Malware Analysis Report

2024-10-18 21:17

Sample ID 240517-ekrpjagf38
Target 4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118
SHA256 4ae82c978e89401819473fd0ac2e19c967619815cb81d26acdc5cce4ed19cbb4
Tags
emotet epoch3 banker trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ae82c978e89401819473fd0ac2e19c967619815cb81d26acdc5cce4ed19cbb4

Threat Level: Known bad

The file 4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

emotet epoch3 banker trojan

Emotet

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-17 04:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 04:00

Reported

2024-05-17 04:02

Platform

win7-20240419-en

Max time kernel

143s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe"

Signatures

Emotet

trojan banker emotet

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\SysWOW64\langsripple.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-41-ac-be-8c-37\WpadDetectedUrl C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC657CE2-4C82-418F-A42D-ADE852ACB211}\WpadDecision = "0" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-41-ac-be-8c-37 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC657CE2-4C82-418F-A42D-ADE852ACB211} C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC657CE2-4C82-418F-A42D-ADE852ACB211}\WpadNetworkName = "Network 3" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC657CE2-4C82-418F-A42D-ADE852ACB211}\WpadDecisionTime = d073db010fa8da01 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-41-ac-be-8c-37\WpadDecisionTime = d073db010fa8da01 C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\langsripple.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC657CE2-4C82-418F-A42D-ADE852ACB211}\WpadDecisionReason = "1" C:\Windows\SysWOW64\langsripple.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-41-ac-be-8c-37\WpadDecisionReason = "1" C:\Windows\SysWOW64\langsripple.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-41-ac-be-8c-37\WpadDecision = "0" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-41-ac-be-8c-37\WpadDecisionTime = b01854c80ea8da01 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC657CE2-4C82-418F-A42D-ADE852ACB211}\WpadDecisionTime = b01854c80ea8da01 C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FC657CE2-4C82-418F-A42D-ADE852ACB211}\62-41-ac-be-8c-37 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\SysWOW64\langsripple.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7} C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4E57EF~1.EXE" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Windows\\SysWOW64\\LANGSR~1.EXE" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Windows\\SysWOW64\\LANGSR~1.EXE" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Windows\SysWOW64\langsripple.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Windows\SysWOW64\langsripple.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4E57EF~1.EXE" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\langsripple.exe N/A
N/A N/A C:\Windows\SysWOW64\langsripple.exe N/A
N/A N/A C:\Windows\SysWOW64\langsripple.exe N/A
N/A N/A C:\Windows\SysWOW64\langsripple.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe

--96a0d3cf

C:\Windows\SysWOW64\langsripple.exe

"C:\Windows\SysWOW64\langsripple.exe"

C:\Windows\SysWOW64\langsripple.exe

--2331fcab

Network

Country Destination Domain Proto
AR 190.16.101.10:80 tcp
AR 190.16.101.10:80 tcp
VE 190.217.1.149:80 tcp
VE 190.217.1.149:80 tcp
US 45.56.122.75:80 tcp
US 45.56.122.75:80 tcp
FR 85.25.92.96:8080 tcp
FR 85.25.92.96:8080 tcp

Files

memory/2320-0-0x0000000000310000-0x0000000000327000-memory.dmp

memory/2320-5-0x00000000002D0000-0x00000000002E1000-memory.dmp

memory/108-6-0x00000000002F0000-0x0000000000307000-memory.dmp

memory/2404-11-0x00000000006F0000-0x0000000000707000-memory.dmp

memory/108-16-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2668-17-0x0000000000B10000-0x0000000000B27000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 04:00

Reported

2024-05-17 04:02

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe"

Signatures

Emotet

trojan banker emotet

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\SysWOW64\loadabuilder.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\SysWOW64\loadabuilder.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\SysWOW64\loadabuilder.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\SysWOW64\loadabuilder.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\loadabuilder.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7} C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Windows\\SysWOW64\\LOADAB~1.EXE" C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4E57EF~1.EXE" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Windows\\SysWOW64\\LOADAB~1.EXE" C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4E57EF~1.EXE" C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Windows\SysWOW64\loadabuilder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" C:\Windows\SysWOW64\loadabuilder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" C:\Windows\SysWOW64\loadabuilder.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\4e57efc86bd3ffbba00f7b48ecad40b0_JaffaCakes118.exe

--96a0d3cf

C:\Windows\SysWOW64\loadabuilder.exe

"C:\Windows\SysWOW64\loadabuilder.exe"

C:\Windows\SysWOW64\loadabuilder.exe

--d4954212

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
AR 190.16.101.10:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
VE 190.217.1.149:80 tcp
US 45.56.122.75:80 tcp
FR 85.25.92.96:8080 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
GB 94.177.253.126:80 tcp
MX 187.188.166.192:80 tcp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

memory/3108-1-0x0000000000710000-0x0000000000727000-memory.dmp

memory/3108-5-0x00000000006F0000-0x0000000000701000-memory.dmp

memory/2568-6-0x0000000002220000-0x0000000002237000-memory.dmp

memory/2536-12-0x0000000000E20000-0x0000000000E37000-memory.dmp

memory/2568-17-0x0000000000400000-0x000000000043E000-memory.dmp

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\e067bc2560d38144183d820119c466a0_39fbc0df-d496-4ae0-b1d7-bde60e245d90

MD5 c6b4ed23b646d09be518590697d71aae
SHA1 cbcead300f943e7512750e9bd85af4d8df3eecea
SHA256 6c756bd7a9b936a087c0f1df8f46cc17de4698b2cec67e2a28bfe589bc656cb1
SHA512 24306f7480814a03901475af646a04df9d9f912201c51643d33584a808db928060a72ee634e5ee1649117c9f4c8605fea495aabba51111533d9f98fe265d6c9b

memory/1584-19-0x0000000000DD0000-0x0000000000DE7000-memory.dmp