8c7cfdd7fcb3c9ab2daf33bde7235cfb866a2fdbc0367db7969f0b685ddaa272

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Size 1.2MB
Sample240530-kc94ssch33
SHA256 8c7cfdd7fcb3c9ab2daf33bde7235cfb866a2fdbc0367db7969f0b685ddaa272
MD5 8393d7df32d8a57a6130b14a58c047d4
SHA1 2bed4d89af4981dfbee55fde78104aabb77acab5
SHA512 fda4ea2606b21aa70d6a9276dd29e221d72a823e6f011e49e97657fcfd1a105666aaceefc7c1fd3c22255f05794b80bb70a1e9ab01a76f3cd6f8b161924a0220
SSDEEP 24576:xJLXJeWGyTm5+i/z4S/AfEHlMCDHJuB3G5WGo5BH+:LjJef+m9L/AM9DHJcjr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023341-54.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
464	skywidget.exe
1164	skywidgeter.exe
4884	skywidgeted.exe
1768	skywidgets.exe

Loads dropped DLL 31 IoCs

pid	Process
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023341-54.dat	upx
behavioral2/memory/560-60-0x00000000035D0000-0x00000000035E2000-memory.dmp	upx
behavioral2/memory/560-59-0x00000000035D0000-0x00000000035E2000-memory.dmp	upx
behavioral2/memory/560-65-0x00000000035D0000-0x00000000035E2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Skywidget = "\"C:\\Program Files (x86)\\Skywidget\\skywidgets.exe\" subcmd"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skywidgetRun = "\"C:\\Program Files (x86)\\Skywidget\\skywidget.exe\" subcmd"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SkywidgetUpDates = "C:\\Program Files (x86)\\Skywidget\\skywidgeted.exe"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\ = "skywidget"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\NoExplorer = "1"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Skywidget\skywidgets.exe	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
File created	C:\Program Files (x86)\Skywidget\skywidget_sajulove_new.dll	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
File created	C:\Program Files (x86)\Skywidget\skywidget.exe	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
File created	C:\Program Files (x86)\Skywidget\uninstall.exe	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
File created	C:\Program Files (x86)\Skywidget\skywidgeter.exe	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
File created	C:\Program Files (x86)\Skywidget\skywidget.dll	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
File created	C:\Program Files (x86)\Skywidget\skywidgeted.exe	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1588	sc.exe
2820	sc.exe
3064	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
228	schtasks.exe
968	schtasks.exe
1948	schtasks.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A739130E-2FF2-4221-996B-765BCCB5C97E}\ = "enteri"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\ProgID	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\0	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\0\win32\ = "C:\\Program Files (x86)\\Skywidget\\skywidget.dll"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO.1	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\ = "skywidget"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\VersionIndependentProgID	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\0\win32	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO\CLSID	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\InprocServer32\ThreadingModel = "Apartment"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\ = "enteri 1.0 Çü½Ä ¶óÀÌºê·¯¸®"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\TypeLib	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\ProxyStubClsid32	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\TypeLib\ = "{DF5E4044-3CF7-41DC-B56C-333BC114FF55}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\TypeLib\Version = "1.0"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\AppID = "{A739130E-2FF2-4221-996B-765BCCB5C97E}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\TypeLib\ = "{DF5E4044-3CF7-41DC-B56C-333BC114FF55}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\TypeLib\Version = "1.0"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO.1\ = "enteriSO Class"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\Programmable	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\TypeLib	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\FLAGS	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO\ = "enteriSO Class"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO\CLSID\ = "{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO\CurVer	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\InprocServer32	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO.1\CLSID	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\VersionIndependentProgID\ = "enteri.enteriSO"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\HELPDIR	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\HELPDIR\	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO\CurVer\ = "enteri.enteriSO.1"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\ProgID\ = "enteri.enteriSO.1"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\ProxyStubClsid32	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\ = "IenteriSO"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF5E4044-3CF7-41DC-B56C-333BC114FF55}\1.0\FLAGS\ = "0"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\TypeLib	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A739130E-2FF2-4221-996B-765BCCB5C97E}	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\enteri.DLL	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}\InprocServer32\ = "C:\\Program Files (x86)\\Skywidget\\skywidget.dll"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\ = "IenteriSO"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBBE63ED-F7CA-453C-999C-56D28AB88751}\TypeLib\ = "{DF5E4044-3CF7-41DC-B56C-333BC114FF55}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\enteri.DLL\AppID = "{A739130E-2FF2-4221-996B-765BCCB5C97E}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\enteri.enteriSO.1\CLSID\ = "{2D28F96A-5FC7-4D36-A3FC-128B0FFB9C30}"	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
464	skywidget.exe
464	skywidget.exe
1768	skywidgets.exe
1768	skywidgets.exe
1164	skywidgeter.exe
1164	skywidgeter.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
464	skywidget.exe
1768	skywidgets.exe
1164	skywidgeter.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
464	skywidget.exe
464	skywidget.exe
1164	skywidgeter.exe
1164	skywidgeter.exe
4884	skywidgeted.exe
4884	skywidgeted.exe
1768	skywidgets.exe
1768	skywidgets.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1792	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	94
PID 560 wrote to memory of 1792	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	94
PID 560 wrote to memory of 1792	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	94
PID 1792 wrote to memory of 228	1792	cmd.exe	96
PID 1792 wrote to memory of 228	1792	cmd.exe	96
PID 1792 wrote to memory of 228	1792	cmd.exe	96
PID 560 wrote to memory of 464	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	97
PID 560 wrote to memory of 464	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	97
PID 560 wrote to memory of 464	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	97
PID 560 wrote to memory of 2416	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	98
PID 560 wrote to memory of 2416	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	98
PID 560 wrote to memory of 2416	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	98
PID 2416 wrote to memory of 968	2416	cmd.exe	100
PID 2416 wrote to memory of 968	2416	cmd.exe	100
PID 2416 wrote to memory of 968	2416	cmd.exe	100
PID 560 wrote to memory of 4344	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	101
PID 560 wrote to memory of 4344	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	101
PID 560 wrote to memory of 4344	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	101
PID 4344 wrote to memory of 1948	4344	cmd.exe	103
PID 4344 wrote to memory of 1948	4344	cmd.exe	103
PID 4344 wrote to memory of 1948	4344	cmd.exe	103
PID 464 wrote to memory of 3064	464	skywidget.exe	104
PID 464 wrote to memory of 3064	464	skywidget.exe	104
PID 464 wrote to memory of 3064	464	skywidget.exe	104
PID 560 wrote to memory of 1164	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	106
PID 560 wrote to memory of 1164	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	106
PID 560 wrote to memory of 1164	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	106
PID 560 wrote to memory of 4884	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	107
PID 560 wrote to memory of 4884	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	107
PID 560 wrote to memory of 4884	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	107
PID 560 wrote to memory of 1768	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	108
PID 560 wrote to memory of 1768	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	108
PID 560 wrote to memory of 1768	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	108
PID 560 wrote to memory of 2816	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	109
PID 560 wrote to memory of 2816	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	109
PID 560 wrote to memory of 2816	560	8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe	109
PID 1164 wrote to memory of 1588	1164	skywidgeter.exe	110
PID 1164 wrote to memory of 1588	1164	skywidgeter.exe	110
PID 1164 wrote to memory of 1588	1164	skywidgeter.exe	110
PID 1768 wrote to memory of 2820	1768	skywidgets.exe	112
PID 1768 wrote to memory of 2820	1768	skywidgets.exe	112
PID 1768 wrote to memory of 2820	1768	skywidgets.exe	112

