¯Ê×Ò³Ö§³Ö×é¼þ" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DF0D4B-528D-FFD8-E64F-F28188BEDDD0}\Programmable 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCB380C4-D350-44BE-8791-50216F4747AC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ASBarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarX.ToolBand.1\CLSID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32\ThreadingModel = "Apartment" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\0\win32\ = "C:\\Program Files (x86)\\Baidu\\Toolbar\\BarBroker.exe" BarBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\TypeLib 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCB380C4-D350-44BE-8791-50216F4747AC}\TypeLib\ = "{D02E3AB9-7796-40CB-BDFC-20D834FE1F75}" ASBarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\ = "°Ù¶È¹¤¾ßÀ¸¸¨Öú¶ÔÏó" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BDHomePage.2\CLSID 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FA677CC1-D6FA-4B55-825D-6C493F56ED84} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D02E3AB9-7796-40CB-BDFC-20D834FE1F75}\1.0\FLAGS\ = "0" ASBarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32\ = "C:\\Program Files (x86)\\Baidu\\Toolbar\\BaiduBarX.dll" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\0\win32 BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BarBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}\InprocServer32\ThreadingModel = "Apartment" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AddressSearch.JsObject 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2} 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\ProxyStubClsid32 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FBEDBA6C-44A2-43b9-BD49-20EB6E0C4E86}\VersionIndependentProgID\ = "AddressSearch.SnavHttpProtocol" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}\ = "ISearchHook" 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe Token: SeBackupPrivilege 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2744 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 28 PID 1620 wrote to memory of 2744 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 28 PID 1620 wrote to memory of 2744 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 28 PID 1620 wrote to memory of 2744 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 28 PID 1620 wrote to memory of 2744 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 28 PID 1620 wrote to memory of 2744 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 28 PID 1620 wrote to memory of 2744 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 28 PID 1620 wrote to memory of 2648 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 29 PID 1620 wrote to memory of 2648 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 29 PID 1620 wrote to memory of 2648 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 29 PID 1620 wrote to memory of 2648 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 29 PID 1620 wrote to memory of 2648 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 29 PID 1620 wrote to memory of 2648 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 29 PID 1620 wrote to memory of 2648 1620 15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15c5f7c55bcbb6ea5236da240f0c4f03_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe"C:\Program Files (x86)\Baidu\Toolbar\BarBroker.exe" -RegServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:2744
-
-
C:\PROGRA~2\Baidu\{31DF0~1\ASBarBroker.exe"C:\PROGRA~2\Baidu\{31DF0~1\ASBarBroker.exe" -RegServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
333B
MD56dd75c3990eabc4493f873b55c04eff3
SHA19a441bafe2916f4c0d143e91829d0c5159b78eb5
SHA256dcc449371c23fffa9b8c0e5a4f1fb464ab3e0f94e1eda59d9fd0899559106f3e
SHA5128f148d18d0334a3e6e5ee2278a214cd855a9de227b14d7eea09fb5e2b8e243edcc45114a2d5b35a027049ec89090aa20b10e7d4165f7534d814d9c50b8e76ba9
-
Filesize
228KB
MD5adafb685914e48bcb2cc47d02de967d4
SHA1241e39b0b51028ab451f0abb2e39492ce18e2701
SHA2562a5e0c7f3698b8192df5ca2548944632e656eb27f4b3b3bd252b370b7348ad70
SHA5128f01feebc063c0b611c7503f1bbcbd5479fb65f0acc8c66eae91965228c5c8037bafc3393b251d77f2f62d457d2e661b99d703bebac7df269792f030258388ed
-
Filesize
468KB
MD5fd00f62dcb903fbbbe40aeb48a482708
SHA11333d5ef06dfd707e40a1322cb40c08487b3f50d
SHA2563efdb3bf488038cf8c08b690f4bfa469fb49b9d2ed585ba3c88feb0770f37350
SHA512c83ac2be93e05527e09de4ea0b3617bbcbb5747890c7a0b861ad3b55aaaec3d148783a7fcbbacb66b92ede37440d82d41fbfe8a871273f1c6796fdcbe63131a2
-
Filesize
1.2MB
MD510a311357d5a4f66ef3d902a2cf5e35f
SHA1129cf2d957da9f4ebdf330fe238ad7832310bf7a
SHA25699b5a682cc03894a9e95d360127c10a1efd4106ea3ae50a56351f9f2e4f74a59
SHA512d174436e615c0fdd2e0b23b79126e5c83d27add68f49a5cc4c62f12ade893f16669961dd313b2adb79f0a5fbfea686c779b37a569ce800e30d87e6c59cdeff3f
-
Filesize
129KB
MD50ebf8f583abb1ffb40c07b87eae4edb3
SHA1ef91b3245f426b86c2b69fd9678176d3be05c009
SHA25600a481ef9985281177c1f6cc6d055c2bdb719db224637e7eb474a3eaab6305cf
SHA5120bca7bc46019628149afb00cd69d26fd59195c4cbecbb472f9afabf73e8b3eb1da20fdaa4ef03c0776d11b5c8532d16b40a927e4b8b68640067c145cb7e463b4
-
Filesize
1.1MB
MD557d9f8b6e595ef4a02d8630c53fddcc3
SHA1523dedd35613dc3221657876a3f5248e38e2a842
SHA256c9a2b8ff0be921e2ac2ff6993f7fecc486b02969254884f89af3a19babfcf7e6
SHA512e95f144caa3bb636fd4a085a24a41d95ac6dae1c47d729400bb65a37527863b02b15e98cb62121f2155956f8a2b177f3b1a11d9ba08881858924d9bd75be985e
-
Filesize
2.6MB
MD5ba75680a2b710f7d2c575e816000f041
SHA1a36e8bf8635473494cf58953227b21facdfd2682
SHA2564c4c9cf71e8eb6f83fe875ad657512f1405648b30472df6597d92a679ee51801
SHA5124408149541ab4b6eda6c9d6b95995be64773559701a18096c283e503fa3b5b22b624db5956c7916f4cecd80c47036e13b100dd51069ef23292749ef4a89bfbb3
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9