C:\Users\Admin\AppData\Local\Temp\8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd /C schtasks /Create /F /TN "swgWin" /SC ONLOGON /TR "'C:\Program Files (x86)\Skywidget\skywidget.exe' schcmd" /rL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /F /TN "swgWin" /SC ONLOGON /TR "'C:\Program Files (x86)\Skywidget\skywidget.exe' schcmd" /rL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:228
- C:\Program Files (x86)\Skywidget\skywidget.exe
  "C:\Program Files (x86)\Skywidget\skywidget.exe" Updatecmd
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\sc.exe
    sc query npf
    3⤵
    - Launches sc.exe
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  cmd /C schtasks /Create /F /TN "SkyWidgetSystem" /SC ONLOGON /TR "'C:\Program Files (x86)\Skywidget\skywidgets.exe' schcmd" /rL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /F /TN "SkyWidgetSystem" /SC ONLOGON /TR "'C:\Program Files (x86)\Skywidget\skywidgets.exe' schcmd" /rL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:968
- C:\Windows\SysWOW64\cmd.exe
  cmd /C schtasks /Create /F /TN "skywidgeter" /SC ONLOGON /TR "'C:\Program Files (x86)\Skywidget\skywidgeter.exe' Runcmd" /rL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /F /TN "skywidgeter" /SC ONLOGON /TR "'C:\Program Files (x86)\Skywidget\skywidgeter.exe' Runcmd" /rL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1948
- C:\Program Files (x86)\Skywidget\skywidgeter.exe
  "C:\Program Files (x86)\Skywidget\skywidgeter.exe" Updatecmd
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\sc.exe
    sc query npf
    3⤵
    - Launches sc.exe
    PID:1588
- C:\Program Files (x86)\Skywidget\skywidgeted.exe
  "C:\Program Files (x86)\Skywidget\skywidgeted.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4884
- C:\Program Files (x86)\Skywidget\skywidgets.exe
  "C:\Program Files (x86)\Skywidget\skywidgets.exe" Updatecmd
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\sc.exe
    sc query npf
    3⤵
    - Launches sc.exe
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DelUS.bat

Path C:\DelUS.bat
Size 228B
SHA256 f5495481973a089928da96c6d448ee274a64630ea52558b1a89554353fee7d7e
MD5 0f3a5948298a9eac1b8666837727778e
SHA1 17988ba1b91b8e6ac6ae55494baf602ed9f1cf57
SHA512 ce7a646077fdd206304ad038b6d0d041d9457f8127724ece413e1d30cca0b2b29f6c4bccbe4e74fe89bf1191252c326d4575b903e62250bb25e91d8a3fbe5160
MD5 SHA1 SHA512

Submit Download

skywidget.dll

Path C:\Program Files (x86)\Skywidget\skywidget.dll
Size 394KB
SHA256 215db10bc99f164c478947bc8764599f92dd13825df7c3976a9add160fd84425
MD5 00949b125a4b3c061d08936567cf5e98
SHA1 f8ab4d07b6e74f2665e5f84ff49d028f42d92735
SHA512 4f159d8f6ea53156e6649c4aa888f525994853e66ff132b246c99c887d75af66c72ca4246554c8b4b36b6b8df0316fa9e651a2f69b2a773bcdee60971ea6dac4
SSDEEP 6144:MzwKvibsrgK8WxCJYdS9jUVBrSZuKMKJWjWRhMIl:Mz3K4kKKWSYKM1jYMIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

skywidget.exe

Path C:\Program Files (x86)\Skywidget\skywidget.exe
Size 406KB
SHA256 a051240474ebdd520d7e144be42327eb6d031877eebcd317799d9cd5506838f6
MD5 121134436747e494349071ae5fd3374c
SHA1 071412c2bde1d2a021b981831d744f2f789d01fb
SHA512 eb9dfd3c2898c11ac82b7087386f1fa0cb8d9a8c870d4809dd47055d46d150abab6182b9a47a1a463f6926c8b351774db24756a6bbd62f687c1690b66a58bc95
SSDEEP 6144:LfC3g+wZVaOjHb/+O1R0b7cKPFFRDZ85zqNOfBCY9mCOmga2Mf:Lfd+wZMOHmbY6FZ85zRzmagR
MD5 SHA1 SHA512 SSDEEP

Submit Download

skywidgeted.exe

Path C:\Program Files (x86)\Skywidget\skywidgeted.exe
Size 578KB
SHA256 25190a20daf29836a63a18abe96e0c3bd7409d1c04e654c615b61f1c0d4fb6fa
MD5 e1e03923033ef166bb15011e66121ac4
SHA1 c8ab795189c08ff24caeb32c39e0f3c4f6e72395
SHA512 44e1bb79e10d25e5db5b786511a1eef89c5a945d77dfa1269188840db935efd876c5822f891a77b9e411dd28436f05823ff92f35eaf22033cd90cbf2fa9389d5
SSDEEP 6144:2Wpv43MCMsnMa4VqaeQhaXScUTNgSiK6f43h96RCFEdioAig7+KBWTxd:2Wpv+MH2aVatUTNgSiv7RCfoAig78x
MD5 SHA1 SHA512 SSDEEP

Submit Download

skywidgeter.exe

Path C:\Program Files (x86)\Skywidget\skywidgeter.exe
Size 366KB
SHA256 ad300d5180b5d5effb70eac81be707e58f13aa328bc03ae12ea09331fe3fc62a
MD5 b8e601ec45dda3531bd7302b64cb254c
SHA1 dce10e74b9373075817f3453351e14b62dfae112
SHA512 228c1a0f1add618ddbf648cafd7ec7f3e4264e8d2015bc98e44b915aa68420a97d9bba031a68561cce697416c8e1da5e9f4fa2bf43a7e712e7d3e337abf7ee8b
SSDEEP 6144:5Vz9umS0sF9Kw1T1SpoJCZyqqyXV2JM6twCeNjKs:5Vh49KKhioJ2yqrsJvwCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

skywidgets.exe

Path C:\Program Files (x86)\Skywidget\skywidgets.exe
Size 386KB
SHA256 df90b340b912983f1c49d9f63b00375a5274ededb8bef3c901d0fed31476d389
MD5 ddccd6e8903414bd4f80246926379ed1
SHA1 d19177ad5b02a4d40a5e4393edd786511841cb87
SHA512 452f5dd1b2d1feb1e1d9571644678daeacb216ad2e15e8af011817525df6cf5c97ff93df9e729a4048d782b08c491377959086c12e610751a8358b14ff03f9bd
SSDEEP 6144:GLYdfzIxHkFk1tVbalFMc76mMig5olK3V00uJbNm7Lrdi5PJssl/F:GEVEqkag/Eg5olK3viNK8is
MD5 SHA1 SHA512 SSDEEP

Submit Download

DLLWebCount.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3AC9.tmp\DLLWebCount.dll
Size 32KB
SHA256 9c5f4eeadc9c2881bc02b45d757b35d3bfd2dc7d917d2e8fde2917fabf48908f
MD5 248536afcb6f59c1797f079a0da15b63
SHA1 7fa238f871b357c66168728ab1bb38addcfba3f8
SHA512 b82accc8530650ebae8d4f8752002c2d23ab7b29e958e6c14731ad186a0fcdbbab937723a540de62d58f4659580843191fd53cb415e07167d7b55cd174a79652
SSDEEP 96:jos0e13nQHmwy5PFlufG/cg6TGkB4iuzJFGA98ONfeZEWVCxCSvONfeZEWVArmdj:josH1XZwy5NbgB5KPdNeTYgNeT6dba1
MD5 SHA1 SHA512 SSDEEP

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3AC9.tmp\FindProcDLL.dll
Size 32KB
SHA256 0ac175b28d2a156e71bda214d4a35321c85d434e325624564f0a5eee23c718be
MD5 849abe37c3b8a6dd48089b769ee789c5
SHA1 81d5d6c4d6328059a07ae59878c717211a726512
SHA512 fa1f60aa1e26dffe6a0b2ee8cba6490cc2d1f94613777466ce434a71431bd88f8c3964718f3ea1dd2c8ca41847cc259999bb293ea2591f4f0a0add286229f76f
SSDEEP 384:kZgOCgkqzx8Cu8d1VKZA9dHC8rotc8dfa3FvCyj72y4hUqAbso4AH:kZhCgkqzCsd1AoaWUgSJORbsopH
MD5 SHA1 SHA512 SSDEEP

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3AC9.tmp\KillProcDLL.dll
Size 32KB
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SelfDelete.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3AC9.tmp\SelfDelete.dll
Size 24KB
SHA256 2f4767da9dc7e720d910d32d451674cd08b7892ca753ec5c10b11fe85e12f06b
MD5 ddc0d6806073a5b034104c88288ca762
SHA1 9663cc10c496f05d6167e19c3920245040e5e431
SHA512 545ca797a397cfcbd9b5d3bd2da2e3219ba7a294e541831655c5763a7f17480fd0b990d0c2e58ba8c71f81d85472b2da6d079b8211b44c40c8c36d21168ec054
SSDEEP 96:kloL9cOmJnnH/4zN0TZquBog7OzRN5wmglWFq7PJv7PJaGvhWf89WrTXEGNR9j:klQcrKR0TDBFcN0lR9hvhWEAEYRB
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3AC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

version.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv3AC9.tmp\version.dll
Size 22KB
SHA256 31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
MD5 fbe588b15eb1bd86defade69f796b56f
SHA1 2f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA512 e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
SSDEEP 384:6Qx38r8QfiLpVjOXf4Rrd2IpZn8LI2EdGZ5D6PDo3rsyfyC8n:6Qx38r8Qgp1OvYd2zqGZ5D6PDmXf98
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-105-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-102-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-131-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-130-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-129-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-128-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-103-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-104-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-65-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-59-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download

memory/560-60-0x00000000035D0000-0x00000000035E2000-memory.dmp

Download